If you run a small business, you may have heard the term "Data Protection Officer" (DPO) and wondered whether you need one, and whether you can simply do the job yourself. For most small businesses the short answers are: you probably are not legally required to appoint a DPO, and if you do appoint one, the owner-manager is often not the right person to be it. Here is why.
When is a DPO legally required?
Under the UK GDPR (Article 37), you must appoint a DPO only in limited situations:
- you are a public authority; or
- your core activities involve large-scale, regular and systematic monitoring of individuals (for example, large-scale tracking or profiling); or
- your core activities involve large-scale processing of special category data (such as health data) or criminal offence data.
Most small businesses (a shop, a trades business, a small agency) do none of these on a large scale, so a statutory DPO is not mandatory. You still have to comply with data protection law; you just don't need a formally designated DPO.
The catch: independence and conflicts of interest
If you do appoint a DPO (whether required to or by choice), the role carries legal protections. A DPO must be able to act independently, report to the highest level of management, and must not have a conflict of interest (UK GDPR, Article 38). The DPO advises on and monitors compliance, they should not also be the person deciding how and why personal data is processed.
That is the problem for an owner-manager. If you set the purposes and means of processing (which most business owners do), being your own DPO is usually a conflict of interest, because you would effectively be marking your own homework. Regulators have taken enforcement action elsewhere on exactly this point.
A better approach for small businesses
You can take data protection seriously without a conflicted DPO:
- Appoint a privacy lead (not a formal DPO), someone responsible for day-to-day compliance who can still get independent advice.
- Document your processing: what data you hold, why, your lawful basis, and how long you keep it.
- Write a privacy notice and a short internal data protection policy.
- Train staff, control access, and have a plan for data breaches and individuals' rights requests.
- If your activities do trigger the DPO requirement, appoint someone (internal or external) who is genuinely independent, an outsourced DPO is a common solution.
So, can you be your own DPO?
If your business is not required to have one, you can run compliance yourself under a "privacy lead" label without the formal DPO title and its independence rules. If your business is required to have a DPO, you generally should not appoint yourself if you also decide how data is used, use an independent person or an external service instead.
Key takeaways
- Most small businesses are not legally required to appoint a DPO (UK GDPR, Article 37).
- A DPO must be independent and conflict-free (Article 38), an owner-manager who controls the data usually cannot validly be the DPO.
- You can appoint a privacy lead instead, and still meet your obligations.
- If a DPO is required, consider an external/outsourced DPO to ensure independence.
Sources
- UK GDPR, Articles 37–39 (designation, position and tasks of the DPO)
- Data Protection Act 2018
- Information Commissioner's Office (ICO) guidance on DPOs
--- This article is general information about the law of England & Wales as at 2026, not legal advice. For advice on your circumstances, consult a qualified solicitor.