Organisations routinely merge the data protection officer (DPO) and the chief privacy officer (CPO) into one job title, and then find that the person who designs the privacy programme is also the person legally tasked with independently monitoring it. The DPO is a role defined by the GDPR in Articles 37 to 39, with protected independence and fixed tasks; the CPO is an executive role that the organisation defines for itself, accountable for delivering privacy outcomes. One advises and checks, the other decides and owns. This guide compares the two for boards, general counsel, CISOs and privacy leaders deciding how to structure privacy accountability: the legal rules on independence and conflicts, reporting lines, who carries liability, when one person can hold both roles, and how to choose by organisation size. For the day-to-day work and routes into the role, see the Privacy Engineer and DPO Career Guide.
Key takeaways
- The DPO is a statutory monitor; the CPO is an accountable owner. GDPR Article 39 gives the DPO advisory and monitoring tasks, while the controller, and in practice the executive it appoints, remains responsible under Article 24 for compliance.
- Independence is a legal requirement, not a style. Article 38(3) bars instructions on how the DPO performs its tasks, protects the DPO from dismissal or penalty for performing them, and requires direct reporting to the highest management level.
- The conflict test is about deciding processing. The Court of Justice held in X-FAB Dresden (C-453/21) that a conflict may exist where other duties lead the DPO to determine the purposes and means of processing; a CPO who sets privacy strategy and approves processing usually does exactly that.
- Combining the roles is not banned, but it needs evidence. The GDPR sets no fundamental incompatibility, so the assessment is case by case; where one person holds both, document why there is no conflict or separate the monitoring function.
- Size changes the answer. Small organisations often use an external or part-time DPO with an internal privacy lead; large ones run a CPO-led programme with a separate DPO who reports directly to the board.
Two roles, two sources of authority
The DPO exists because the law says so; the CPO exists because the organisation decides it needs a privacy executive. That difference drives everything else.
| Dimension | Data protection officer (DPO) | Chief privacy officer (CPO) |
|---|---|---|
| Source | GDPR Articles 37 to 39, and Member State law under Article 37(4) | Organisational design; no GDPR definition |
| When required | Public authorities (except courts acting judicially); core activities of large-scale regular and systematic monitoring; core activities of large-scale special category or criminal offence data (Art. 37(1)) | Never required by the GDPR; a business choice |
| Purpose | Inform, advise, monitor compliance, advise on DPIAs, cooperate with and act as contact point for the supervisory authority (Art. 39(1)) | Set privacy strategy, own the programme, approve or reject processing, manage budget and team |
| Decision rights | Advisory; should not determine purposes and means of processing | Executive; often decides or co-decides processing |
| Independence | No instructions on tasks, no dismissal or penalty for performing them, direct reporting to highest management (Art. 38(3)) | Normal line management; can be directed by the CEO or general counsel |
| Employment | Staff member or service contract (Art. 37(6)); a group may share one DPO if easily accessible (Art. 37(2)) | Normally an employee executive |
| External visibility | Contact details published and communicated to the supervisory authority (Art. 37(7)); data subjects may contact the DPO (Art. 38(4)) | No publication duty |
| Confidentiality | Bound by secrecy or confidentiality on tasks under Union or Member State law (Art. 38(5)) | Contractual and professional duties only |
A useful shorthand: the CPO is the first line owner of privacy risk, and the DPO is closer to a second line function with a statutory mandate. See the Three Lines Model for Cyber Risk Guide for how those lines interact.
GDPR Articles 37 to 39: the rules that shape the DPO
Designation and qualities (Article 37)
- Mandatory cases: the three triggers in Article 37(1), with "core activities" and "large scale" assessed by the controller and documented.
- Voluntary designation: Article 37(4) allows it in other cases. A voluntary DPO is still a DPO, and Articles 38 and 39 then apply in full, so organisations that only want a privacy lead should give the role a different title.
- Qualities: chosen for expert knowledge of data protection law and practices and the ability to perform the Article 39 tasks (Art. 37(5)). There is no mandatory certificate; see Privacy and DPO Certifications Compared.
Position (Article 38)
- Involvement: properly and in a timely manner in all issues relating to personal data protection (Art. 38(1)).
- Resources: resources necessary for the tasks, access to personal data and processing operations, and support to maintain expert knowledge (Art. 38(2)).
- Independence: no instructions on the exercise of tasks, no dismissal or penalty for performing them, direct reporting to the highest management level (Art. 38(3)).
- Other duties: allowed, provided they do not result in a conflict of interests (Art. 38(6)).
Tasks (Article 39)
Article 39(1) lists minimum tasks: inform and advise on obligations; monitor compliance, including assignment of responsibilities, awareness, training and audits; advise on data protection impact assessments and monitor their performance; cooperate with the supervisory authority; and act as its contact point, including on prior consultation under Article 36. Article 39(2) requires due regard to the risk associated with processing operations, so a DPO can and should prioritise.
Note what is missing: the DPO is not tasked with carrying out DPIAs, keeping the record of processing, or deciding lawful bases. Those belong to the controller. The EDPB's 2024 coordinated enforcement report states that drafting or carrying out DPIAs is the controller's task and the DPO should advise. See the DPIA Guide and the Data Mapping and ROPA Guide.
Conflict of interest: the legal test
Article 38(6) is short, so the case law and supervisory practice do the work.
- CJEU, X-FAB Dresden (C-453/21, 9 February 2023): a conflict may exist where a DPO is entrusted with other tasks or duties that would result in the DPO determining the objectives and methods of processing personal data. Whether a conflict exists is for the national court to determine case by case, on all relevant circumstances, in particular the organisational structure and all applicable rules, including policies. The same judgment held that national law may protect a staff DPO from dismissal except for just cause, provided it does not undermine the GDPR's objectives.
- Belgian Data Protection Authority, decision of 28 April 2020: a company had appointed its Head of Compliance, Risk Management and Audit as DPO. The Litigation Chamber found an Article 38(6) infringement and imposed a fine of 50,000 euros, reasoning that as department head the DPO determined purposes and means of processing in those departments, leaving no independent oversight of them.
- EDPB coordinated enforcement action (report adopted 17 January 2024): 25 authorities and more than 17,000 responses. Up to 15 supervisory authorities reported DPOs likely to be in a conflict or facing risks to independence. The report cites roles such as CEO, CFO or heads of departments, decision-making on purposes and means, and acting as DPO for both a controller and its processor as risk areas, and notes the GDPR does not establish a fundamental incompatibility between DPO and other duties.
Applying the test to common combinations
| Second role held by the DPO | Conflict risk | Why |
|---|---|---|
| CPO who sets strategy and approves processing | High | Determines purposes and means; monitors own decisions |
| CEO, CFO or other director | High | Named as a risk area by the EDPB report; decides processing |
| Head of compliance, risk and audit | High | Found to conflict by the Belgian authority in 2020 |
| CISO or head of IT | Medium to high | Usually decides means of processing (systems, retention, logging); case by case |
| General counsel | Medium | Defends the organisation against data subjects and regulators while acting as their contact point |
| Privacy counsel or analyst without decision rights | Low | Advisory work similar to DPO tasks |
| External DPO who also represents the client in litigation | High | Cited by the EDPB report for law firm DPOs |
The table is a starting point for the documented assessment, not a ruling. The decisive question is always whether the person decides the why and how of any processing they would then monitor.
Reporting lines
- DPO: must report directly to the highest management level. The EDPB report found DPOs reporting to lower management in some organisations, one with only a "dotted line" to top management, and in four Member States 30 percent or more of respondents said the DPO was not expected to report to top management at all. A written annual report to the board, with a right to escalate at any time, is the evidence a regulator will look for.
- CPO: commonly reports to the general counsel, the chief risk officer, the CEO or the CISO's line. The choice reflects whether privacy is treated as legal, risk, operational or security work, and is a design decision with no legal constraint.
- Both present: the DPO can sit in the CPO's function for administration (budget, HR) but needs a direct, documented route to the board for its tasks, and the CPO must not be able to block or edit that route.
The same structural debate exists for security leadership; see Where Should the CISO Report.
Liability: who answers for what
| Exposure | DPO | CPO | Organisation |
|---|---|---|---|
| Compliance with the GDPR | Monitors and advises | Delivers, as the executive owner | Responsible and must be able to demonstrate compliance (Art. 24(1)) |
| Administrative fines | Not the addressee | Not the addressee | Infringements of Articles 25 to 39 up to 10 million euros or 2 percent of worldwide turnover, whichever is higher (Art. 83(4)(a)) |
| Failure to designate or protect the DPO | None | May be the decision maker | Fineable under Art. 83(4)(a), as the Belgian 2020 decision shows |
| Employment protection | Cannot be dismissed or penalised for performing tasks (Art. 38(3)); national law may add more | Ordinary employment terms | Bears the cost of a defective dismissal |
| Personal exposure | Confidentiality duty (Art. 38(5)); contractual and professional duties | Contractual and, where national law provides, director or officer duties | Not applicable |
The practical point: the GDPR places the obligation on the controller and processor, not on the DPO, so a CPO who expects the DPO to "own" compliance has misread the law. Accountability for decisions sits with the executive line, which is the CPO's job.
When one person can hold both roles
Combining the roles is lawful only where the combined person does not determine purposes and means of processing they then monitor. In practice that works in three patterns:
- Advisory "CPO" title: the person carries the CPO title for external credibility but has no decision rights over processing; business owners decide and the person advises and monitors. This is a DPO with a different title.
- Combined role with a delegated monitor: the CPO is formally the DPO, but monitoring of the areas they decide on is delegated to an independent reviewer (internal audit or an external firm) reporting to the board. This reduces risk but leaves the conflict question open for the supervisory authority.
- Small organisation, low-risk processing: a voluntary DPO in an organisation with simple processing, where the privacy lead has a narrow remit. The documented assessment should explain why the volume and nature of processing make the conflict immaterial.
Whatever pattern you choose, write the Article 38(6) assessment down, list the decisions the person is excluded from, review it at each reorganisation, and record who decides when the person would otherwise mark their own homework.
Decision guidance by organisation size
| Organisation | Typical model | DPO | Privacy owner | Watch for |
|---|---|---|---|---|
| Small, DPO not mandatory | Privacy lead, no DPO | Not designated; avoid the title to avoid triggering Articles 38 and 39 | Operations or legal lead | Document why Article 37(1) does not apply |
| Small or mid-sized, DPO mandatory | External or part-time DPO plus internal lead | Service contract under Art. 37(6) | Internal privacy or compliance lead | Enough DPO time and access; the EDPB report flags under-resourcing |
| Mid-sized, moderate risk | Internal DPO, privacy owned by business units | Staff member reporting to the board | Business owners with a central coordinator | DPO slowly becoming the de facto decision maker |
| Large or high-risk processing | CPO-led programme with separate DPO | Independent, direct board line, own budget | CPO with privacy engineering and legal teams | CPO controlling the DPO's resources or reports |
| Group of companies | Group DPO plus local contacts; group CPO | One DPO easily accessible from each establishment (Art. 37(2)) | Group CPO and local privacy leads | Accessibility, language and local law differences |
Worked scenario: a scaling health technology company
A 400-person health app provider processes health data at large scale, so Article 37(1)(c) requires a DPO. It appointed its head of legal as "DPO and CPO" at launch. Three years on, that person approves new data uses, chairs the product privacy review and signs off DPIAs.
- Assessment: applying X-FAB, the person determines purposes and means for new features and then monitors them. The conflict is real.
- Restructure: the head of legal keeps the CPO role and the product decisions. A senior privacy manager with no approval rights becomes DPO, with a written charter, a budget line and a quarterly written report to the board.
- Process change: product teams own DPIAs; the DPO advises and records whether advice was followed. Deviations from DPO advice are minuted with reasons.
- Machine identities: the DPO's monitoring plan adds service accounts and API integrations that move health data to analytics and AI vendors, because those flows rarely appear in human-centred reviews. See the AI and GDPR Guide.
- Outcome: the supervisory authority's contact point is now someone who can credibly say they did not design the processing under question.
Implementing the split
- Map current decisions (weeks 1 to 2): list who approves new processing, DPIAs, retention, vendors and breach notification today.
- Run the Article 38(6) assessment (weeks 2 to 4): for each person with DPO tasks, record the decisions they make; any decision on purposes or means is a flag.
- Write two charters (weeks 4 to 6): a DPO charter (tasks, board access, resources, no-instruction clause, confidentiality) and a CPO mandate (decision rights, budget, programme ownership).
- Pilot on one process: run the next three DPIAs under the new split and check that DPO advice is recorded separately from the decision.
- Update public and regulator records: publish the DPO contact details and notify the supervisory authority of any change (Art. 37(7)).
- Rollback plan: if the new DPO lacks capacity, use an external DPO under a service contract rather than reverting to the combined role.
Detection and measurement
- Board reporting: number of DPO reports delivered directly to the highest management level per year (target at least one written report, plus ad hoc escalations).
- Advice followed: percentage of DPIAs and processing changes where DPO advice was recorded and either followed or overridden with written reasons (target 100 percent recorded).
- Timely involvement: share of new processing activities where the DPO was consulted before go-live.
- Conflict review currency: months since the last documented Article 38(6) assessment (target under 12, and after every reorganisation).
- Resource adequacy: DPO full-time equivalents and budget against the processing inventory size, reviewed yearly.
Common failure patterns
- The DPO marks its own homework: the same person approves processing and then monitors it, the pattern behind the Belgian 2020 fine.
- The dotted line: the DPO reports through the CPO or general counsel with only nominal board access, which the EDPB report found in practice.
- Voluntary DPO by accident: calling a privacy lead "DPO" when none is required triggers Articles 38 and 39 protections and tasks.
- DPO writing the DPIAs: the controller's work moves to the DPO, who then has nobody independent advising on it.
- Under-resourced external DPO: a few hours a month cannot cover the Article 39 tasks for large-scale processing.
- Blind spots in machine data flows: monitoring covers staff and customer processes but not service accounts, API keys and AI agents moving personal data; see AI Agents and Data Subject Rights.
Practitioner checklist
- Record whether Article 37(1) or Member State law requires a DPO, with the reasoning.
- Avoid the DPO title for privacy leads where no DPO is designated.
- Write a documented Article 38(6) conflict assessment for every DPO, citing X-FAB, and review it yearly.
- Give the DPO a direct, written route to the highest management level that the CPO cannot block.
- Separate DPO advice from processing decisions in DPIA and change records.
- Fund the DPO with a budget line and time allocation matched to the processing inventory.
- Publish DPO contact details and notify the supervisory authority of changes.
- Give the CPO a mandate with clear decision rights and programme ownership.
Standards and references
- GDPR Article 37: Designation of the data protection officer
- GDPR Article 38: Position of the data protection officer
- GDPR Article 39: Tasks of the data protection officer
- Court of Justice of the EU: Judgment in Case C-453/21, X-FAB Dresden
- EDPB: Coordinated Enforcement Action report on the designation and position of DPOs
- GDPR Article 83: General conditions for imposing administrative fines
- Hunton: Belgian DPA sanctions company for non-compliance with the GDPR's DPO requirements
Related NHI Mgmt Group resources: Privacy Engineer and DPO Career Guide, Privacy Programme Guide for Security Teams, DPIA Guide, Privacy Programme Maturity Model, Identity Data Privacy and Consent Guide. This guide summarises GDPR rules on the data protection officer and is not legal advice.