Data protection officer requirements

When a DPO is legally required: Article 37 of the UK GDPR

Article 37(1) of the UK General Data Protection Regulation (UK GDPR) sets the only three cases in which a controller or a processor must designate a data protection officer. Article 37 of the UK GDPR reads: “The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts and tribunals acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.”

The words “and tribunals” were inserted on 20 August 2025 by paragraph 11 of Schedule 11 to the Data (Use and Access) Act 2025. Since 30 September 2026 the regulator has been the Information Commission, still known as the ICO: section 118 of the Data (Use and Access) Act 2025, commenced by SI 2026/1015, abolished the office of the Information Commissioner, and SI 2026/386 made Article 37(7) and Article 39 read “the Commission”. Those are the only changes the 2025 Act and the regulations under it have made to Articles 37 to 39. The Act did not abolish or rename the DPO, and there is no “senior responsible individual” in UK law; that proposal was in the Data Protection and Digital Information Bill, which fell in 2024 without becoming law. The ICO's page on data protection officers, read live on 1 November 2026, still says “except for courts acting in their judicial capacity” and notes that it is under review because of the Act; the Article is the current law.

Any other organisation may appoint a DPO voluntarily under Article 37(4), and the ICO says that if it does, “the same requirements of the position and tasks apply had the appointment been mandatory.” The same rules apply either way. A data protection lead who is not the DPO should not be called one, because the DPO, in the ICO's words, “is a specific role with particular requirements under the UK GDPR”. The test applies to processors, such as a payroll or software supplier, on their own account as well as to controllers.

Who needs a data protection officer: the answer by sector

Limb (a) turns on a closed definition. Subsection (1) of section 7 of the Data Protection Act 2018 reads: “For the purposes of the UK GDPR, the following (and only the following) are ‘public authorities’ and ‘public bodies’ ...– (a) a public authority as defined by the Freedom of Information Act 2000, (b) a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002 (asp 13), (ba) the Advanced Research and Invention Agency, and (c) an authority or body specified or described by the Secretary of State in regulations, subject to subsections (2), (3) and (4).” Under section 7(2), a body on that list counts as a public authority for the UK GDPR only “when performing a task carried out in the public interest or in the exercise of official authority vested in it”, and section 7(3) leaves out parish councils in England, community councils in Wales and Scotland, parish and community meetings and charter trustees.

So the first question is whether the organisation is a public authority under the Freedom of Information Act 2000 or the Scottish Act: listed in Schedule 1 to the Freedom of Information Act 2000 or its Scottish equivalent, designated by order, or a company wholly owned by public bodies (section 3(1) of each Act). For the sectors this guide covers:

• Maintained schools and maintained nursery schools. Paragraph 52 of Schedule 1 lists “The governing body of– (a) a maintained school, as defined by section 20(7) of the School Standards and Framework Act 1998, or (b) a maintained nursery school, as defined by section 22(9) of that Act.” The governing body is a public authority and must have a DPO. This applies in England and Wales.
• Academies and multi-academy trusts. Paragraph 52A lists “The proprietor of an Academy, in respect of information held for the purposes of the proprietor's functions under Academy arrangements.” The proprietor is the academy trust, so the duty sits with the trust rather than each academy.
• Schools in Northern Ireland. Paragraph 54 lists the managers of controlled, voluntary and grant-maintained integrated schools, so they must have a DPO.
• Council schools in Scotland. A public school is “any school under the management of an education authority”, and the education authority is the council (Education (Scotland) Act 1980, section 135(1)). The council is a Scottish public authority, so a Scottish council school's DPO is the council's.
• Bodies designated in Scotland. Grant-aided schools, independent special schools and providers of secure accommodation services are designated Scottish public authorities for those functions by SSI 2016/139, and registered social landlords for their housing services by SSI 2019/143. Many are charities, and each must have a DPO.
• Other independent schools. Elsewhere an independent school is not on the list, so limb (a) does not apply and only limbs (b) and (c) can.
• Charities. Being a charity does not make an organisation a public authority, so for most charities only limbs (b) and (c) can apply. Academy trusts, which are charities, are the main exception in England, alongside the Scottish bodies above.
• Care providers. An independent care home, home care agency or supported living provider is not on the list, so in practice limb (c) is the one to test. A home run directly by a council is covered by the council's DPO, because the council is the public authority. A company wholly owned by a council is a public authority in its own right and needs its own DPO, though Article 37(3) lets it share the council's.
• Private nurseries, pre-schools and childminders. Not on the list, so limb (a) does not apply. A nursery class run by a maintained school is part of that school and falls under its governing body's DPO; a private or voluntary nursery that only uses the school's site is a separate provider.

For every organisation that is not a public authority, the whole question is limbs (b) and (c), and both turn on two phrases the UK GDPR does not define: “core activities” and “large scale”.

Core activities and large scale: how to decide, and what to record

The ICO's guidance on data protection officers defines the first phrase: “Your core activities are the primary business activities of your organisation. So, if you need to process personal data to achieve your key objectives, this is a core activity.” Processing for “other secondary purposes”, which it illustrates with “payroll or HR information”, is not. So for most organisations, staff sickness records, payroll and DBS certificates do not trigger the duty on their own, however many there are.

For “large scale”, the ICO relies on the DPO guidelines of the former Article 29 Working Party and says: “When determining if processing is on a large scale, the guidelines say you should take the following factors into consideration:

• the numbers of data subjects concerned;
• the volume of personal data being processed;
• the range of different data items being processed;
• the geographical extent of the activity; and
• the duration or permanence of the processing activity.”

The ICO's example of limb (c) is an insurer: “A health insurance company processes a wide range of personal data about a large number of individuals, including medical conditions and other health information. This can be considered as processing special category data on a large scale.” Limb (b) is about “all forms of tracking and profiling, both online and offline”, such as behavioural advertising. In our reading it rarely fits a school, charity or care provider, but test it where tracking or profiling people is part of the service itself.

Neither the UK GDPR nor the ICO sets a number, so applying the factors is a judgement; put figures against each one. How the questions run, in our reading rather than the ICO's:

• A care group or home care agency. Care cannot be given without health information about every person supported, so the special category data is part of the core activity and the question is scale. A group of homes, or an agency supporting several hundred people with records kept for years, sits further along each factor than a single small home; neither is automatically in or out.
• A charity running counselling, advocacy or health support. The health information is the service, so the same scale question applies. A charity whose only special category data is about its own staff and volunteers is in the HR position the ICO calls secondary.
• An independent special school outside Scotland, or a nursery group. Health and special educational needs information is part of educating every pupil; a nursery holds allergy and medical details for each child. Whether that is large scale depends on the numbers, range and duration.

Write the decision down. The ICO says: “If you decide that you don’t need to appoint a DPO, either voluntarily or because you don’t meet the above criteria, it’s a good idea to record this decision to help demonstrate compliance with the accountability principle.” A useful record names the limb, gives the figures for each factor, states the conclusion and who reached it, and sets a review date, such as the next new service or merger. Not needing a DPO does not remove the work: the ICO adds that “you must ensure that your organisation has sufficient staff and resources to discharge your obligations under the UK GDPR.”

Data protection officer role requirements: Articles 37 to 39

Knowledge. Article 37(5) requires a DPO to be designated “on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.” No qualification or certificate is prescribed; the ICO says the level of knowledge “should be proportionate to the type of processing you carry out”.

Employee, contractor or shared. Under Article 37(6) the DPO “may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract”, and the ICO says an external DPO “should have the same position, tasks and duties as an internally-appointed one.” A service contract is the basis on which external DPO services are bought in. A group of undertakings may share one DPO provided the DPO is “easily accessible from each establishment” (37(2)), and several public authorities may share one, “taking account of their organisational structure and size” (37(3)); the ICO says a shared DPO “must still be able to perform their tasks effectively”. There is one designated DPO, though the ICO says a team of data protection specialists may support them.

No conflict of interests. Article 38(6) of the UK GDPR allows other duties that “do not result in a conflict of interests”. The ICO says this means “the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data”, while “a public authority could appoint its existing FOI officer / records manager as its DPO.”

Article 38 then sets what the organisation owes the post:

• Involvement. The DPO must be “involved, properly and in a timely manner, in all issues which relate to the protection of personal data” (38(1)), and given the resources, access to personal data and support to keep their knowledge up to date (38(2)).
• Independence. The DPO “does not receive any instructions regarding the exercise of those tasks” and “shall not be dismissed or penalised” for performing them (38(3)).
• Board level. The DPO “shall directly report to the highest management level” (38(3)), which the ICO glosses as “ie board level”, adding: “This doesn’t mean the DPO has to be line managed at this level but they must have direct access to give advice to senior managers who are making decisions about personal data processing.”
• Open to the people whose data it is. Any data subject may contact the DPO about the processing of their data and the exercise of their rights (38(4)), so subject access and other data subject requests can go to the DPO, and the DPO “shall be bound by secrecy or confidentiality concerning the performance of his or her tasks” (38(5)).

The tasks. Article 39(1) of the UK GDPR sets the minimum: to inform and advise the organisation and its staff; to monitor compliance with data protection law and the organisation's policies, “including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits”; to advise, where asked, on data protection impact assessments and monitor their performance; “to cooperate with the Commission”; and “to act as the contact point for the Commission”. Under Article 39(2) the DPO works with “due regard to the risk associated with processing operations”, and the ICO says “the DPO’s tasks cover all personal data processing activities, not just those that require their appointment under Article 37(1).” And the ICO sets the habit that makes the role real: “If you decide not to follow the advice given by your DPO, you should document your reasons to help demonstrate your accountability.”

For how the DPO role works in a school – the governing board or trust board as the highest management level, and whether a headteacher or business manager can hold the post – see the guide to the data protection officer for schools.

Publishing the DPO's details, telling the ICO, and the fines

Article 37(7) reads: “The controller or the processor shall publish the contact details of the data protection officer and communicate them to the Commission.” The contact details must be published; the name need not be. The ICO says “You aren’t required to include the name of the DPO when publishing their contact details but you can choose to provide this if you think it’s necessary or helpful”, and then: “However, remember you do have to provide your DPO’s name if you report a personal data breach to the ICO and to those individuals affected by it.”

The ICO says the contact details must also be given in privacy information under Articles 13 and 14 and when consulting the ICO about an impact assessment under Article 36, and recorded in the record of processing activities. A role mailbox, rather than a person's own address, keeps the published details right when the person changes.

The organisation, as data controller, is responsible for data protection compliance, not the DPO. The ICO says “The DPO isn’t personally liable for data protection compliance. As the controller or processor it remains your responsibility to comply with the UK GDPR.” Appointing a DPO does not move a trust board's, trustees' or directors' accountability onto the DPO.

Failing to designate a DPO when one is required, or to give the post what Articles 38 and 39 require, falls in the lower fine tier. Article 83(4) of the UK GDPR covers “the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43”, and sets fines “up to £8,700,000, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”; section 157(1)(a) of the Data Protection Act 2018 applies that amount. The £17.5 million or 4% tier does not apply to infringements of the DPO articles themselves, though failing to comply with an enforcement notice can reach it (section 157(4)).

The DPO's advice, and the decision made in a message

The ICO asks organisations to write down their reasons when they do not follow their DPO's advice, and Article 38(1) wants the DPO involved in time. In trusts, charities and care groups, both the advice and the decision often travel by message. A care group's operations director texts the external DPO on a Friday to ask whether a new rota app needs an impact assessment; the DPO says it does; the director replies that it goes live on Monday and the assessment can follow. A registered manager asks in a managers' group chat whether she can email a resident's care plan to a relative's personal address. A care worker reports a lost phone holding residents' details, a security incident, to her manager by text at midnight. A trustee forwards a donor's complaint, name and all, to the DPO's personal number.

Each of those is what the accountability principle asks an organisation to be able to show: the advice, the reasons for departing from it, and whether the DPO was asked before the decision or after. In a consumer messaging app on personal phones, the organisation cannot reliably produce them for its board or the ICO, and they leave with whoever leaves – including an external DPO whose contract ends.

ComplyChat provides channels for those work conversations that the organisation controls. A mobile number verified by SMS is the identity, so an external DPO, a bank worker or a trustee with no work account can be in the same channel as the managers, and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, and on paid plans, once the organisation's Microsoft 365 tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat is not a DPO service or a compliance system, and it does not replace the impact assessment, the record of processing or the breach log. If your DPO's advice already arrives by email to work accounts and is filed, you do not need us for this.

A question for the next board meeting: the last time your DPO advised against something, where is that advice now, and where are the reasons for going ahead?

Questions people ask

Is a DPO legally required?

A data protection officer is legally required only in the three cases in Article 37(1) of the UK GDPR: a public authority or body, core activities that need large-scale regular and systematic monitoring of people, or core activities that consist of large-scale processing of special category or criminal offence data. Any other organisation may appoint one voluntarily, and the ICO advises recording a decision not to.

How to become a data protection officer?

No qualification is prescribed. Article 37(5) requires “expert knowledge of data protection law and practices”, which the ICO says should be proportionate to how complex and risky the processing is, adding that “It would be an advantage for your DPO to also have a good knowledge of your industry or sector”.

Does a charity need a data protection officer?

Most charities do not, because a charity is not usually a public authority under section 7 of the Data Protection Act 2018. The exceptions are academy trusts in England, which are public authorities under the Freedom of Information Act 2000; charities designated as Scottish public authorities, such as registered social landlords for their housing services; and charities whose core activities involve large-scale processing of special category data such as health records.

Does a care home need a data protection officer?

An independent care provider is not a public authority, so it needs a DPO only if its core activities consist of large-scale processing of special category data such as health information. The ICO's factors are the number of people, the volume and range of data, the geographical extent and the duration or permanence of the processing. On those factors a group of homes is more likely to meet the test than a single small home, in our reading, but it is a judgement the provider must make, and the ICO advises recording a decision not to appoint.

Can a data protection officer be outsourced or shared?

Yes. Article 37(6) lets the DPO be a staff member or work under a service contract, Article 37(2) lets a group of undertakings share one, and Article 37(3) lets several public authorities share one. The ICO says an external DPO “should have the same position, tasks and duties as an internally-appointed one”.

Do you have to tell the ICO who your DPO is?

Yes. Article 37(7) requires the organisation to publish the DPO's contact details and communicate them to the Information Commission, the ICO. The ICO says the name need not be published, but must be given when reporting a personal data breach.

Official guidance and your next step

The legal text is in Article 37, Article 38, Article 39 and Article 83 of the UK GDPR, section 7 and section 157 of the Data Protection Act 2018, Schedule 1 to the Freedom of Information Act 2000, and, for Scotland, Schedule 1 to the Freedom of Information (Scotland) Act 2002 with the designation orders SSI 2016/139 and SSI 2019/143. The ICO's data protection officers page in its Guide to accountability and governance is the regulator's guidance, under review since the Data (Use and Access) Act 2025. Legislation is quoted as published on legislation.gov.uk on 1 November 2026, and the ICO page as read live that day.

This guide covers the UK and is not legal advice about a particular organisation. For the sector detail, read the guides to the data protection officer for schools, a small charity's GDPR policy, care home data protection and GDPR for nurseries and childminders.

Then do one thing: find the paper that records whether your organisation needs a DPO. If there is none, write one page against the three limbs and the ICO's five factors, with your own figures, put it to the board and minute the decision. If you already have a DPO, check that the published contact details still reach them.