We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Can your IT manager be your DPO?

The job title is not the test, but the decisions that come with it matter.

Your IT manager can be your data protection officer, or DPO, only if their other duties do not conflict with the role. They cannot also decide why and how your organisation uses personal data. Check the real work, rather than the job title.

Checked 7 October 2026

Contents
  1. Where does the conflict of interest arise?
  2. Is being good at IT enough to be a DPO?
  3. What should you check before appointing them?
  4. What if the roles do not fit?
  5. What to do
  6. Common questions
  7. Sources

Part of the guide Do you need a data protection officer? UK GDPR sets three tests

Where does the conflict of interest arise?

A conflict arises when the other role puts the person in charge of decisions the DPO must monitor. The ICO says a DPO cannot hold a position that determines the purposes and means of using personal data. In plain terms, that means why you use it and how.

Ask who makes those decisions in your organisation. An IT title alone does not answer that question. The same check applies when another senior employee is being considered for the DPO role.

Check the jobs before combining them

  1. List the data decisions What does their other role decide about why and how personal data is used?
  2. Check for a conflict Would the DPO monitor decisions they make in the other job?
  3. Check skills and support Look at expertise, time, resources and access to senior management.
Check each part of the arrangement. This diagram does not approve an appointment.

Is being good at IT enough to be a DPO?

No. The DPO needs experience and expert knowledge of data protection law. They also need enough time, resources and support to keep that knowledge up to date. Technical skill may help, but it does not replace those requirements.

The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level.

ICO DPO guidance
Read original

What should you check before appointing them?

Write down both jobs before deciding. The useful questions are about decisions, skills and support. They are more reliable than adding DPO to an existing job description and hoping the roles fit.

A practical check of the proposed arrangement
QuestionWhat the role needs
What data decisions does their other job control?No duty that decides the purposes and means of using personal data.
What data protection knowledge do they have?Relevant experience and expert knowledge.
When will they do the work?Enough time and resources.
Who can they report concerns to?Access to the highest management level.
Can staff and the public reach them?Readily available contact details.

What if the roles do not fit?

You can change the duties, appoint another suitable employee or use an external DPO under a service contract. An outside appointment has the same position, tasks and duties as an internal one.

Your organisation remains responsible for following UK GDPR. The DPO advises and monitors. They do not take that responsibility away from the business.

What to do

  1. List the data decisions the proposed DPO makes in their other job.
  2. Check for a conflict before combining the roles.
  3. Check their expertise, time and access to senior management.
  4. If the duties conflict, change the arrangement or consider another appointment.

Common questions

Is every IT manager barred from being a DPO?

The ICO’s test is whether the duties conflict. An existing employee can be the DPO if their other duties are compatible.

Can we outsource the role instead?

Yes. You can contract with an individual or an organisation. The DPO’s position, tasks and duties stay the same.

Do these checks apply to a voluntary DPO?

Yes. A voluntary appointment has the same requirements for the position and tasks.

Where next

Sources

  1. ICO, Data protection officers, checked 7 October 2026

This is an independent editorial guide, not legal advice.