Do you need a data protection officer? UK GDPR sets three tests

When does UK GDPR make a data protection officer compulsory?

UK GDPR makes a data protection officer (DPO) compulsory if you meet one of three tests. You are a public body. Your main work is tracking people regularly and systematically on a large scale. Or your main work is handling sensitive or criminal offence data on a large scale.

Suppliers that handle data for others face the same tests. Main work means UK GDPR's core activities, and sensitive data means special category data, such as health information.

UK GDPR does not define large scale. The ICO points to five factors from EU regulators' guidance, which it calls useful but not binding in the UK: how many people, how much data, how many kinds of data, how wide an area, and how long it lasts.

What does a data protection officer have to do?

A data protection officer advises your organisation and its staff on their data protection duties, and checks that the organisation follows the rules. In return, UK GDPR says you must give the officer the resources and the independence to do the job.

Can someone already on the team do it?

Yes, someone on your team can be your data protection officer, unless their other work creates a conflict of interest, such as deciding why and how you use personal data. The ICO's example is a head of marketing who decides which customers to target.

What happens if you appoint one when you do not have to?

A data protection officer you appoint by choice has the same position and tasks under UK GDPR as a compulsory one. Do not call other data protection specialists your DPO, because the title belongs to a role with particular requirements.

Can the role be outsourced, and to whom?

Yes, under UK GDPR a data protection officer can be on your staff or work under a service contract, with an individual or an organisation. UK GDPR asks for expert knowledge of data protection law and practice, but does not name a qualification the officer must hold.

Ask an outside provider what the fee covers, including help with a data breach. See providers that publish a price and how DPO services are priced.

What should you write down, and what must you tell the ICO?

If you appoint a data protection officer, you must publish the officer's contact details and give them to the ICO, which became the Information Commission on 30 September 2026. If you decide not to appoint, the ICO says it is a good idea to record that decision, because it helps show that you meet UK GDPR's accountability principle.

If your provider is your officer and you switch, give the ICO the new officer's details through its online service. The service asks for your registration reference and security number.

Read what to check before a first appointment or what to check when you switch.

Did the UK's Data (Use and Access) Act 2025 change the rules?

The Data (Use and Access) Act 2025 (UK) kept UK GDPR's three tests for a data protection officer, except that it added tribunals to the court exception, from 20 August 2025. The officer's position and tasks are unchanged, apart from the regulator's name, the Information Commission, since 30 September 2026.

What to do

1. Answer the ICO's online DPO questions, then write down the result and your reasons.
2. Check that your candidate does not decide why and how you use personal data.
3. Ask any outside provider, in writing, who the officer will be and how many other clients that officer serves. Ask what the fee covers and what indemnity cover the firm holds.
4. Use the title DPO only for the person who holds the legal role.

Common questions

Can a small business need a data protection officer?

Sometimes. UK GDPR sets no minimum size for this duty, so a small firm is caught by the same three tests as any other organisation.

Is the data protection officer personally liable if you get it wrong?

No. The officer is not personally liable for data protection compliance, and your organisation remains responsible.

Can one data protection officer serve several organisations?

Yes. A group of companies may share one officer if every part of the group can reach the officer easily.

Do you have to publish the officer's name?

No. You can publish the contact details without the name. When you report a personal data breach to the ICO, the report must give the name and contact details of your officer or of another contact point.

Where next

• First DPO or AI policy
• Switching provider
• Regulated sectors
• How much does an outsourced DPO cost, and what does it cover?
• How do I choose a data protection or AI governance adviser?
• Is a data protection officer a senior role?
• Does GDPR apply to small businesses and sole traders?

This is an independent editorial guide, not legal advice.