Who cannot act as a data protection officer?

Why this question arises at all

An organisation looks for a candidate inside its own structure and asks whom it may appoint. The answers circulating on the market take the form of a list of forbidden positions. No such list exists in the Regulation, and a list without a criterion leads to two opposite mistakes. The first is rejecting a person who determines neither the purposes nor the means of processing. The second is appointing a person outside the list who does in fact decide about those purposes.

The second source of confusion concerns the basis of the prohibition of a conflict of interests. It is sometimes attributed to the guidelines of the Article 29 Working Party, known as WP 243. However, it is laid down in Article 38(6) of the Regulation, which is directly applicable. The guidelines add a criterion and examples of positions to it, not the norm.

The third source is practical. A DPO conflict of interest is sometimes treated as a feature of the candidate that it is enough to assess once, in an interview. Article 38(6), however, imposes the duty to ensure the absence of a conflict on the organisation. Article 24(1) GDPR additionally requires the controller to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the Regulation. A trace of the assessment should therefore remain in the documents.

The same grounds apply to a voluntary designation. The WP 243 guidelines of the Article 29 Working Party state that the requirements of Articles 37 to 39 then apply as if the designation had been mandatory. The conditions of the obligation are described in How to determine if an organization must appoint a DPO?.

What has to be established before a decision

Whom the President of the UODO regards as excluded

The President of the UODO draws the line more clearly than the guidelines. It regards as unacceptable the appointment as DPO of a person managing an entity that is a controller or a processor. As examples it gives a member of a company’s management board, a member of an association’s management board, a school head and a commune head. According to the authority, such a DPO would assess and monitor himself or herself.

The authority has confirmed this position with fines. In the report for 2025 the President of the UODO described a fine on a private entity whose DPO was the president of the management board. The fine concerned an infringement of Article 38(6). In a communication of 31 August 2026 the President of the UODO reported a fine on a court bailiff who for five years had himself acted as DPO in his own office. The bailiff was the controller and assumed that such an arrangement would not result in a conflict of interests. The authority found the designation of the controller to be contrary to the law. It imposed PLN 12,000 for failing to guarantee the DPO a status ensuring independence. A further PLN 3,500 concerned the failure to notify the President of the UODO within 14 days.

The same limit covers a sole trader, because it is the sole trader who is the controller. A written justification does not move it. In the bailiff’s case the authority did not accept the controller’s assessment that there was no conflict. In the course of inspections the UODO also found a conflict of interests where the municipal secretary acted as DPO.

When a DPO conflict of interest arises

Article 38(6) GDPR permits the combining of functions. The data protection officer may fulfil other tasks and duties. The limit is set by the second sentence of that paragraph, which requires the controller or the processor to ensure that any such tasks and duties do not result in a conflict of interests.

The Regulation does not define the conflict itself. The WP 243 guidelines of the Article 29 Working Party state in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. As a rule of thumb, the guidelines say that conflicting positions may include senior management positions. They name chief executive, chief operating, chief financial and chief medical officer. They also name the head of the marketing department, the head of Human Resources and the head of IT departments.

The criterion is functional rather than nominal. The guidelines extend it to other roles lower down in the organisational structure if those roles lead to the determination of purposes and means of processing. They state that the conflict has to be considered case by case in each organisation, because each has its own structure. For managerial positions that do not involve managing the entity, I recommend a written justification of the assessment.

A second source of conflict is pointed out by the President of the UODO. A conflict may result from the DPO acting simultaneously in two roles within the organisation. It may also result from actions or decisions of the DPO that are then subject to his or her own assessment under Article 39(1)(b). The WP 243 guidelines add an example from outside the organisational structure. A conflict of interests may arise if an external DPO is asked to represent the controller or processor before the Courts in cases involving data protection issues.

Which tasks exclude a candidate without a managerial position

A conflict does not require a managerial position. The President of the UODO indicates that three criteria may be helpful in the assessment. They are the organisational, substantive and time criteria. The organisational criterion concerns the DPO’s reporting line. The other two concern the content and the number of his or her other tasks.

In 2025 the President of the UODO answered a question whether a school secretary or a chief HR and payroll specialist may become the DPO. The authority stated that work in the HR and payroll department may involve deciding or co-deciding on the purposes and means of processing. It stressed that this may concern not only the person managing the department. As an example it gave drafting job advertisements, which may require determining the categories of candidates’ data. A second example is the decision whether and which documents to keep in personnel files and for how long. The authority recalled that tasks leading to the determination of the purposes and means of processing cannot belong to the DPO.

The second group consists of tasks that the DPO would later have to assess. In another answer from 2025 the President of the UODO considered that entrusting the DPO with coordinating the handling of breaches should be regarded as unlawful. The same applied to coordinating the handling of requests from data subjects to exercise their rights under Articles 15 to 22 GDPR. The DPO could not then objectively monitor actions that he or she had coordinated. Inspections described in the President of the UODO’s report for 2025 showed that in several entities breaches were documented by the DPO, the deputy or the DPO team. Entrusting them with this task had not been preceded there by a written analysis of the conflict of interests.

The third criterion concerns time. According to the President of the UODO, a conflict of interests may also result from an excess of duties. It arises where the DPO has to choose between tasks because there is not enough time for all of them.

Direct reporting is a duty of the organisation

Article 38(3) GDPR contains three separate norms. The controller and processor ensure that the officer does not receive any instructions regarding the exercise of his or her tasks. He or she is not dismissed or penalised by the controller or the processor for performing his tasks. The officer reports directly to the highest management level of the controller or the processor.

The last of those norms does not assess the candidate’s seniority. It requires the organisation to ensure that the DPO has a direct line to the highest management level. According to the UODO, in performing his or her activities the DPO may not report to any other person or unit. The President of the UODO applies this also to the other tasks of a person who combines functions. Subordinating that person to a department director, a head of unit or any other person outside the highest management level is ruled out. A candidate’s junior position is therefore not an obstacle under Article 38(3). The obstacle is an arrangement in which, in the other role, he or she would still report to a head of unit.

The WP 243 guidelines tie the place in the structure to the assessment of qualities as well, because they read the ability to fulfil the tasks incumbent on the DPO as referring both to personal qualities and knowledge and to the position within the organisation.

What Article 37(5) requires

The officer is designated on the basis of professional qualities. The provision points in particular to expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.

This is a positive condition, so it works differently from a prohibition. A person without such qualities is not excluded by name. What that person does not meet is the condition on the basis of which the designation happens at all.

The provisions indicate neither a required education, nor a certificate, nor a length of service. Recital 97 of the Regulation does indicate how to establish the necessary level of expert knowledge. It should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed. Knowledge of data protection law and practice is therefore always required, while its level is matched to the specific organisation. The WP 243 guidelines of the Article 29 Working Party regard it as a relevant element that DPOs have expertise in national and European data protection laws and practices and an in-depth understanding of the GDPR.

Who assesses a DPO conflict of interest

The addressee of Article 38(6) is the controller or the processor. The provision imposes no obligation on the candidate and does not require any declaration from him or her. A DPO conflict of interest is therefore assessed by the organisation. It examines the tasks and duties of a specific person against the organisational structure and internal rules. The organisation’s assessment is not final, however. The President of the UODO may review it, and an infringement of Article 38 is subject to a fine under Article 83(4)(a) GDPR.

Depending on the activities, size and structure of the organisation, the guidelines say it can be good practice for controllers or processors to do five things.

• To identify the positions which would be incompatible with the function of DPO.
• To draw up internal rules to this effect in order to avoid conflicts of interests.
• To include a more general explanation about conflicts of interests.
• To declare that their DPO has no conflict of interests with regard to the DPO function, as a way of raising awareness of this requirement.
• To include safeguards in the internal rules and to ensure that the vacancy notice for the position of DPO or the service contract is sufficiently precise and detailed.

The guidelines recall that conflicts of interests may take various forms depending on whether the DPO is recruited internally or externally. The declaration is made by the organisation about its DPO, not by the candidate. It raises awareness and does not replace the assessment. I recommend recording negative decisions as well, because it is useful to be able to return to a rejected candidacy at the next change of structure.

Can a company or a team act as the officer

Article 37(6) permits two forms. The officer may be a staff member or fulfil the tasks on the basis of a service contract. The WP 243 guidelines add that such a contract may be concluded with an individual or an organisation outside the controller’s or processor’s organisation.

Polish law does not prohibit a contract with a company, but its notification procedure matters. Article 10(1) of the Polish Personal Data Protection Act requires the President of the UODO to be notified within 14 days of the designation. The notification states the officer’s first name, surname and e-mail address or telephone number. The UODO requires notification of the designation of a specific person. In Poland the designated person is therefore a natural person, even where the contract was concluded with a company.

The WP 243 guidelines allow a team to work on the service provider’s side. They set the condition that each member of the organisation exercising the functions of a DPO fulfils all applicable requirements of Section 4 of the GDPR. As an example they give that no one has a conflict of interests. They treat it as equally important that each such member be protected by the provisions of the GDPR. They also recommend a clear allocation of tasks within the DPO team and assigning a single individual as a lead contact and person in charge for each client. They add that it would generally also be useful to specify these points in the service contract.

What does not exclude a candidate

Three circumstances are sometimes treated as an obstacle, although the provisions do not make any of them one.

The first is one person serving several entities. Article 37(2) permits a single officer for a group of undertakings, provided that the officer is easily accessible from each establishment. Article 37(3) permits a single officer for several public authorities or bodies, taking account of their organisational structure and size. A third arrangement is described by the second sentence of Article 37(4), which permits the officer to act for associations and other bodies representing controllers or processors. Beyond those three arrangements, admissibility rests on Article 37(6) and on section 2.5 of the guidelines rather than on a separate provision.

Serving many entities does have limits, however. The UODO accepts it only in justified cases and with a number of entities that stays within reasonable limits. According to the Office, what matters includes the DPO’s availability, his or her time and the avoidance of a conflict of interests. The EDPB, in its report on the 2023 coordinated enforcement action, describes a finding of one supervisory authority. The same external DPO acted there as the DPO of the controller and of its processor. According to the EDPB, a conflict of interests may arise in such an arrangement.

The second circumstance is not being employed by the organisation. Article 37(6) permits both a staff member and a person acting on the basis of a service contract.

The third is performing other tasks. The first sentence of Article 38(6) permits them expressly. The limit is set by the conflict of interests, including the time criterion indicated by the President of the UODO.

What is required of the deputy

Article 11a(1) of the Polish Personal Data Protection Act allows a person to be designated to stand in for the officer during his or her absence. The provision requires the criteria of Article 37(5) and (6) of the Regulation to be taken into account. Article 11a(2) further requires the provisions concerning the officer to be applied to the deputy accordingly. It does so in connection with performing the officer’s duties during his or her absence.

For the time of the substitution the deputy is therefore also covered by the prohibition of a conflict of interests and the requirement of direct reporting. The UODO allows a deputy to be designated permanently. In my assessment a permanent deputy should not hold a position that would exclude the DPO himself or herself. The conflict would otherwise surface at the first substitution. Article 11a(3) adds notification under Article 10 and the publication of data under Article 11.

Grounds that decide most cases

Ground	Whom it excludes	Exceptions and limits	Applicable from
Article 38(6) GDPR	the controller itself and a person managing the entity (position of the President of the UODO) and a person whose other tasks result in a conflict of interests	other tasks and duties are permitted; the conflict may result from determining purposes and means, from assessing one’s own actions or from an excess of duties	25 May 2018
Article 37(5) GDPR	does not exclude by name — it sets a positive condition which a person without professional qualities does not meet	expert knowledge and the ability to fulfil the tasks of Article 39 are “in particular”, not the whole catalogue; the provision indicates no education, certificate or length of service	25 May 2018
Article 38(3) GDPR	no one by reason of seniority — it excludes an arrangement in which the DPO reports in other tasks to a person outside the highest management level (position of the President of the UODO)	the duty to ensure direct reporting rests with the organisation	25 May 2018

Common mistakes

• Designating a management board member or the controller itself. The President of the UODO regards such a designation as unacceptable. A written justification does not change that.

• Entrusting the DPO with coordinating breaches or data subject requests. In the view of the President of the UODO, the DPO would then assess his or her own actions.

• Extending the DPO’s tasks without a written conflict analysis. UODO inspections found such changes in the documenting of breaches.

• Subordinating the DPO to a head of unit in his or her other role. The President of the UODO regards such an arrangement as ruled out.

• Expecting a declaration from the candidate instead of an assessment by the organisation. The WP 243 guidelines describe a declaration made by the organisation about its DPO.

• Omitting the notification to the President of the UODO. The deadline is 14 days from the designation. For this failure alone the authority imposed PLN 3,500 on the bailiff.

Conclusions and next steps

A DPO conflict of interest is not the only reason for rejecting a candidate. Article 37(5) operates independently of it, so a candidate without a conflict may still be unsuitable. Article 38(3) further requires the organisation to ensure that the DPO reports directly to the highest management level.

Seven steps that put candidate selection in order.

1. Exclude the controller itself and the persons managing the entity, including management board members.
2. Describe the candidate’s decisions about data in all of his or her roles, indicating the purposes and means of processing he or she takes part in determining.
3. Check that the candidate does not perform or coordinate tasks that he or she would later have to assess as DPO.
4. Assess how much time will remain for the DPO tasks alongside the other duties.
5. Check the qualities against the processing operations carried out in the organisation, in line with recital 97.
6. Record in the organisational rules that the DPO reports directly to the highest management level, also in his or her other tasks.
7. Record the assessment with its reasoning, notify the President of the UODO within 14 days of the designation and publish the DPO’s details without delay.

Return to this assessment at every change of structure. A promotion or taking over a new department can create a conflict that did not exist on the day of designation. Where the assessment reveals a conflict, remove the conflicting task or appoint another person.

Related materials

• How to determine if an organization must appoint a DPO? — the decision that precedes candidate selection.
• External or internal DPO? What to consider before deciding? — the choice of model in which the role is to be performed.
• What information should the board expect from the DPO? — the relationship with the officer after the designation.
• What should a contract with an external data protection officer contain? — the clauses that protect the independence of an external officer.

Sources

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), consolidated version — Articles 15 to 22, Article 24(1), Article 37(2), (3), (4), (5) and (6), Article 38(3) and (6), Article 39(1), Article 83(4)(a) and Article 99(2) — eur-lex.europa.eu.
• Regulation (EU) 2016/679 (GDPR), version as published in OJ EU L 119 of 4 May 2016 — recital 97 — eur-lex.europa.eu.
• Act of 10 May 2018 on personal data protection, consolidated text as at 18 August 2026 — Article 10, Article 11 and Article 11a (in Polish) — isap.sejm.gov.pl.
• Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), wp243rev.01, adopted 13 December 2016, last revised 5 April 2017 — sections 2.1, 2.5 and 3.5 — English version ec.europa.eu, Polish version (in Polish) uodo.gov.pl.
• Personal Data Protection Office (UODO), What guarantees of independence are granted to the DPO under the GDPR? (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), Can a person from outside the organisation of the controller or processor act as DPO? (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), What is the maximum number of entities one DPO may serve? (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), Should a deputy DPO be designated permanently? (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), Verification of compliance with the provisions on the data protection officer, communication of 30 March 2022 (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), Fine for failing to ensure the independence of the data protection officer, communication of 31 August 2026 on decision DKN.5131.24.2025 (in Polish) — uodo.gov.pl.
• President of the Personal Data Protection Office, Report on the activities of the President of the Personal Data Protection Office in 2025 — pages 74, 84–85, 232–234 and 245–246 (in Polish) — uodo.gov.pl.
• European Data Protection Board, 2023 Coordinated Enforcement Action. Designation and Position of Data Protection Officers, report adopted on 16 January 2024 — point 4.5.1 — edpb.europa.eu.