{"id":4002,"date":"2026-08-18T10:00:00","date_gmt":"2026-08-18T08:00:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=4002"},"modified":"2026-08-20T18:06:08","modified_gmt":"2026-08-20T16:06:08","slug":"what-information-should-the-board-expect-from-the-dpo","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/","title":{"rendered":"What information should the board expect from the DPO?"},"content":{"rendered":"\n<p class=\"ll-art-meta wp-block-paragraph\"><a href=\"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/\"><strong>Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for the board and management \u2022 published August 18, 2026 \u2022 updated August 18, 2026 \u2022 9 min read<\/p>\n\n\n\n<div class=\"wp-block-columns ll-art-shell is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column ll-art-rail is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-railinner is-layout-constrained wp-block-group-is-layout-constrained\">\n<div class=\"wp-block-group ll-art-railcard is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">On this page<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"#krotka-odpowiedz\">Short answer<\/a><\/li>\n<li><a href=\"#dlaczego\">Why this question arises at all<\/a><\/li>\n<li><a href=\"#co-ustalic\">What must be determined before the decision<\/a><\/li>\n<li><a href=\"#bledy\">Most common mistakes<\/a><\/li>\n<li><a href=\"#pytania\">Questions for the next board meeting<\/a><\/li>\n<li><a href=\"#wnioski\">Conclusions and next steps<\/a><\/li><\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-group ll-art-railcard ll-art-railmeta is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">Legal status<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>August 2026.<\/strong> Articles 38 and 39 GDPR unchanged; the Polish Act of May 10, 2018 on the Protection of Personal Data (including the deputy for the DPO). I have not identified any new obligations or national guidance on reporting by the DPO to senior management.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Last significant update: August 18, 2026.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column ll-art-main is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-answer is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading\" id=\"krotka-odpowiedz\">Short answer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The board should expect from the data protection officer a picture of the state of data protection, not a report of activities performed. That picture is made up of six things: the DPO&#8217;s work plan and how far it has been delivered, the result of monitoring compliance together with the weight of the departures identified, the risks treated as priorities, the recommendations issued together with what happened to them, the course of breach cases and of contacts with the supervisory authority and with data subjects, and the conditions in which the DPO works. The GDPR does not set the format or the frequency of such reporting \u2014 it does settle that the DPO is to be involved, properly and in a timely manner, in all issues relating to data protection, and that they report directly to the highest management level. The organization therefore sets the scope and the cycle itself, but it does not get to decide whether the flow exists at all. What should not be expected is that the DPO takes over responsibility for compliance or takes the processing decision on the board&#8217;s behalf.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"dlaczego\">Why this question arises at all<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR describes the position and the tasks of the DPO, but it does not describe the route by which the results of their work are to reach senior management. The Regulation requires the controller to ensure that the DPO is involved, properly and in a timely manner, in all issues relating to the protection of personal data (Article 38(1)), settles that they report directly to the highest management level (Article 38(3)) and lists the tasks (Article 39(1)): informing and advising, monitoring compliance with the rules and with policies \u2014 including the assignment of responsibilities, awareness-raising, training of staff and the related audits \u2014 providing advice on request as regards the data protection impact assessment and monitoring its performance, cooperating with the supervisory authority, and acting as the contact point. On what exactly is to reach the board&#8217;s table, in what form and how often, it says nothing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This creates an arrangement that is uncomfortable for both sides. Responsibility for compliance and for demonstrating it stays with the controller, that is, with the organization represented by its senior management \u2014 the DPO monitors and advises, but is not answerable for the consequences of decisions they do not take. The board is therefore answerable for an area of which it knows exactly as much as it has been told, and usually has no way of its own to check whether it has been told everything that matters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The scale of this is known. In the coordinated enforcement action of the European Data Protection Board of 2023, covering more than 17,000 responses from organizations in the European Economic Area, the most frequent answer on the frequency of DPO reporting to the highest management level was &#8220;once or twice a year&#8221; (median 45.64%), and 16.9% of respondents indicated that no reporting from the DPO is expected at all. Most organizations do not document the reasons for departing from the DPO&#8217;s recommendations \u2014 34.59% (median) do so every time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The third reason is practical. The list of questions the Personal Data Protection Office (UODO) puts to controllers when verifying compliance with the rules on the DPO is largely about exactly this flow of information: whether the DPO draws up a work plan, how often they pass on audit results, how the controller documents its failure to follow their recommendations, how the controller supervises their work. These are questions to the controller, not to the DPO. A board that does not know the answers finds out about the gap at the worst possible moment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"co-ustalic\">What must be determined before the decision<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What follows from the rules and what from the organization&#8217;s own arrangements<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">From the rules follow the DPO&#8217;s position and the duty to maintain a flow of information, not the format of a report. Involving the DPO in all issues relating to data protection is to be proper and timely, and their reporting line \u2014 direct. Both requirements are addressed to the controller, that is, to the organization, not to the DPO. When the duty to appoint a DPO arises at all, and how to document that analysis, I have described in <a href=\"https:\/\/www.lablogic.pl\/en\/how-to-determine-if-an-organization-must-appoint-a-dpo\/\">How to determine if an organization must appoint a DPO?<\/a>. The guidelines on data protection officers give, as an example of how that reporting line is realized, an annual report on the DPO&#8217;s activities prepared for the highest management level. That is an example of good practice, not a statutory obligation, and the whole difficulty lies in that distinction: the absence of a report is not in itself a breach, but an organization without such a document has to demonstrate by other means that senior management knew where things stood.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From the organization&#8217;s own arrangements follows the rest: the scope of the information, its cycle, its form, the addressee on the board&#8217;s side and the escalation path in urgent matters. These arrangements are a management decision, not a technical one \u2014 and it is worth taking them deliberately rather than letting them take shape by accident.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Six areas worth asking about regularly<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The work plan and how far it has been delivered.<\/strong> Monitoring compliance is continuous rather than one-off, so it should follow from a plan that takes into account the specifics of the organization, the risk assessment and the actual processing operations \u2014 that is the position UODO took in answering a question about the DPO&#8217;s audit plan. The basis is expressly in the Regulation: monitoring compliance also covers the related audits and the awareness-raising and training of staff. The board should know that plan, its scope, how much of it has been delivered, and what was moved and why.<\/li>\n<li><strong>The result of the monitoring, not a list of activities.<\/strong> What has value is information on which areas were checked, where departures were found and how serious they are. A tally of training sessions and checks carried out, with no assessment of the result, tells the board nothing about the state of the organization.<\/li>\n<li><strong>Priority risks \u2014 and what the DPO is not dealing with.<\/strong> The DPO performs their tasks with due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing \u2014 which in practice means setting priorities. The board should know what fell outside those priorities: that is information about deliberately accepted exposure, not about neglect.<\/li>\n<li><strong>Recommendations and what became of them.<\/strong> This is the most important element of the whole flow. The board should know which recommendations were issued, which were implemented, which were not and on what reasoning. A decision differing from the DPO&#8217;s position is permissible \u2014 the controller takes its decisions independently \u2014 but it has to be documented, because without that it later looks not like a decision but like an oversight.<\/li>\n<li><strong>Breaches, data subject requests and contacts with the authority.<\/strong> What matters is the aggregate picture: how many events were assessed, how many were classified as personal data breaches, how many were notified to the authority and why the rest were not, what requests from individuals came in and whether the deadlines were met, whether any proceedings are pending. A single high-risk event obviously calls for immediate information, outside the cycle.<\/li>\n<li><strong>The conditions in which the function is performed.<\/strong> Providing the DPO with the resources necessary to carry out their tasks, with access to personal data and processing operations and with resources to maintain their expert knowledge is a controller obligation that follows directly from the Regulation. A question about conditions is therefore the board asking about the performance of its own obligation, not a courtesy towards the DPO. The same area covers conflicts of interest and \u2014 where the organization uses that option \u2014 the appointment of a person to deputize for the DPO during their absence, which Polish law permits subject to the same qualification criteria and after notifying the President of UODO.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These six areas add up to a single piece of information: whether the organization is in control of its data processing and whether it can demonstrate it. If the DPO&#8217;s report does not allow that question to be answered, its scope needs to change \u2014 however extensive it may be.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the board should not expect from the DPO<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Part of the friction in the board\u2013DPO relationship comes from expectations the role simply does not cover.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DPO does not bear responsibility for processing that does not comply with the rules. The duty to ensure and demonstrate compliance belongs to the controller \u2014 appointing a DPO does not transfer it. Nor does the DPO take the controller&#8217;s place in the controller&#8217;s own tasks: keeping the record of processing activities is a controller obligation, and assigning it to the DPO was identified in the EDPB report as a problematic practice, as was granting the DPO authority to represent the controller in data protection matters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DPO does not &#8220;approve&#8221; projects or decisions. They give a position; the decision is taken by whoever is answerable for the process. On the data protection impact assessment their role is narrower still than is generally assumed: they give advice <strong>on request<\/strong> and monitor the performance of the assessment \u2014 they do not carry it out for the process owner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two limits run in the other direction and bind the board above all. The controller must ensure that the DPO receives no instructions regarding the exercise of their tasks and is not dismissed or penalized for performing them. These are not recommendations addressed to the DPO but obligations of the organization \u2014 and therefore also the limits of what the board may require of them. An expectation of &#8220;a position that will let the project go ahead&#8221; is, in that arrangement, an impossible one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The third limit sometimes comes as a surprise: the DPO is bound by secrecy or confidentiality concerning the performance of their tasks. The board may expect a full picture of the state of data protection, but not every piece of information the DPO has obtained \u2014 particularly where reports from individuals and individual cases are involved.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cycle, form and evidence trail<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A sensible arrangement has three levels, and it is worth keeping them apart, because mixing them produces either a flood of detail or silence. The first level is the periodic report \u2014 annual as a minimum, half-yearly or quarterly in organizations with intensive processing \u2014 covering the six areas described above. The second level is immediate information outside the cycle, triggered by events that require a decision: a high-risk breach, proceedings by the authority, an impact assessment showing high residual risk, a planned change with a major effect on processing. The third level is direct access \u2014 the ability to approach the DPO outside the schedule, and the DPO&#8217;s ability to approach the board whenever they consider it necessary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second and third levels are not good practice beyond the standard \u2014 they are the way the requirement that the DPO be involved in all data protection issues properly and <strong>in a timely manner<\/strong> is actually met. An organization with only an annual report does not meet that requirement, however exemplary the report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All three levels are worth writing down: in an internal rulebook, a resolution or the document appointing the DPO. The document sets expectations on both sides and at the same time evidences that the flow of information was designed in the organization rather than left to chance. The same value attaches to adopting the rule that the DPO&#8217;s position, and any board decision departing from it, go into the minutes together with the reasoning.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"bledy\">Most common mistakes<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-errors\"><li><strong>An activity report instead of a report on the state of affairs.<\/strong> A document listing training delivered, opinions issued and checks carried out, with no assessment of the result, provides no basis for any decision.<\/li>\n<li><strong>No trace of rejected recommendations.<\/strong> Departing from the DPO&#8217;s position without recorded reasoning is one of the weaknesses most frequently identified in the EDPB action and one of the points the supervisory authority asks about.<\/li>\n<li><strong>Reporting through an intermediary.<\/strong> Passing information through the IT, HR or compliance director breaches the principle of direct reporting to the highest management level and smooths out along the way exactly what matters most to the board.<\/li>\n<li><strong>An annual cycle only.<\/strong> A report once a year does not meet the requirement of timely involvement of the DPO in data protection issues. Without a path outside the cycle, the organization learns about the problem at a point when the decision is already late.<\/li>\n<li><strong>Treating the report as a formality.<\/strong> A report accepted without discussion and without a decision differs in its effects not at all from a report that never existed.<\/li>\n<li><strong>Expecting a guarantee.<\/strong> The question &#8220;are we compliant&#8221; has no unequivocal answer. The useful answer reads: which areas are in order, which are not, how serious the departures are and in what order it is worth closing them.<\/li>\n<li><strong>Asking only after an event.<\/strong> Contact with the DPO only at the point of a breach or an inspection means the organization uses the role reactively and, for most of the year, does not know where it stands.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"pytania\">Questions for the next board meeting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This list does not replace a report \u2014 it lets you check whether the flow of information you have so far is sufficient.<\/p>\n\n\n\n<div class=\"wp-block-group ll-art-check is-layout-constrained wp-block-group-is-layout-constrained\">\n<ol class=\"wp-block-list\"><li>Is there a work plan for the DPO for the current year, and how far has it been delivered?<\/li>\n<li>Which processing areas were checked in the last period, and with what result?<\/li>\n<li>Which three risks does the DPO consider the most serious today, and what reduces them?<\/li>\n<li>What recommendations were issued in the last period, which of them were implemented, and where the organization acted differently \u2014 where is the reason recorded?<\/li>\n<li>How many events were assessed as possible personal data breaches, how many were notified to the authority, and on what basis was notification not made in the remaining cases?<\/li>\n<li>Are there any pending proceedings, complaints or data subject requests that require management attention?<\/li>\n<li>Does the DPO have the resources, the time, access to data and processing operations and the means to maintain expert knowledge \u2014 and if not, what is missing?<\/li>\n<li>Has any arrangement arisen in the structure that risks a conflict of interest, particularly after organizational changes?<\/li>\n<li>Has it been settled in which situations the DPO contacts the board outside the schedule \u2014 and was that path used in the past year?<\/li><\/ol>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"wnioski\">Conclusions and next steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The flow of information between the DPO and the board is an element of the data protection system, not a matter of organizational culture. The rules give that flow its basis and set its minimum \u2014 proper and timely involvement of the DPO in all issues, and direct reporting to the highest management level \u2014 but they do not fill it with content. The organization fills it, and the organization is answerable for the consequences if it does not.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The order of actions is short. Establish whether the organization has a settled scope and cycle of information from the DPO; if not, adopt them first. Agree the scope of the report around the six areas: the work plan, the result of monitoring, priority risks, recommendations and what became of them, breach cases and contacts with the authority, and the conditions in which the function is performed. Introduce the rule of documenting decisions that depart from the DPO&#8217;s position. Define the events that trigger immediate information. Write these arrangements into a document that can be shown. Finally, check whether the DPO has the conditions to prepare such a report at all \u2014 because providing them is a controller obligation, and a report demanded of someone with no access to information and no time to analyze it will be worth exactly as much as those conditions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related materials<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong><a href=\"https:\/\/www.lablogic.pl\/en\/how-to-determine-if-an-organization-must-appoint-a-dpo\/\">How to determine if an organization must appoint a DPO?<\/a><\/strong> \u2014 the three grounds for the obligation and how to document the analysis.<\/li>\n<li><strong><a href=\"https:\/\/www.lablogic.pl\/en\/does-every-data-breach-need-to-be-reported\/\">Does every data breach need to be reported?<\/a><\/strong> \u2014 the risk assessment and the notification decision, that is, the material behind the fifth area of the report.<\/li>\n<li><strong><a href=\"https:\/\/www.lablogic.pl\/en\/where-should-the-board-begin-preparing-for-nis2\/\">Where should the board begin preparing for NIS2?<\/a><\/strong> \u2014 management responsibility in the second regime.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-sources\"><li>Regulation (EU) 2016\/679 of the European Parliament and of the Council (GDPR), Articles 38\u201339, consolidated text \u2014 EUR-Lex: <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/PDF\/?uri=CELEX:02016R0679-20160504\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a> (accessed: August 18, 2026)<\/li>\n<li>Act of May 10, 2018 on the Protection of Personal Data, Articles 8\u201311a, consolidated text \u2014 Chancellery of the Sejm, ISAP: <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20180001000\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a> (accessed: August 18, 2026) (in Polish)<\/li>\n<li>Should the DPO draw up an audit plan? \u2014 Personal Data Protection Office (UODO): <a href=\"https:\/\/uodo.gov.pl\/pl\/673\/4205\" target=\"_blank\" rel=\"noreferrer noopener\">uodo.gov.pl<\/a> (accessed: August 18, 2026) (in Polish)<\/li>\n<li>Verification of compliance with the rules on the data protection officer, communication of March 30, 2022 \u2014 Personal Data Protection Office (UODO): <a href=\"https:\/\/uodo.gov.pl\/pl\/138\/2438\" target=\"_blank\" rel=\"noreferrer noopener\">uodo.gov.pl<\/a> (accessed: August 18, 2026) (in Polish)<\/li>\n<li>Guidelines on Data Protection Officers (WP 243 rev. 01), Article 29 Working Party, endorsed by the European Data Protection Board \u2014 European Data Protection Board: <a href=\"https:\/\/ec.europa.eu\/newsroom\/article29\/items\/612048\" target=\"_blank\" rel=\"noreferrer noopener\">ec.europa.eu<\/a> (accessed: August 18, 2026)<\/li>\n<li>2023 Coordinated Enforcement Action. Designation and Position of Data Protection Officers, report adopted on January 16, 2024 \u2014 European Data Protection Board: <a href=\"https:\/\/www.edpb.europa.eu\/system\/files\/2024-01\/edpb_report_20240116_cef_dpo_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">edpb.europa.eu<\/a> (accessed: August 18, 2026)<\/li><\/ul>\n\n\n\n<div class=\"wp-block-group ll-art-author is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading\">Author<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Micha\u0142 Rutkowski<\/strong> \u2014 LabLogic. Combines legal, organizational, and technological perspectives in working with boards of medium and large organizations: support and performance of DPO functions, preparation for NIS2 and KSC, incident response, audits, and training. Contact: M.Rutkowski@LabLogic.pl<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group ll-art-cta is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading\">Check what your board knows today<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether the information reaching the board allows it to assess the state of data protection and take decisions, it is worth starting with a review of that flow and of the scope of the DPO&#8217;s report. Support of an external DPO covers putting the relationship with senior management in order, setting the scope and cycle of reporting, and taking over or supporting the DPO function.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.lablogic.pl\/en\/external-data-protection-officer-iod-dpo\/\">Support of an external DPO<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group ll-art-disclaimer is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">This material is general and educational in nature. It does not constitute individual legal advice or a recommendation for a specific organization. The scope of obligations should be assessed taking into account its situation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Legal status: August 2026.<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The board should expect from the data protection officer a picture of the state of data protection, not a report of activities. Six areas make up that picture. The GDPR does not set the format of the report, but it does settle that the flow of information has to exist.<\/p>\n","protected":false},"author":2,"featured_media":4297,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[70],"tags":[],"class_list":["post-4002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dpo"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Micha\u0142 Rutkowski\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"LabLogic - Micha\u0142 Rutkowski | DPO, RODO, NIS2 i Cybersecurity w praktyce\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"What should the board expect from the DPO?\" \/>\n\t\t<meta property=\"og:description\" content=\"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-18T08:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-20T16:06:08+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"What should the board expect from the DPO?\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#article\",\"name\":\"What should the board expect from the DPO?\",\"headline\":\"What information should the board expect from the DPO?\",\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/author\\\/user_lablogic\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg\",\"width\":1200,\"height\":630,\"caption\":\"What should the board expect from a DPO? \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"datePublished\":\"2026-08-18T10:00:00+02:00\",\"dateModified\":\"2026-08-20T18:06:08+02:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#webpage\"},\"articleSection\":\"DPO and GDPR, Optional\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"position\":1,\"name\":\"LabLogic\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/dpo\\\/#listItem\",\"name\":\"DPO and GDPR\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/dpo\\\/#listItem\",\"position\":2,\"name\":\"DPO and GDPR\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/dpo\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#listItem\",\"name\":\"What information should the board expect from the DPO?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"name\":\"LabLogic\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#listItem\",\"position\":3,\"name\":\"What information should the board expect from the DPO?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/dpo\\\/#listItem\",\"name\":\"DPO and GDPR\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#organization\",\"name\":\"Micha\\u0142 Rutkowski - LabLogic\",\"description\":\"DPO, RODO, NIS2 i Cybersecurity w praktyce\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"telephone\":\"+48586231777\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2020\\\/03\\\/LABLOGIC_LOGO2.png\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/author\\\/user_lablogic\\\/#author\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/author\\\/user_lablogic\\\/\",\"name\":\"Micha\\u0142 Rutkowski\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Micha\\u0142 Rutkowski\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#webpage\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/\",\"name\":\"What should the board expect from the DPO?\",\"description\":\"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/author\\\/user_lablogic\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/author\\\/user_lablogic\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"What should the board expect from a DPO? \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/what-information-should-the-board-expect-from-the-dpo\\\/#mainImage\"},\"datePublished\":\"2026-08-18T10:00:00+02:00\",\"dateModified\":\"2026-08-20T18:06:08+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"name\":\"Micha\\u0142 Rutkowski - LabLogic\",\"alternateName\":\"LabLogic\",\"description\":\"DPO, RODO, NIS2 i Cybersecurity w praktyce\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"What should the board expect from the DPO?","description":"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.","canonical_url":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#article","name":"What should the board expect from the DPO?","headline":"What information should the board expect from the DPO?","author":{"@id":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/#author"},"publisher":{"@id":"https:\/\/www.lablogic.pl\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg","width":1200,"height":630,"caption":"What should the board expect from a DPO? \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"datePublished":"2026-08-18T10:00:00+02:00","dateModified":"2026-08-20T18:06:08+02:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#webpage"},"isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#webpage"},"articleSection":"DPO and GDPR, Optional"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","position":1,"name":"LabLogic","item":"https:\/\/www.lablogic.pl\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/dpo\/#listItem","name":"DPO and GDPR"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/dpo\/#listItem","position":2,"name":"DPO and GDPR","item":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/dpo\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#listItem","name":"What information should the board expect from the DPO?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","name":"LabLogic"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#listItem","position":3,"name":"What information should the board expect from the DPO?","previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/dpo\/#listItem","name":"DPO and GDPR"}}]},{"@type":"Organization","@id":"https:\/\/www.lablogic.pl\/en\/#organization","name":"Micha\u0142 Rutkowski - LabLogic","description":"DPO, RODO, NIS2 i Cybersecurity w praktyce","url":"https:\/\/www.lablogic.pl\/en\/","telephone":"+48586231777","logo":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2020\/03\/LABLOGIC_LOGO2.png","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#organizationLogo"},"image":{"@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/#author","url":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/","name":"Micha\u0142 Rutkowski","image":{"@type":"ImageObject","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g","width":96,"height":96,"caption":"Micha\u0142 Rutkowski"}},{"@type":"WebPage","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#webpage","url":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/","name":"What should the board expect from the DPO?","description":"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#breadcrumblist"},"author":{"@id":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/#author"},"creator":{"@id":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg","@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#mainImage","width":1200,"height":630,"caption":"What should the board expect from a DPO? \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"primaryImageOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/#mainImage"},"datePublished":"2026-08-18T10:00:00+02:00","dateModified":"2026-08-20T18:06:08+02:00"},{"@type":"WebSite","@id":"https:\/\/www.lablogic.pl\/en\/#website","url":"https:\/\/www.lablogic.pl\/en\/","name":"Micha\u0142 Rutkowski - LabLogic","alternateName":"LabLogic","description":"DPO, RODO, NIS2 i Cybersecurity w praktyce","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.lablogic.pl\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"LabLogic - Micha\u0142 Rutkowski | DPO, RODO, NIS2 i Cybersecurity w praktyce","og:type":"article","og:title":"What should the board expect from the DPO?","og:description":"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.","og:url":"https:\/\/www.lablogic.pl\/en\/what-information-should-the-board-expect-from-the-dpo\/","og:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg","og:image:secure_url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-08-18T08:00:00+00:00","article:modified_time":"2026-08-20T16:06:08+00:00","twitter:card":"summary_large_image","twitter:title":"What should the board expect from the DPO?","twitter:description":"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.","twitter:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg"},"aioseo_meta_data":{"post_id":"4002","title":"What should the board expect from the DPO?","description":"Six areas the board should ask the data protection officer about, plus the cycle, form and evidence trail of reporting. See what the DPO role does not cover.","keywords":null,"keyphrases":{"focus":{"keyphrase":"DPO reporting to the board"},"additional":[{"keyphrase":"data protection officer report"},{"keyphrase":"what the board can require from the DPO"},{"keyphrase":"DPO reports to the highest management level"},{"keyphrase":"data protection report for the board"}]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-08-18 22:34:13","updated":"2026-08-20 16:07:08","seo_analyzer_scan_date":null,"focus_keyword":"DPO reporting to the board","additional_keywords":[{"word":"data protection officer report","score":0},{"word":"what the board can require from the DPO","score":0},{"word":"DPO reports to the highest management level","score":0},{"word":"data protection report for the board","score":0}],"truseo_locale":null},"spectra_blocks_featured_image_url":{"thumbnail":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1-150x150.jpg","width":150,"height":150},"medium":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1-300x158.jpg","width":300,"height":158},"medium_large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1-768x403.jpg","width":768,"height":403},"large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1-1024x538.jpg","width":1024,"height":538},"full":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/ll-og-what-information-should-the-board-expect-from-the-dpo-en-1.jpg","width":1200,"height":630}},"spectra_blocks_author_info":{"display_name":"Micha\u0142 Rutkowski","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g","author_link":"https:\/\/www.lablogic.pl\/en\/author\/user_lablogic\/","description":"Micha\u0142 Rutkowski \u2014 praktyk ochrony danych i cyberbezpiecze\u0144stwa, w\u0142a\u015bciciel LabLogic. Od 2004 roku pracuje na styku technologii, ochrony danych i zarz\u0105dzania ryzykiem. Pe\u0142ni funkcj\u0119 zewn\u0119trznego IOD\/DPO, prowadzi audyty RODO, kwalifikacj\u0119 i wdro\u017cenia NIS2 oraz ustawy o KSC, wspiera organizacje przy incydentach i naruszeniach ochrony danych, szkoli zarz\u0105dy, kadr\u0119 kierownicz\u0105 oraz zespo\u0142y IT i compliance. Pracuje ze \u015brednimi i du\u017cymi organizacjami, w tym z sektora finansowego i bran\u017c regulowanych."},"_links":{"self":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/4002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/comments?post=4002"}],"version-history":[{"count":3,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/4002\/revisions"}],"predecessor-version":[{"id":4193,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/4002\/revisions\/4193"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media\/4297"}],"wp:attachment":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media?parent=4002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/categories?post=4002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/tags?post=4002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}