# Schools and academies: who can be your DPO? Compare the appointment options for schools in England and the checks that help you choose someone who can do the job. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md). **The short answer.** A maintained school or academy in England can appoint a suitable employee, a shared officer or someone under a service contract as its data protection officer (DPO). The Department for Education also lists community volunteers as an option. Each appointment still needs the right expertise and freedom from conflicting duties ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/37) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). ## Which DPO appointment options can a school use? In England, all maintained schools and academies must have a designated DPO. This guide covers those settings ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), checked 7 October 2026). The Department for Education sets out several appointment routes. Whichever route you consider, check the person’s knowledge, other responsibilities and available time ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). **DPO appointment options for maintained schools and academies in England. These are alternatives, not a ranking.** | Appointment route | What to check | A useful question | | --- | --- | --- | | Existing employee | Expertise, time and other duties | Which duties would change to give the DPO enough time and avoid conflicts? | | Shared DPO | Capacity across the schools covered | How much time and support would each school receive? | | Community volunteer | Relevant knowledge and continuing support | What experience and resources would enable this person to do the job? | | Contracted DPO | The agreed role and resources | Who would do the work, and what would the contract cover? | Source: GOV.UK, Data protection in schools, Role of data protection officers, Guidance, https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 7 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 7 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/38 (checked 7 October 2026) ## Can a headteacher, business manager or governor be the DPO? Check what the person actually decides. The DPO cannot also hold a role that decides why and how personal data is used. A job title alone does not answer that question ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). For a proposed headteacher, school business manager, governor or IT lead, write down their decision-making duties. Would they be reviewing data decisions they had made themselves? Use that question to examine a possible conflict, rather than treating it as a complete legal test ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). Under the UK General Data Protection Regulation (UK GDPR), the DPO must report directly to the organisation’s highest management level. The organisation must not direct how the DPO performs their DPO tasks ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). **Check the person, not just the job title** 1. List their decisions: Write down what they decide about personal data. 2. Check the overlap: Would they be reviewing decisions they made themselves? 3. Check independence: They must be able to perform the DPO tasks independently and report to the top. A starting point for checking a possible conflict. It is not a complete legal test. Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/38 (checked 7 October 2026) ## What knowledge and qualifications should a school DPO have? Look for expert knowledge of data protection law and practice, plus the ability to do the work. UK GDPR does not prescribe a particular DPO qualification ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). The Department for Education says the person should understand school operations, the technology and systems the school uses, and cyber security. Ask candidates to explain how they would approach a data protection question involving a school system ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), checked 7 October 2026). The school must provide the resources and access needed for the role, including support to keep the DPO’s knowledge current ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). > "Your data protection officer needs to be impartial." > Department for Education, School DPO guidance > Department for Education, Role of data protection officers, https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 7 October 2026) ## Can academies or schools share a DPO? Yes. A DPO can cover more than one school. For public authorities or bodies sharing an appointment, UK GDPR requires their structure and size to be taken into account ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 7 October 2026). The arrangement must leave the DPO able to work effectively and easy to contact. Ask how each school would reach them, how competing requests would be handled and what cover would be available during absence or school holidays ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## What should an outsourced school DPO contract cover? An external DPO has the same role requirements as an internal DPO. Ask who the designated officer would be and how any supporting team would work with them ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). School DPO work includes answering questions from parents, pupils and staff, reviewing privacy notices, and advising and reporting to governors or trustees. Ask the provider to explain how these responsibilities would be delivered ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), checked 7 October 2026). Ask which tasks the school would retain, what support would be included in the fee and which work would cost extra. Compare the written scope alongside the price. When The Assurance Desk recorded Data Protection People’s published service scope on 17 July 2026, it listed DPO for Schools alongside other DPO services. That is a dated example of a stated school service, not an assessment of whether the firm suits a particular school ([The Assurance Desk, Data Protection People profile](https://theassurancedesk.com/advisers/data-protection-people), checked 7 October 2026). ## Who does the work after the DPO is appointed? The DPO’s work includes monitoring staff awareness, training and audits. The DPO also advises on data protection impact assessments when asked and monitors how they are carried out ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/39), checked 7 October 2026). All school staff still have responsibilities to protect personal data. Set out who will handle daily tasks and how they will involve the DPO promptly when data protection issues arise ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38) and [GOV.UK, Data protection in schools, Guidance](https://www.gov.uk/guidance/data-protection-in-schools), checked 7 October 2026). The organisation remains responsible for complying with UK GDPR. Appointing a DPO does not transfer that responsibility to the officer ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). **Appointing a DPO does not move every task** - **DPO**: Advises, monitors compliance and supports impact assessments. - **School staff**: Protect personal data in their daily work and involve the DPO promptly. - **The organisation**: Remains responsible for complying with UK GDPR. Agree how these responsibilities work together in your school. Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/39 (checked 7 October 2026); GOV.UK, Data protection in schools, Role of data protection officers, Guidance, https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 7 October 2026); ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026) ## What to do 1. Write a role description that addresses knowledge, resources and conflicting responsibilities ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/37) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). 2. Ask for school experience and a clear explanation of how the proposed appointment would work ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), checked 7 October 2026). 3. Agree how the DPO would report to senior management and how staff would involve them ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). 4. Publish the DPO’s contact details, include them in privacy information and give them to the ICO, the UK data protection regulator ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## Common questions ### Can a school use a volunteer as its DPO? The Department for Education lists volunteers from the wider school community as an option. The appointment still needs the expertise, time, support and freedom from conflicting duties required for the role ([GOV.UK, Data protection in schools, Role of data protection officers, Guidance](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/37) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/38), checked 7 October 2026). ### Is an internal data protection lead the same as the DPO? A supporting role does not by itself make someone the designated DPO. An organisation must identify its DPO and make the responsibilities of any supporting team clear ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) ## Sources - GOV.UK, Data protection in schools, Role of data protection officers, Guidance: https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 7 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 7 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/38 (checked 7 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026) - The Assurance Desk, Data Protection People profile: https://theassurancedesk.com/advisers/data-protection-people (checked 7 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/39 (checked 7 October 2026) - GOV.UK, Data protection in schools, Guidance: https://www.gov.uk/guidance/data-protection-in-schools (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.