What Does a Data Protection Officer Do? DPO Tasks Ireland
Last updated 14 October 2026. General information only, not legal advice.
A Data Protection Officer (DPO) advises an organisation on its data protection obligations, monitors whether it is meeting them, and acts as the contact point for the Data Protection Commission (DPC) and for individuals. The DPO does not run the compliance programme or take decisions on the organisation’s behalf. That stays with the controller or processor.
This guide sets out what the DPO role involves under the GDPR for Irish businesses, how it differs from a compliance manager, and what the organisation must provide to make the role work.
What is a DPO under GDPR?
The DPO role is set out in Articles 37 to 39 of the GDPR. Article 37 says when a DPO must be designated, Article 38 covers the DPO’s position in the organisation, and Article 39 lists the tasks.
Appointment is mandatory in three situations: the organisation is a public authority or body, its core activities involve large-scale regular and systematic monitoring of individuals, or its core activities involve large-scale processing of special-category or criminal-offence data. Outside those cases, appointing a DPO is optional unless other law requires one. If you are not sure which side of the line you fall on, see our guide to whether you need a DPO in Ireland.
The tasks of a DPO under Article 39
Article 39(1) sets out a minimum list of tasks. In practice they work out as follows.
1. Advising and informing
The DPO informs and advises the organisation, and the staff who handle personal data, about their obligations under the GDPR and other data protection rules. This might mean advising on a new customer app, a marketing campaign, a supplier contract or a staff-monitoring proposal before it goes live.
2. Monitoring compliance
The DPO monitors compliance with the GDPR, other data protection law and the organisation’s own policies. Article 39 includes the assignment of responsibilities, awareness-raising and training of staff, and related audits. A typical annual cycle includes reviewing policies, spot-checking how teams handle personal data, and reporting gaps to management.
3. Advising on data protection impact assessments
Where requested, the DPO advises on data protection impact assessments (DPIAs) and monitors how they are carried out. The DPO does not usually write the DPIA. The business owner of the project does, with the DPO’s input. If a project looks high-risk, our DPIA support page explains how we can help.
4. Cooperating with the supervisory authority
The DPO cooperates with the DPC, for example when it makes enquiries or opens an investigation.
5. Acting as contact point
The DPO is the contact point for the DPC on processing issues, including prior consultation where a high-risk processing operation cannot be adequately mitigated. Individuals can also contact the DPO about any issue relating to their personal data or the exercise of their rights.
Article 39(2) adds that the DPO must have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of the processing. In other words, effort should go where the risk is highest, not be spread evenly.
What a DPO is not responsible for
It is common to assume that the DPO is personally accountable for GDPR compliance. They are not. The controller or processor remains responsible for compliance and must be able to demonstrate it. Tasks that sit with the organisation include:
- keeping the record of processing activities (the DPO may help, but the obligation is the organisation’s);
- deciding the lawful basis, the purposes and the means of processing;
- carrying out DPIAs, and deciding whether to proceed after one;
- deciding whether to notify a personal data breach. Breaches must go to the DPC within 72 hours where feasible, so the DPO should be involved quickly. See our 72-hour data breach response guide.
What the organisation must provide: independence and resources
Article 38 sets conditions that the organisation, not the DPO, must meet:
- Early involvement: the DPO must be involved properly and in good time in all issues relating to personal data.
- Resources: the organisation must provide the resources needed, access to personal data and processing operations, and support for keeping the DPO’s knowledge up to date.
- Independence: the DPO must not receive instructions on how to carry out their tasks, and cannot be dismissed or penalised for performing them.
- Reporting line: the DPO reports directly to the highest management level.
- Confidentiality: the DPO is bound by secrecy or confidentiality in relation to their tasks.
Conflicts of interest
A DPO may have other duties, but Article 38(6) requires the organisation to make sure they do not result in a conflict of interests. The risk is greatest where the DPO also decides why and how personal data is processed. Roles such as head of IT, head of HR, head of marketing or a company director are the usual concern, because the person would end up advising on, and monitoring, their own decisions. Regulators and the EU courts have looked at this question, and it is a common reason organisations choose an external appointment instead.
Internal or outsourced DPO
Article 37(6) allows the DPO to be a member of staff or to perform the role under a service contract. An outsourced DPO is a practical option where the organisation does not have the expertise in house, or where no suitable employee would be free of conflicts. Either way, the independence and resourcing conditions above still apply.
Need help with this? Plus Promotions Limited provides an outsourced DPO service for Irish businesses, from €750 per month.
Registering your DPO in Ireland
If you appoint a DPO under Article 37(1), you must notify their contact details to the DPC. According to the DPC, notification is a one-off step with no fee, and an outsourced DPO must be notified as well. Separately, Article 37(7) requires you to publish the DPO’s contact details, for example in your privacy notice, so that individuals can reach them. The DPO does not have to be named publicly. Changes to the details must be notified to the DPC.
For the wider picture, see our GDPR and data protection guides hub.
Frequently asked questions
What does a Data Protection Officer do day to day?
Typically they review new projects and suppliers, advise staff, monitor compliance with policies, support DPIAs and data subject requests, train staff, and deal with the DPC. The mix depends on the size and risk of the organisation.
Is the DPO personally liable for GDPR breaches?
The GDPR places the compliance obligations on the controller or processor, not on the DPO. The DPO’s job is to advise and monitor.
Can a DPO be an outsourced provider?
Yes. Article 37(6) allows the DPO to perform the role under a service contract. An outsourced DPO must still be notified to the DPC and have their contact details published.
Who does the DPO report to?
The highest management level of the controller or processor, such as the board or the managing director. They must not be given instructions on how to carry out their tasks.
Do I have to tell the Data Protection Commission who my DPO is?
If you appoint a DPO under Article 37(1), yes. The DPC has an online form for this, and there is no fee.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
