UK GDPR fundamentals · Article 37

When you need a Data Protection Officer

Updated April 2026UK GDPR Articles 37–39ICO aligned

Not every organisation needs a Data Protection Officer — but every organisation that does need one must appoint one, register their details with the ICO, and ensure they have the independence the role requires. Understanding when the Article 37 threshold is crossed, and what the DPO role entails in practice, is a fundamental part of any data protection programme.

How to read this guide. This guide explains statutory requirements and regulatory expectations derived from UK GDPR, DPA 2018, and ICO published guidance. It does not determine compliance in any specific case. Where we write “UK GDPR requires” we cite statute. Where we write “the ICO expects” or “the ICO has indicated” we cite regulatory guidance, which is not identical to a statutory obligation. Both matter — but they are different things.

When a DPO is mandatory

Article 37(1) requires a DPO in three circumstances: where the processing is carried out by a public authority or body; where the core activities consist of processing requiring regular and systematic monitoring of data subjects on a large scale; or where the core activities consist of large-scale processing of special category data or data relating to criminal convictions. Each trigger requires careful assessment — “large scale” and “regular and systematic monitoring” are not defined in the legislation.

Source: UK GDPR Article 37(1); ICO DPO guidance

The DPO’s role

Article 39 sets out the DPO’s minimum tasks: informing and advising the controller and employees of their obligations; monitoring compliance; providing advice on DPIAs; cooperating with the ICO; and acting as the point of contact with the ICO. The DPO must be involved early in all data protection matters and must have access to the highest management level.

Independence requirements

Article 38 requires the DPO to act independently and not be penalised for performing their tasks. They must not hold a position with a conflict of interest — a DPO who also serves as Head of IT or Marketing, with operational control over data processing, is likely conflicted. The ICO has highlighted this as a common failing.

Where no DPO is required

Where no DPO is mandatory, it is still good practice to designate a Data Protection Lead with clear accountability for data protection matters. Their existence and responsibilities should be documented in the data protection programme, though they do not have the statutory status or independence requirements of a DPO.

ICO registration

Where a DPO is appointed, their contact details must be communicated to the ICO and typically published in the privacy notice. The ICO maintains a published record of DPO contact details. Failure to notify the ICO of a mandatory DPO appointment, or to publish the DPO’s contact details as required, is a compliance failing.

Record this. Document the assessment of whether a DPO is required — the factors considered and the conclusion. If appointed, record the appointment formally including the role specification and independence safeguards. The documented assessment is itself evidence of accountability.

Not legal advice. This guide is derived from UK GDPR (Data Protection Act 2018 / DUAA 2025) and ICO published guidance as at April 2026. Obligations are subject to change. Consult a qualified solicitor or data protection practitioner for advice specific to your organisation.