The Data Protection Officer (DPO) oversees the organisation's compliance with data protection law. The DPO advises on and monitors the handling of data on Identified or identifiable persons, supports data protection impact assessments, and acts as a contact point for data subjects and supervisory authorities.

Unlike a Risk owner, the DPO does not usually make the risk-acceptance decision themselves — the role is designed to be independent so it can challenge and advise management, which is why many regulations (e.g. GDPR, nDSG) restrict a DPO from also holding operational data-processing responsibilities that would create a conflict of interest.