Part 3: Law enforcement processing Chapter 4: Controller and processor Sections 69 to 71: Data protection officers
These sections provide for the appointment and the tasks of data protection officers ("DPO"). There was no requirement under the 1998 Act for controllers to appoint a DPO, but some controllers may already have an individual who performs a similar role. An individual designated as a DPO must have the appropriate skills and training for the role. The level of knowledge should be commensurate to the types of data processing the controller carries out; some types of processing will require a more bespoke skill set than others, a DPO for the police, for example, will require significant knowledge of the numerous systems that are operated in policing and the legal context for them. Depending on the size and function of the organisation, the DPO could be part-time or full-time, or one DPO could be appointed to work on behalf of several controllers (police forces for example could have one DPO per region as opposed to one per force). Irrespectively, the DPO will need to be suitably senior and resourced to be able to undertake his or her duties.
	Section 71 mandates the controller to make the DPO responsible for the specified tasks set out in subsection (1). Overall the role of the DPO is to assist the controller and employees actually involved in the data processing in how to make sure operations are compliant with the law and with data protection obligations. DPOs must be able to perform their duties independently.