The real test of a DPO comes when expertise meets organisational reality.
7 minute read
On Tuesday morning, ASOS app users received a push notification that did not come from ASOS. It was addressed to the company’s DPO and IT team, claimed that the sender had “fully compromised the Snowflake instance”, and ended: “Engage with us, or we will leak it.”
At the time this article was drafted, ASOS had confirmed unauthorised activity involving third-party platforms used to communicate with customers and stated that names and contact details may have been exposed. ASOS said it did not believe payment card details or account passwords had been affected. Snowflake also stated that it had found no compromise of its own platform.
The facts are still emerging and I will not speculate about what happened inside ASOS. My thoughts are with the teams working through it, and with the customers wondering what it means for them. Anyone who has managed a serious incident knows how intense those first days are. It is unusual to see a DPO named in the attack itself, and it is a reminder of how much rests on that role when something goes wrong. The DPO is expected to advise quickly, calmly and independently, often on incomplete facts and under real pressure. They can only do that well if they have been properly supported and empowered long before the incident arrives, with clear access to decision-makers, organisational standing, sufficient resources, operational independence, and the backing needed to give difficult advice and have it heard.
I have put together a short carousel on what makes a good DPO, and this week felt like the right time to share it. None of what follows is about blame. It is about ensuring the person in that seat has the access, support and authority they need to be effective when they are needed most.
The question usually gets answered with a list of qualifications. Expert knowledge of data protection law, familiarity with the sector, a working understanding of the organisation's processing. All of that matters, and none of it is optional. Whilst those things are necessary, they are rarely what determines whether a DPO succeeds. In my experience the difference is made by the conditions the organisation puts around the role.
The DPO belongs in the third line of defence
Many organisations treat the DPO as an operational function. The DPO writes the DPIAs, maintains the record of processing, works through the privacy inbox and clears the ticket queue. That is delivery work, and it sits properly in the first and second lines, with the business that owns the risk and the teams that build and run the controls.
Article 39 gives the DPO a different task: to inform, to advise, to monitor compliance and to cooperate with the supervisory authority. That is third line work. It only means something if it is performed independently of the activity being reviewed. If the DPO designs and builds the control, there is nobody left to assess whether the control actually works. Article 38(6) is clear that any other tasks must not give rise to a conflict of interest, and doing the work whilst also assuring it is precisely such a conflict. The person advising on whether to notify the ICO and affected customers should not also be the person whose controls are under review.
Advice given without fear
Independence is written into the Regulation. Article 38 requires that the DPO receives no instructions regarding the exercise of their tasks, is not dismissed or penalised for performing them, and reports to the highest management level. Article 38(2) requires that the organisation provides the resources necessary to carry out those tasks and to maintain expert knowledge.
In practice, independence is something an organisation grants rather than something a DPO can declare. It looks like a direct reporting line that is not filtered through the function being reviewed. It looks like budget, headcount, tooling, training and protected time. A DPO who is uncertain about the consequences of giving unwelcome advice will, over time, give less of it. That is a quiet risk, and it does not show up on a compliance dashboard. The real test often comes in the first few hours, when a DPO may need to recommend notifying the ICO on incomplete information, or telling customers what has happened and what steps they can take to protect themselves, before the business feels fully ready to do so.
The panned out view
A DPO can only advise on what they can see. That means line of sight across every area of the business processing personal data, including HR, marketing, product, sales, procurement, security, finance and data teams, as well as the third parties acting on the organisation's behalf and the platforms they provide.
The ASOS incident, as reported so far, appears to involve third-party platforms used to communicate with customers. Customer engagement tools, push notification services, CRM systems and cloud data platforms can hold significant volumes of customer data, and responsibility for them may sit across marketing, digital, data and technology functions. If a DPO does not have visibility of which vendors process customer data, what information they hold, and who can access those systems, it becomes far harder to assess risk in advance or help scope and respond to a breach when one occurs.
Where responsibility for AI governance sits with the DPO, the same principle applies. Seeing the completed assessment is not the same as understanding how use cases are identified and approved, how the model inventory is maintained, what triggers a DPIA or fundamental rights impact assessment, where training data comes from, or how human oversight is demonstrated. A DPO reviewing the output of a governance process without visibility of the process itself can offer only limited assurance.
Presence across the organisation matters
An advisory role runs on influence, and influence is built long before it is needed. It helps to be a familiar face around product, change, procurement, security and HR forums rather than simply another name on the mailing list. Building relationships early creates trust and, over time, a group of listening ears when difficult conversations need to happen. The first interaction with a team should not be during an incident or compliance escalation. When an incident does land, those relationships are what get the DPO accurate facts from marketing, security and the vendor in hours rather than days. Advice is also more likely to be acted on when it is expressed in terms the business already understands, such as risk, cost, timelines and customer trust, and when it helps teams find a safe path forward rather than simply pointing out the limits.
It also helps to make the work itself visible. A risk-based annual workplan, agreed at the highest level, helps the organisation understand the DPO's priorities and the reasons behind them. Regular attendance at team meetings and governance forums provides valuable insight into evolving risks, levels of understanding, and where additional support or training may be needed. It also creates opportunities to gather meaningful data and metrics that demonstrate trends, resource pressures, and the case for further investment in privacy and governance. A short quarterly report to the board helps keep privacy on the agenda throughout the year, not just when an incident occurs. Maintaining a written record of advice given, including advice that was not followed, supports accountability and protects all parties. Just as importantly, the DPO should highlight the good privacy practices being adopted across the organisation, not just the risks, incidents and poor practices that have been identified and addressed.
Empower the role, then assess its impact
The most effective DPOs are involved early, when ideas are taking shape and changes can still be made quickly and at relatively low cost. A regular seat at change, product, AI and vendor governance forums is often more valuable than any job title. So too is access to the information needed to do the role properly: systems, records of processing activities, contracts, incident logs and the risk register, together with a clearly defined role in the incident response plan and sufficient budget for training, tooling and specialist advice.
Reporting then becomes important. Rather than focusing on isolated snapshots, organisations should look at trends over time and the direction of travel. Useful metrics for a DPO to report on include:
DPIAs raised and completed, including any occasions where DPO advice was not followed.
Time taken to respond to data subject requests and close incidents, including more complex or higher-risk cases.
Oversight of third-party providers and international data transfers.
AI use cases assessed, compared with those in active use across the organisation.
Training completion rates, recurring themes and repeat issues.
Privacy and governance maturity, tracked over time.
Maturity that is not measured is difficult to demonstrate, whether to a board, a client or a supervisory authority.
In short
A good DPO is knowledgeable, independent, properly resourced and able to see the whole picture. Three of those four are given by the organisation, and incidents like this week’s are when they are tested, in public and at speed. Get the conditions right and the DPO stops being seen as a barrier to the business and becomes an early warning system for it.
The carousel below brings these points together across ten slides. If you find it useful, please feel free to share it with colleagues.
Is your DPO function set up for success?
A capable DPO can only be effective when the right governance, reporting lines, access and support are in place. If you would like an independent review of your current arrangements, I would be happy to help identify gaps, clarify priorities and suggest practical next steps.
Next, I'll be looking at ‘Now is the time to ask for the training budget’
Stay in the loop
If you found this useful, subscribe to the Roseline Data Privacy monthly newsletter and never miss out on our practical data privacy insights, updates, and tips delivered straight to your inbox. No noise, just what matters.