There is something deceptively ceremonial about being appointed a Data Protection Officer. The title arrives with authority, independence and the reassuring weight of legislation behind it, and for a brief moment you may imagine that the difficult part was acquiring enough knowledge to deserve the appointment. Then you enter the organisation and discover that the law was merely your passport. Somewhere there is a ROPA nobody entirely trusts, a retention schedule inherited from another age, a processor whose contract promises deletion while nobody has thought to test it, and a product team already halfway through building something that privacy has only just heard about. This is usually when the education of the DPO truly begins.
I have learnt from experience that the greatest temptation for a newly appointed DPO is to demonstrate expertise by finding everything that is wrong. It is remarkably easy to do. Give a competent privacy professional access to an organisation for several weeks and they will return carrying gaps like fishermen returning from sea: missing DPIAs, inconsistent lawful bases, questionable retention periods, incomplete records, weak processor oversight and policies approaching archaeological status. The difficulty is not finding twenty problems. The difficulty is sitting before senior leadership and explaining, with conviction, why three of them deserve attention before the other seventeen.
That is the moment privacy becomes governance. Boards rarely need another recital of the GDPR because legislation is not how they experience organisational failure. They experience it through regulatory exposure, operational disruption, customer harm, reputational damage, wasted capital and decisions made without adequate information. An incomplete ROPA therefore matters not because Article 30 says one should exist, but because an organisation that cannot reliably describe its processing activities may also struggle to understand the blast radius of an incident, challenge a supplier, execute deletion, respond to a regulator or know what it has exposed when a system fails.
The DPO who understands this begins to speak differently. Privacy vocabulary remains important, but it becomes the foundation rather than the ceiling of the conversation. When I discuss retention with executives, for example, the question is not merely whether information has exceeded a prescribed period; it is why the organisation continues carrying a liability whose business value may already have expired. When discussing DPIAs, I am less interested in celebrating the number completed than understanding whether material privacy risks are influencing decisions before money is spent, contracts are signed and technology becomes difficult to unwind. Governance has little value when it arrives after inevitability.
This also requires abandoning one of the profession’s more comfortable illusions: that independence means distance. A DPO cannot understand risk by observing the organisation from a privacy citadel. You need to understand how the business makes money, where growth is expected to come from, which technology the organisation is betting on, where third parties have become operationally indispensable and what senior management worries about when privacy professionals are not in the room. Only then can independence become useful, because challenging a decision without understanding what produced it is compliance; challenging it while understanding the commercial consequences is judgement.
Aspiring DPOs should therefore study beyond privacy with some seriousness. Read the annual report and strategy alongside regulatory guidance. Understand risk appetite, product governance, procurement, outsourcing, technology architecture and, crucially, the economics of the organisation you advise. A £10 million transformation programme does not become a “privacy project” because personal data appears somewhere inside it, yet the privacy implications may determine whether that investment produces value or creates an expensive remediation programme three years later. The DPO who can make that connection will eventually find that conversations at board level become less about explaining privacy and more about shaping decisions.
There will, of course, be uncomfortable moments. Senior executives occasionally want certainty where the law offers judgement, and businesses naturally prefer answers that allow momentum to continue. The mature DPO learns that the most useful question is not always, “Can we do this?” Sometimes it is whether we should do it, what assumptions make the decision defensible, who owns the residual risk and whether we would remain comfortable explaining the same decision to customers, regulators and the board after something has gone wrong. Those questions move privacy from legal interpretation into organisational character.
Perhaps that is what surprised me most about becoming a DPO. The further I progressed into privacy leadership, the less the job seemed to be about privacy alone. A ROPA became a map of organisational memory; a DPIA became evidence of institutional judgement; breach management became a test of whether governance survives contact with panic; retention became a conversation about whether an organisation possesses the discipline to let go of information simply because it can no longer justify keeping it. The artefacts remained the same, but their meaning changed once viewed from the boardroom.
So when the appointment finally comes, resist the urge to spend your first months proving how much privacy law you know. The organisation probably already assumes that competence, which is why it gave you the title. Spend that time understanding where decisions are made, where accountability becomes blurred, where commercial ambition is moving faster than governance and where the organisation may be carrying risks it has normalised simply because nothing has happened yet. A good DPO can explain the law with precision; a board-level DPO understands the business well enough to recognise the moment when tomorrow’s privacy problem is being created today, while everyone else in the room still believes they are discussing growth.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
