Data protection officers: What a DPO asks your agency

Data protection officers (DPOs) are the people an organisation designates under Articles 37–39 of the GDPR to advise it on data protection law, monitor how it applies that law, and act as the contact point for the supervisory authority and for the individuals whose data it holds. A DPO is mandatory for public bodies and for organisations whose core activities involve large-scale systematic monitoring or large-scale processing of sensitive data. Everyone else may appoint one voluntarily. For a web designer, the more common encounter is not being a DPO but answering one: The client's DPO reviewing the site you build and the files you collect.

That second angle is what this article is built around. The legal basics come first, because you cannot answer a DPO's questions without knowing what their job actually is.

What the GDPR asks a DPO to do

The tasks sit in Article 39(1) of the General Data Protection Regulation. Two terms matter before reading them. A controller decides why and how personal data is processed — your client, for its own website. A processor handles personal data on the controller's behalf — you, when you build forms, import a customer list or store staff photos the client uploaded.

Article 39(1) lists five tasks. On a website project, each one points at something concrete you produce:

The Cypriot law firm Kyprianou describes monitoring compliance as one of the DPO's general functions — which, in practice, means the DPO asks questions rather than writes code. They need evidence from whoever built the thing.

Independence and the reporting line

Article 38(3) states that the DPO must not receive instructions about how to perform these tasks, must not be dismissed or penalised for performing them, and reports directly to the highest management level. Article 38(6) allows other duties as long as they do not create a conflict of interests. Article 38(4) adds that data subjects may contact the DPO about any issue relating to the processing of their data.

So is a DPO a high-ranking officer? The reporting line is senior; the job title does not have to be. A DPO can be a staff member or fulfil the tasks under a service contract (Art. 37(6)) and still have direct access to the board.

The conflict rule is where agencies occasionally stumble. The Court of Justice of the EU ruled in X-FAB Dresden (C-453/21, 9 February 2023) that a conflict of interests may exist where a DPO is given other tasks that would lead them to determine the purposes and means of processing, and that this is assessed case by case. If a client asks your studio's technical lead to "also be our DPO", that person would be monitoring the processing they themselves designed. Decline it, or at minimum get the client's own legal advice before agreeing.

Qualifications and training

Article 37(5) asks for professional qualities and expert knowledge of data protection law and practice. The regulation does not name a certificate, a degree or a minimum number of training hours. Training courses exist in many countries, but which one a client accepts is the client's decision, not a legal standard you can point to.

Is a DPO legally required? The three Article 37 triggers

Article 37(1) makes a DPO mandatory in three situations:

• (a) Processing is carried out by a public authority or body, except courts acting in their judicial capacity.
• (b) The core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale.
• (c) The core activities consist of large-scale processing of special categories of data (Art. 9, e.g. health) or data on criminal convictions (Art. 10).

"Core activities" means the main business, not supporting functions like payroll. "Large scale" is not defined by a number in the regulation, which is why the answer for many clients is "check". Recital 91, written for impact assessments, gives one fixed point that is commonly applied here too: Processing of patient or client data by an individual physician, other health professional or lawyer should not be considered large scale.

Applied to six typical agency clients:

Three of the six plausibly meet a GDPR trigger. The other three may still have a DPO because national law or their own policy says so.

Where national law adds its own threshold

Member states can extend the obligation (Art. 37(4)). Germany is the familiar example: § 38 of the Federal Data Protection Act requires a DPO where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data, plus further cases such as processing that requires an impact assessment. A dental practice with 20 or more staff who regularly work in the practice software can cross that line even though the GDPR alone would not catch it.

If you work for clients in several countries, do not carry one country's rule into another. Ask the client whether they have a DPO; do not infer it from their size.

A decision rule for small studios

If your studio's core activity is designing and building sites, not analysing visitor behaviour at scale, triggers (a) to (c) are unlikely to apply to you as a business. What does apply is your role as a processor for clients who do have a DPO. Write down your reasoning about your own status once, date it, and revisit it if you start hosting or operating sites with user accounts for clients.

The 12 questions a client's DPO tends to send a web agency

When a client has a DPO, a vendor questionnaire usually arrives at contract stage or shortly before launch. The questions vary, but they cluster around two things: The site you build, and the files you collected while building it.

Two articles explain most of them. Article 28 requires a contract or other legal act between controller and processor, in writing (Art. 28(9)) — the data processing agreement — and Article 28(3)(g) says the processor deletes or returns all personal data at the end of the service, at the controller's choice. Article 33(2) says a processor notifies the controller without undue delay after becoming aware of a personal data breach. Both are in the GDPR text.

Questions about the build

Questions about the files you collected

These are the ones agencies are least ready for, because files arrive by email, WeTransfer and shared drives over several weeks.

Five of the twelve depend on a structured project record: The brief, the upload inventory, the storage location, the upload log and the approval record. A project export covers the first two directly; the other three only if your tool records them. The remaining seven need documents only you can write — the contract, hosting details, your subprocessor list, your access list and your deletion routine.

That split is a useful planning tool. The seven document answers can be prepared once and reused for every client. The five project answers have to be captured while the project runs, because nobody can reconstruct "who approved the team photo" from a mail archive three months later.

A portal such as cluein.me collects the brief, uploads and approvals behind one client link and exports them as a ZIP with a structured JSON and Markdown brief. That gives you one artifact to hand over for questions 1 and 8: The brief and the list of files the client supplied. For questions 9–11, check what your setup records about storage, upload times and approvals. It does not answer questions 2–7 or 12 for you; those remain your own paperwork.

Why these reviews tend to land in November and December

Projects signed before year-end for a January launch put the DPO review inside your briefing window, not after design sign-off. Clients who close budgets in the last weeks of the year often want vendor checks finished before the contract goes out.

Budget for two rounds: One batch of questions, one batch of follow-ups. If the questionnaire arrives after the design is approved, a "no" on question 3 — a font or video embed the DPO will not accept — means rework on finished screens.

Three failure modes show up repeatedly:

• The answer lives in an email thread. The DPO asks again at the next annual review, and nobody at the agency can find what was said.
• The agency assumes there is no DPO. The first sign is a questionnaire two days before launch. Ask at intake: "Does your organisation have a data protection officer, and should they see this project?"
• Uploaded files outlive the project. Staff photos and customer CSVs sit in a freelancer's personal cloud folder long after handoff, which is exactly what question 12 is designed to catch.

The Gibraltar Regulatory Authority calls the DPO a key player in an organisation's data governance system. For an agency, that translates into something narrower and more practical: The DPO is a reviewer whose questions you can predict, and most of them can be answered before they are asked.

FAQ

What does a data protection officer do?

A DPO informs and advises the organisation on its data protection obligations, monitors how they are applied, advises on impact assessments, and is the contact point for the supervisory authority and for individuals. The tasks are set out in Article 39(1) GDPR; the right of individuals to contact the DPO is in Article 38(4). In practice, much of the work is asking teams and vendors for evidence of how data is handled.

Is a DPO legally required?

Under the GDPR, a DPO is required for public authorities and for organisations whose core activities involve large-scale systematic monitoring or large-scale processing of special-category or criminal data (Article 37(1)). National law can add cases; Germany's § 38 BDSG, for example, adds a threshold based on how many people work with automated processing. Organisations outside these cases may appoint one voluntarily.

Is a DPO a high-ranking officer?

The DPO reports directly to the highest management level (Article 38(3)), so the reporting line is senior. The job title and pay grade do not have to be, and the role can be filled by an employee or by an external provider under a service contract. What the GDPR protects is independence: No instructions on how to do the tasks and no penalties for doing them.

Is DPO a stressful job?

There is no regulatory data on that question. The structural pressure points are visible in the law: The DPO monitors colleagues' work, may disagree with management, and must avoid conflicts of interest with any other role they hold. Articles 38(3) and 38(6) are designed to protect the position from exactly those tensions.