Data protection officer (DPO)
A data protection officer is the person an organisation designates to inform, advise and monitor compliance with data protection law, and to act as the contact point for the supervisory authority and for data subjects. The role is independent by design: they report to the highest level of management and cannot be instructed on how to do the job.
Designation is mandatory under the regulation in three situations: public authorities, organisations whose core activities require large scale regular and systematic monitoring of individuals, and those whose core activities involve large scale processing of special category or criminal conviction data. Spanish law adds a list of specific cases where it is required and requires the designation to be notified to the AEPD. Outside those cases it is optional, and appointing one voluntarily brings the same independence requirements with it.
The constraint that causes most trouble in practice is conflict of interest. The role cannot be held by someone who determines how and why personal data is processed, which rules out the head of IT, the head of marketing and, in most structures, the chief information security officer. Appointing the security lead as data protection officer because they are the nearest available expert is a common and defective arrangement.
For a technical team this is the person who reads a security assessment for its privacy implications, and who has to answer for what was decided. It changes how a report is written: findings that touch personal data need the categories of data involved, the volume, the retention and the legal basis alongside the technical detail, because without those the officer cannot act on them. That is how we write them in the data protection work where technical findings are written for the person who has to act on them.