IT Security & Compliance
Most businesses don't need a Data Protection Officer.
Quite a few have been told otherwise.
Do you actually need one?
The law requires a Data Protection Officer in three situations: you're a public authority, you monitor people systematically on a large scale, or you process special category data — health, biometrics, criminal records — on a large scale.
If none of those describe you, you don't need a DPO, and anyone selling you one as a legal requirement is wrong.
What you almost certainly do need is someone who makes sure the obligations that do apply to you are actually being met. That's a different job, and usually a smaller one.
I'll tell you which you need in the first conversation. It costs nothing, and if the answer is "neither, you're fine", that's what I'll say.
If you do need a DPO
I act as the appointed Data Protection Officer for organisations that require one — including within a healthcare group delivering NHS-commissioned services, where the work covers data protection impact assessments for services handling special category health data and clinical imaging.
What that involves in practice:
- Monitoring compliance — not a one-off audit, an ongoing role
- Data protection impact assessments for new services and significant changes, completed before processing starts rather than afterwards
- Advising on lawful basis, necessity and proportionality — the questions that decide whether something can go ahead at all
- Being the contact point for the Information Commissioner's Office and for individuals exercising their rights
- Reporting to your senior information risk owner or board, independently
Independence, in writing
A Data Protection Officer has to be able to act independently. That's difficult if the same person is also making the IT decisions being assessed.
Where my firm has done work on a system I'm assessing, I declare it in the assessment itself, and I don't review my own work. Where I'm running a client's IT day to day, I won't take the DPO role for them at all — I'll support whoever does.
That declaration goes into the documents, so it can be checked rather than taken on trust. It's also the reason the advice is worth having: a DPO who can't say no isn't doing the job.
If you don't need a DPO — data protection support
Most businesses that come to me are in this position. The obligations are real but the statutory role isn't required, and what's needed is someone to get the work done:
- Records of processing — what data you hold, why, where it lives and how long for
- Policies that match what you actually do, rather than a template that describes somebody else's business
- Subject access requests — the process for handling one before you receive one, and help when you do
- Breach procedure — who does what, in what order, within seventy-two hours
- Supplier due diligence — the contracts and checks for anyone processing data on your behalf
- Staff training — the part everyone skips and every breach report mentions
Your own director stays the accountable person. I do the work.
Where this overlaps with security
Data protection and information security are related but not the same thing, and it's worth being clear about which you're buying.
Cyber Essentials and ISO 27001 are security standards — they're about protecting information from threats. Data protection law is about whether you should be holding that information at all, on what basis, and what the people it describes are entitled to.
Doing one well helps with the other. Neither substitutes for it.
What it costs
Ongoing data protection work — the DPO role, or support where one isn't required — is drawn from your agreed hours, the same as everything else. There's no separate retainer and no annual fee on top.
Larger pieces of work with a defined start and finish, such as a data protection impact assessment for a new service, are billed for the time they take.
Not sure which you need?
That's the most common position to be in. One conversation usually settles it — including when the answer is that you're already fine.