Schools and academies: who can be your DPO?

Part of the guide Do you need a data protection officer? UK GDPR sets three tests

Which DPO appointment options can a school use?

In England, all maintained schools and academies must have a designated DPO. This guide covers those settings.

The Department for Education sets out several appointment routes. Whichever route you consider, check the person’s knowledge, other responsibilities and available time.

DPO appointment options for maintained schools and academies in England. These are alternatives, not a ranking.
Appointment route	What to check	A useful question
Existing employee	Expertise, time and other duties	Which duties would change to give the DPO enough time and avoid conflicts?
Shared DPO	Capacity across the schools covered	How much time and support would each school receive?
Community volunteer	Relevant knowledge and continuing support	What experience and resources would enable this person to do the job?
Contracted DPO	The agreed role and resources	Who would do the work, and what would the contract cover?

Can a headteacher, business manager or governor be the DPO?

Check what the person actually decides. The DPO cannot also hold a role that decides why and how personal data is used. A job title alone does not answer that question.

For a proposed headteacher, school business manager, governor or IT lead, write down their decision-making duties. Would they be reviewing data decisions they had made themselves? Use that question to examine a possible conflict, rather than treating it as a complete legal test.

Under the UK General Data Protection Regulation (UK GDPR), the DPO must report directly to the organisation’s highest management level. The organisation must not direct how the DPO performs their DPO tasks.

Check the person, not just the job title

List their decisions Write down what they decide about personal data.
Check the overlap Would they be reviewing decisions they made themselves?
Check independence They must be able to perform the DPO tasks independently and report to the top.

A starting point for checking a possible conflict. It is not a complete legal test.

What knowledge and qualifications should a school DPO have?

Look for expert knowledge of data protection law and practice, plus the ability to do the work. UK GDPR does not prescribe a particular DPO qualification.

The Department for Education says the person should understand school operations, the technology and systems the school uses, and cyber security. Ask candidates to explain how they would approach a data protection question involving a school system.

The school must provide the resources and access needed for the role, including support to keep the DPO’s knowledge current.

Your data protection officer needs to be impartial.

Yes. A DPO can cover more than one school. For public authorities or bodies sharing an appointment, UK GDPR requires their structure and size to be taken into account.

The arrangement must leave the DPO able to work effectively and easy to contact. Ask how each school would reach them, how competing requests would be handled and what cover would be available during absence or school holidays.

What should an outsourced school DPO contract cover?

An external DPO has the same role requirements as an internal DPO. Ask who the designated officer would be and how any supporting team would work with them.

School DPO work includes answering questions from parents, pupils and staff, reviewing privacy notices, and advising and reporting to governors or trustees. Ask the provider to explain how these responsibilities would be delivered.

Ask which tasks the school would retain, what support would be included in the fee and which work would cost extra. Compare the written scope alongside the price.

When The Assurance Desk recorded Data Protection People’s published service scope on 17 July 2026, it listed DPO for Schools alongside other DPO services. That is a dated example of a stated school service, not an assessment of whether the firm suits a particular school.

Who does the work after the DPO is appointed?

The DPO’s work includes monitoring staff awareness, training and audits. The DPO also advises on data protection impact assessments when asked and monitors how they are carried out.

All school staff still have responsibilities to protect personal data. Set out who will handle daily tasks and how they will involve the DPO promptly when data protection issues arise.

The organisation remains responsible for complying with UK GDPR. Appointing a DPO does not transfer that responsibility to the officer.

Appointing a DPO does not move every task

DPO Advises, monitors compliance and supports impact assessments.
School staff Protect personal data in their daily work and involve the DPO promptly.
The organisation Remains responsible for complying with UK GDPR.

Agree how these responsibilities work together in your school.

What to do

Write a role description that addresses knowledge, resources and conflicting responsibilities.
Ask for school experience and a clear explanation of how the proposed appointment would work.
Agree how the DPO would report to senior management and how staff would involve them.
Publish the DPO’s contact details, include them in privacy information and give them to the ICO, the UK data protection regulator.

Common questions

Can a school use a volunteer as its DPO?

The Department for Education lists volunteers from the wider school community as an option. The appointment still needs the expertise, time, support and freedom from conflicting duties required for the role.

Is an internal data protection lead the same as the DPO?

A supporting role does not by itself make someone the designated DPO. An organisation must identify its DPO and make the responsibilities of any supporting team clear.

Where next

Sources

This is an independent editorial guide, not legal advice.