Can a company director or IT manager be the DPO?
Last updated 15 October 2026. General information only, not legal advice.
Usually not a director or an IT manager. Under Article 38(6) GDPR a DPO may have other duties, but your organisation must make sure none of them creates a conflict of interest. Senior management roles, including the head of IT, are the classic examples of roles that tend to conflict, because they decide how personal data is used.
What the GDPR says about the DPO’s other duties
The GDPR does not ban a DPO from holding another job. Article 38(6) says the DPO may fulfil other tasks and duties, but the controller or processor must ensure these do not result in a conflict of interest. The DPO must also be able to act without taking instructions on how to do the job, must not be penalised for doing it, and reports to the highest level of management (Article 38(3)).
The DPO’s core job is to monitor compliance and advise. A person who also decides why and how personal data is processed would be marking their own homework.
Why directors and IT managers are a problem
The guidelines on DPOs (originally from the Article 29 Working Party and endorsed by the European Data Protection Board) say positions that may conflict include chief executive, chief operating officer, chief financial officer, head of marketing, head of HR and head of IT. The test is not the job title. It is whether the role leads the person to determine the purposes and means of processing personal data. Lower-level roles can conflict too, so each case is assessed on the organisation’s own structure.
In practice:
- Company directors: directors set the business’s direction and approve how data is used, so they generally cannot oversee themselves.
- IT managers: they usually choose systems, retention settings and security measures, which are processing decisions the DPO is meant to review independently.
- HR and marketing leads: they run the main employee and customer datasets and decide how they are used.
Regulators elsewhere in the EU have acted on this. In 2020 the Belgian data protection authority fined a company €50,000 where its DPO also headed audit, risk and compliance.
Who can be the DPO instead?
A DPO must be chosen on the basis of professional qualities and expert knowledge of data protection law and practice (Article 37(5)). The Data Protection Commission says the GDPR does not prescribe specific qualifications, and the level of expertise should match the complexity, scale and sensitivity of your processing. Sensible options are a staff member whose role does not set processing purposes, such as a dedicated compliance or privacy officer, or an external provider under a service contract (Article 37(6)). Whoever it is needs the resources, access and time to do the job (Article 38(2)).
First check whether you must appoint one at all. Our guide on whether you need a Data Protection Officer in Ireland covers the Article 37(1) triggers. If you appoint one, the organisation must publish the DPO’s contact details and give them to the Data Protection Commission. Getting the role wrong is one of the issues that can feature when regulators look at your compliance; see our guide to GDPR fines in Ireland.
Need help with this? Plus Promotions Limited provides an outsourced DPO service for Irish businesses, from €750 per month.
Frequently asked questions
Does a DPO have to be an employee?
No. Article 37(6) GDPR allows the DPO to be a member of staff or to carry out the tasks under a service contract, so an external provider can act as DPO.
Can a DPO be the head of HR or marketing?
Usually not. The EDPB-endorsed guidelines on DPOs list head of marketing and head of HR alongside senior management roles as positions likely to conflict, because those roles typically decide how personal data is used.
Do small businesses have to appoint a DPO?
Only if they meet the Article 37(1) triggers: a public authority, regular and systematic monitoring of individuals on a large scale, or large-scale processing of special-category or criminal-offence data. Many small businesses are not required to appoint one.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
