# Can your IT manager be your DPO?

The job title is not the test, but the decisions that come with it matter.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

Part of the guide [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md).

**The short answer.** Your IT manager can be your data protection officer, or DPO, only if their other duties do not conflict with the role. They cannot also decide why and how your organisation uses personal data. Check the real work, rather than the job title ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## Where does the conflict of interest arise?

A conflict arises when the other role puts the person in charge of decisions the DPO must monitor. The ICO says a DPO cannot hold a position that determines the purposes and means of using personal data. In plain terms, that means why you use it and how ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

Ask who makes those decisions in your organisation. An IT title alone does not answer that question. The same check applies when another senior employee is being considered for the DPO role ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

**Check the jobs before combining them**

1. List the data decisions: What does their other role decide about why and how personal data is used?
2. Check for a conflict: Would the DPO monitor decisions they make in the other job?
3. Check skills and support: Look at expertise, time, resources and access to senior management.

Check each part of the arrangement. This diagram does not approve an appointment.

Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

## Is being good at IT enough to be a DPO?

No. The DPO needs experience and expert knowledge of data protection law. They also need enough time, resources and support to keep that knowledge up to date. Technical skill may help, but it does not replace those requirements ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

> "The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level."
> ICO, DPO guidance
> ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

## What should you check before appointing them?

Write down both jobs before deciding. The useful questions are about decisions, skills and support. They are more reliable than adding DPO to an existing job description and hoping the roles fit ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

**A practical check of the proposed arrangement**

| Question | What the role needs |
| --- | --- |
| What data decisions does their other job control? | No duty that decides the purposes and means of using personal data. |
| What data protection knowledge do they have? | Relevant experience and expert knowledge. |
| When will they do the work? | Enough time and resources. |
| Who can they report concerns to? | Access to the highest management level. |
| Can staff and the public reach them? | Readily available contact details. |

Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

## What if the roles do not fit?

You can change the duties, appoint another suitable employee or use an external DPO under a service contract. An outside appointment has the same position, tasks and duties as an internal one ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

Your organisation remains responsible for following UK GDPR. The DPO advises and monitors. They do not take that responsibility away from the business ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## What to do

1. List the data decisions the proposed DPO makes in their other job ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).
2. Check for a conflict before combining the roles ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).
3. Check their expertise, time and access to senior management ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).
4. If the duties conflict, change the arrangement or consider another appointment ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## Common questions

### Is every IT manager barred from being a DPO?

The ICO’s test is whether the duties conflict. An existing employee can be the DPO if their other duties are compatible ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

### Can we outsource the role instead?

Yes. You can contract with an individual or an organisation. The DPO’s position, tasks and duties stay the same ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

### Do these checks apply to a voluntary DPO?

Yes. A voluntary appointment has the same requirements for the position and tasks ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md)
- [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md)
- [Schools and academies: who can be your DPO?](https://theassurancedesk.com/guides/schools-and-academies-who-can-be-your-dpo.md)
- [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md)
- [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md)

## Sources

- ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.