# Do you need a data protection officer? UK GDPR sets three tests

Ask this before you hire anyone, because the answer changes what you need to buy.

The Assurance Desk. Published 29 September 2026. Last checked 7 October 2026.

**The short answer.** UK GDPR requires a data protection officer only if you meet one of three tests. You are a public body. Your main work is tracking people regularly and systematically on a large scale. Or your main work is handling sensitive data or criminal offence data on a large scale. Anyone else may appoint one by choice, and the same rules then apply ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and [the ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

## In this series

- [Can your IT manager be your DPO?](https://theassurancedesk.com/guides/can-your-it-manager-be-your-dpo.md)
- [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md)
- [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md)
- [Schools and academies: who can be your DPO?](https://theassurancedesk.com/guides/schools-and-academies-who-can-be-your-dpo.md)

## When does UK GDPR make a data protection officer compulsory?

UK GDPR makes a data protection officer (DPO) compulsory if you meet one of three tests. You are a public body. Your main work is tracking people regularly and systematically on a large scale. Or your main work is handling sensitive or criminal offence data on a large scale ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026).

Suppliers that handle data for others face the same tests ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026). Main work means UK GDPR's core activities, and sensitive data means special category data, such as health information ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

UK GDPR does not define large scale. The ICO points to five factors from EU regulators' guidance, which it calls useful but not binding in the UK: how many people, how much data, how many kinds of data, how wide an area, and how long it lasts (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

**The three UK GDPR tests, with examples**

| Test | Caught | Not caught on its own |
| --- | --- | --- |
| You are a public body | Public bodies as the Data Protection Act 2018 (UK) defines them, when they carry out public tasks | Courts and tribunals acting in their judicial capacity |
| Your main work is tracking people regularly and systematically on a large scale | A large retail website that tracks searches and purchases to make recommendations | Tracking that is not part of your main work |
| Your main work is handling sensitive data or criminal offence data on a large scale | A health insurer that holds health information on a large number of people | HR work on staff data, which the ICO calls a secondary function for most organisations |

## What does a data protection officer have to do?

A data protection officer advises your organisation and its staff on their data protection duties, and checks that the organisation follows the rules. In return, UK GDPR says you must give the officer the resources and the independence to do the job ([UK GDPR Article 38](https://www.legislation.gov.uk/eur/2016/679/article/38) and [Article 39](https://www.legislation.gov.uk/eur/2016/679/article/39), checked 29 September 2026).

**The officer's job, and yours**

- **What the officer does**
  - Advises you and your staff on your duties
  - Checks that you follow the rules, including staff training and audits
  - Works with the ICO and is its contact point
- **What you must do**
  - Involve the officer in every data protection issue, properly and on time
  - Give the officer the resources needed
  - Make sure nobody tells the officer how to do the tasks
  - Do not dismiss or penalise the officer for doing them
  - Let the officer report directly to your most senior management

Source: UK GDPR Article 39, legislation.gov.uk, https://www.legislation.gov.uk/eur/2016/679/article/39 (checked 29 September 2026); UK GDPR Article 38, legislation.gov.uk, https://www.legislation.gov.uk/eur/2016/679/article/38 (checked 29 September 2026)

## Can someone already on the team do it?

Yes, someone on your team can be your data protection officer, unless their other work creates a conflict of interest, such as deciding why and how you use personal data (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). The ICO's example is a head of marketing who decides which customers to target (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

## What happens if you appoint one when you do not have to?

A data protection officer you appoint by choice has the same position and tasks under UK GDPR as a compulsory one. Do not call other data protection specialists your DPO, because the title belongs to a role with particular requirements (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

> "The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level."
> ICO, DPO guidance
> The ICO, guidance on data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026)

## Can the role be outsourced, and to whom?

Yes, under UK GDPR a data protection officer can be on your staff or work under a service contract, with an individual or an organisation ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). UK GDPR asks for expert knowledge of data protection law and practice, but does not name a qualification the officer must hold ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

Ask an outside provider what the fee covers, including help with a data breach. See [providers that publish a price](/lists/providers-that-publish-a-price) and [how DPO services are priced](/guides/how-dpo-and-data-protection-services-are-priced).

## What should you write down, and what must you tell the ICO?

If you appoint a data protection officer, you must publish the officer's contact details and give them to the ICO, which became the [Information Commission](/news/ico-becomes-the-information-commission) on 30 September 2026 ([UK GDPR Article 37 from that date](https://www.legislation.gov.uk/eur/2016/679/article/37/2026-09-30), the [UK commencement regulations, S.I. 2026/1015](https://www.legislation.gov.uk/uksi/2026/1015/made) and [the ICO](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/), checked 2 October 2026). If you decide not to appoint, the ICO says it is a good idea to record that decision, because it helps show that you meet UK GDPR's accountability principle (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

If your provider is your officer and you switch, give the ICO the new officer's details through its online service. The service asks for your registration reference and security number ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 29 September 2026).

Read [what to check before a first appointment](/best/first-appointment) or [what to check when you switch](/best/switching-provider).

**After deciding whether you need a DPO**

1. Record your decision: If you decide not to appoint, write down why.
2. If you appoint: An appointed DPO needs knowledge, resources and independence.
3. Publish the contact: If you appoint, give the DPO’s contact details to the ICO as well.

A practical sequence from the ICO guidance. A voluntary DPO has the same role requirements.

Source: ICO guidance on data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026); ICO service to add or change your DPO, https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/ (checked 29 September 2026)

## Did the UK's Data (Use and Access) Act 2025 change the rules?

The Data (Use and Access) Act 2025 (UK) kept UK GDPR's three tests for a data protection officer, except that it added tribunals to the court exception, from 20 August 2025 ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and [Schedule 11 to the Act](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11), checked 29 September 2026). The officer's position and tasks are unchanged, apart from the regulator's name, the Information Commission, since 30 September 2026 ([UK GDPR Article 38](https://www.legislation.gov.uk/eur/2016/679/article/38) and [Article 39 from 30 September 2026](https://www.legislation.gov.uk/eur/2016/679/article/39/2026-09-30), checked 2 October 2026).

## What to do

1. Answer the ICO's [online DPO questions](https://ico.org.uk/for-organisations/data-protection-fee/does-my-organisation-need-a-data-protection-officer-dpo/), then write down the result and your reasons.
2. Check that your candidate does not decide why and how you use personal data.
3. Ask any outside provider, in writing, who the officer will be and how many other clients that officer serves. Ask what the fee covers and what indemnity cover the firm holds.
4. Use the title DPO only for the person who holds the legal role.

## Common questions

### Can a small business need a data protection officer?

Sometimes. UK GDPR sets no minimum size for this duty, so a small firm is caught by the same three tests as any other organisation ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026).

### Is the data protection officer personally liable if you get it wrong?

No. The officer is not personally liable for data protection compliance, and your organisation remains responsible (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

### Can one data protection officer serve several organisations?

Yes. A group of companies may share one officer if every part of the group can reach the officer easily ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026).

### Do you have to publish the officer's name?

No. You can publish the contact details without the name. When you report a personal data breach to the ICO, the report must give the name and contact details of your officer or of another contact point (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/) and [UK GDPR Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Switching provider](https://theassurancedesk.com/best/switching-provider.md)
- [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md)
- [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md)
- [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md)

## Sources

- UK GDPR Article 33, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026)
- UK GDPR Article 37, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 29 September 2026)
- UK GDPR Article 37 from 30 September 2026, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/37/2026-09-30 (checked 2 October 2026)
- UK GDPR Article 38, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/38 (checked 2 October 2026)
- UK GDPR Article 39, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/39 (checked 29 September 2026)
- UK GDPR Article 39 from 30 September 2026, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/39/2026-09-30 (checked 2 October 2026)
- Data Protection Act 2018 (UK), section 7: https://www.legislation.gov.uk/ukpga/2018/12/section/7 (checked 29 September 2026)
- Data (Use and Access) Act 2025 (UK), Schedule 11: https://www.legislation.gov.uk/ukpga/2025/18/schedule/11 (checked 29 September 2026)
- UK commencement regulations, S.I. 2026/1015: https://www.legislation.gov.uk/uksi/2026/1015/made (checked 2 October 2026)
- ICO guidance on data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026)
- ICO questions on whether you need a DPO: https://ico.org.uk/for-organisations/data-protection-fee/does-my-organisation-need-a-data-protection-officer-dpo/ (checked 29 September 2026)
- ICO service to add or change your DPO: https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/ (checked 29 September 2026)
- Freedom of Information Act 2000 (UK), Schedule 1: https://www.legislation.gov.uk/ukpga/2000/36/schedule/1 (checked 29 September 2026)
- The ICO: ICO welcomes transition to new Information Commission, 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.