Can a C-suite executive also be the DPO?

Assigning the Data Protection Officer (DPO) role to a C-suite executive or senior leader can seem like a practical solution. They understand the organisation, have direct access to decision-makers, and are often already responsible for overseeing compliance or governance. 

However, this is a risky strategy that could violate data protection laws like the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR).  

This blog explains what the law says, why conflicts of interest commonly arise for C-suite executives, and how organisations can structure the DPO role to support effective and independent oversight. 

Key takeaway: A C-suite executive can only act as a Data Protection Officer where their other responsibilities do not create a conflict of interest. Because senior leadership roles typically involve determining the purposes and means of processing personal dataInformation which relates to an identified or identifiable natural person., they will usually be unsuitable for the DPO role. 

• Can a C-suite executive legally act as a DPO?
• Why do C-suite roles usually create a conflict of interest?
• Which senior roles are likely to conflict with the DPO role?
• Can the DPO report to the CEO?
• How should organisations structure the DPO role?

Can a C-suite executive legally act as a DPO?

Neither the UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. nor the EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation). expressly prohibits a C-suite executive from acting as a Data Protection Officer. 

Instead, Article 38(6) states that a DPO may perform other tasks and duties provided these do not result in a conflict of interest. 

In practice, this means organisations must assess whether an individual’s other responsibilities prevent them from carrying out the DPO role independently. It’s not about their job title or seniority, but whether their role involves determining the purposes and means of processing personal data. If it does, a conflict of interest is likely to arise because they would be responsible for independently monitoring decisions that they themselves helped to make. 

The Court of Justice of the European UnionA Court interpreting EU law, ensuring it is applied in the same way in all EU countries, and settling legal disputes between national governments and EU institutions. The Courts ensure the correct interpretation and application of primary and secondary EU law within the EU. It consists of two courts: the Court of Justice and the General Court. (CJEU) reinforced this principle in X-FAB Dresden GmbH & Co. KG v FC (Case C-453/21). The Court confirmed that organisations must assess the responsibilities performed by the individual, rather than simply relying on their job title, when determining whether a conflict of interest exists. 

Why do C-suite roles usually create a conflict of interest? 

The DPO has a unique role within an organisation. Rather than making operational decisions, they provide independent advice, monitor compliance with data protection lawAny law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) that relates to the protection of individuals with regards to the Processing of personal data., and offer challenge to the organisation where necessary. 

Most senior executives, however, are responsible for making strategic and operational decisions that influence how personal data is processed. 

This can include decisions about: 

• What personal data will be collected  
• Why data will be used  
• Which technologies or suppliers will processA series of actions or steps taken in order to achieve a particular end. that data 
• How long data will be retained  
• What level of risk the organisation is prepared to accept 

When someone performs both roles, they may be required to assess the lawfulness of decisions they were directly involved in making. 

The European Data Protection Board (EDPB) has consistently identified senior management positions as examples of roles that commonly create conflicts of interest because of their influence over organisational decision-making. 

The issue is therefore often one of independence, rather than expertise. A highly knowledgeable executive may still be unsuitable if they cannot objectively oversee decisions for which they are accountable. 

Which senior roles are likely to conflict with the DPO role?

The below roles commonly create conflicts of interest. However, organisations should always assess the individual’s actual responsibilities rather than relying solely on their job title. 

Can the DPO report to the CEO? 

Many organisations assume that if the CEO cannot act as the DPO, the DPO cannot report to them either, but this is not the case. A DPO can report to the CEO, but it depends on the company’s size and structure. 

Article 38(3) of the UK GDPR and EU GDPR requires the DPO to report directly to the organisation’s highest management level. This does not necessarily mean having a direct reporting line to the CEO. Depending on the organisation’s governance structure, the DPO may report to the Board, senior leadership team (SLT), management committee, or another appropriate senior decision-making body. 

This reporting line ensures that data protection issues receive appropriate visibility and support within the organisation. However, reporting to senior management does not mean the DPO should become part of the operational management responsible for making processing decisions. 

A DPO should be able to: 

• Provide advice without influence  
• Raise concerns directly with senior leadership  
• Question proposed processing activities where necessary  
• Carry out their duties without receiving instructions about how those duties should be performed.  

How should organisations structure the DPO role? 

There is no single model that suits every organisation, but the DPO should always be able to perform their duties independently and without conflicting operational responsibilities. 

Depending on the organisation’s size and structure, this may involve appointing an internal DPO, whose responsibilities are clearly separated from operational decision-making, or appointing an external or outsourced DPO, especially in circumstances where internal independence cannot realistically be achieved. 

An outsourced DPO can provide an additional layer of independence whilst giving organisations access to specialist expertise and practical advice without the constraints that can arise from internal reporting structures. 

Whether you choose the in-house or outsourced DPO route, you need to:

• Provide the DPO with direct access to senior management and adequate resources 
• Document any assessment of potential conflicts of interest  
• Periodically review the DPO’s responsibilities and resources as the organisation evolves  

If you’re unsure whether your current DPO arrangement meets the requirements of the UK GDPR and EU GDPR, The DPO Centre’s experienced DPOs can help you assess your governance and implement an appropriate solution. 

Get in touch to find out how we can help.

In case you missed it…

• 5 signs your organisation needs a Data Protection Officer 
• AI Officer vs DPO: Defining roles in AI governance 
• GDPR DPO requirements: What qualifies as large-scale processing?