UK GDPR Data Protection Officers

The public-authority test uses section 7 of the Data Protection Act 2018. The other two triggers apply to core activities: primary operations needed to achieve the organisation's objectives, not routine ancillary functions such as most employers' internal payroll or HR administration.

Regular and systematic monitoring includes organised, recurring, or methodical tracking and profiling online or offline. To assess whether processing is large scale, consider the number of people, volume and range of data, geographical extent, and duration or permanence. No single numerical threshold decides the issue.

Select the DPO for professional qualities and expert knowledge appropriate to the processing and protections required. A group may appoint one DPO if each establishment can easily access them, and a public body may share one where organisational structure and size allow. The DPO may be an employee or work under a service contract.

Involve the DPO properly and promptly in personal-data matters. Give them resources, access to data and processing, and support to maintain expertise. They must report directly to the highest management level, receive no instructions about how to perform their DPO tasks, and not be dismissed or penalised for performing those tasks.

Article 39 minimum tasks are to inform and advise the controller or processor and staff; monitor compliance, responsibilities, awareness, training, and audits; advise on DPIAs and monitor their performance; cooperate with the ICO; and act as the ICO contact point. The DPO works with due regard to processing risk.

A DPO may perform other work only if it creates no conflict of interests. A role that decides the purposes and means of processing conflicts with independent oversight of those decisions. Assess the real authority of senior management, IT, security, HR, marketing, product, finance, and operational roles rather than relying on job titles.