ODPC Guidance Notes on DPO

Guarding the Gatekeepers: What the ODPC’s 2026 Guidance Notes Mean for Data Protection Officers in Kenya

The Office of the Data Protection Commissioner (ODPC) has taken another significant step towards strengthening Kenya’s data protection regime through the publication of the Guidance Notes for Data Protection Officers (DPOs), 2026. Although the Data Protection Act, 2019 has long recognised the role of a Data Protection Officer, the Guidance Notes provide much-needed clarity on how organisations should appoint, position, empower and support their DPOs to ensure meaningful compliance instead of treating the appointment as a mere statutory formality.

The publication of the Guidance Notes comes at a time when organisations across both the public and private sectors are processing unprecedented volumes of personal data. Financial institutions are increasingly relying on digital onboarding and automated credit assessment. Healthcare providers routinely process highly sensitive medical records through electronic health systems. Educational institutions collect and manage vast amounts of student information, while employers continue to adopt sophisticated human resource management systems capable of monitoring employee activities. At the same time, technological advancements such as artificial intelligence, biometric authentication, cloud computing and digital platforms continue to reshape how organisations collect, analyse and utilise personal information.

Against this backdrop, the role of the Data Protection Officer has assumed greater strategic importance. The DPO is no longer simply an administrative officer responsible for maintaining compliance records. Rather, the DPO serves as a strategic governance function, embedding privacy within an organisation’s operations, advising senior management on regulatory obligations, managing privacy risks and promoting a culture of accountability.

Many organisations have misunderstood the purpose of appointing a DPO by treating the appointment as a one-off compliance exercise, assigning the role to junior officers without sufficient authority or expertise or appointing individuals whose existing responsibilities create conflicts of interest. Effective data protection requires continuous oversight, monitoring and engagement rather than a one-time regulatory exercise.

These practical challenges are what the ODPC seeks to address through the Guidance Notes. Rather than introducing new legal obligations, the Guidance Notes explain how organisations should operationalise the existing requirements under the Data Protection Act, 2019 and the Data Protection Regulations. They provide practical guidance on the designation, appointment, independence, reporting lines, qualifications, responsibilities and resourcing of DPOs, thereby strengthening organisational accountability and promoting a consistent approach to privacy governance across all sectors.

For boards of directors, chief executive officers, compliance teams and senior management, the Guidance Notes should not be viewed as another regulatory publication to be filed away. They should instead be regarded as a roadmap for strengthening governance structures, mitigating regulatory risk and building public trust in an increasingly data-driven economy.

The Legal Framework Governing Data Protection Officers

The right to privacy is firmly entrenched under Article 31 of the Constitution of Kenya, which guarantees every person the right not to have information relating to their family or private affairs unnecessarily required or revealed and protects individuals against the unlawful collection, use or disclosure of information relating to their private affairs. The enactment of the Data Protection Act, 2019 gave effect to this constitutional guarantee by establishing a comprehensive legal framework governing the processing of personal data in Kenya.

One of the accountability mechanisms introduced by the Act is the appointment or designation of a Data Protection Officer. Section 24 provides that a data controller or data processor may appoint or designate a DPO where the processing is undertaken by a public body, where the core activities involve regular and systematic monitoring of data subjects, or where the organisation’s core activities involve the processing of sensitive personal data. The Act further requires organisations that appoint a DPO to publish the DPO’s official contact details and communicate those details to the Data Commissioner.

Although Section 24 establishes the legal basis for appointing a DPO, it provides limited practical guidance on how the role should function in practice. Questions such as who may be appointed, how the DPO should report within the organisation, what qualifications the DPO should possess, whether the role may be outsourced and how independence should be maintained were left largely unanswered by the legislation.

The ODPC’s Guidance Notes bridge this gap. They clarify that effective compliance depends not merely on appointing a DPO, but on ensuring that the individual is appropriately positioned within the organisation, has sufficient authority, is adequately resourced and can perform the role independently without conflicts of interest. In this respect, the Guidance Notes reinforce an important principle of modern data protection law, accountability cannot exist without effective governance structures.

The Guidance Notes also align Kenya’s approach with internationally recognised privacy governance principles, particularly those reflected in global data protection frameworks that recognise the DPO as an independent advisor responsible for promoting compliance rather than determining how personal data should be processed.

Why the DPO matters more than ever

Traditionally, compliance functions within organisations were often viewed as operational support units responsible for ensuring adherence to statutory requirements after business decisions had been made. However, modern privacy regulation has fundamentally changed this approach.

Today, organisations are expected to incorporate privacy considerations at the earliest stages of product development, system implementation and business planning. Decisions regarding customer onboarding, employee monitoring, artificial intelligence, cloud migration, vendor management, cross-border data transfers and cybersecurity all carry significant privacy implications and therefore require proactive oversight throughout the decision-making process rather than after implementation.

The Data Protection Officer therefore occupies a unique position within the organisation. Rather than acting as an obstacle to innovation, an effective DPO enables organisations to innovate responsibly by identifying privacy risks early, recommending lawful mitigation measures and ensuring that business objectives are achieved while safeguarding individuals’ privacy rights.

Beyond protecting the rights of data subjects, the DPO also protects the organisation by identifying privacy risks before they result in regulatory investigations, enforcement action, litigation or reputational damage. By continuously monitoring compliance, advising management and promoting privacy awareness, the DPO serves as an important bridge between the organisation, the Office of the Data Protection Commissioner (ODPC) and the individuals whose personal data it processes. This role requires not only technical competence but also credibility, independence and the confidence of senior leadership.

For this reason, organisations should resist the temptation to regard the DPO merely as the person responsible for responding to regulatory correspondence. Instead, the DPO should be recognised as an integral component of corporate governance, much like internal audit, enterprise risk management and legal compliance.

Which Organisations should Appoint a DPO?

One of the most common misconceptions surrounding the Data Protection Act is that every organisation operating in Kenya is legally required to appoint a Data Protection Officer. In reality, the Act adopts a more nuanced approach.

Section 24 identifies three broad categories of organisations that should appoint or designate a DPO. They are:

1. Public bodies, recognising the extensive volumes of personal data processed in the delivery of public services. Government ministries, county governments, regulators, state corporations and other public institutions routinely process information relating to citizens, employees, contractors and service users. Given the scale and sensitivity of these activities, the appointment of a DPO is a critical governance requirement.

• Organisations whose core activities involve regular and systematic monitoring of individuals. This extends beyond surveillance in the traditional sense. Telecommunications providers monitoring subscriber activity, financial institutions analysing customer transactions for fraud detection, digital platforms tracking user behaviour, employers using workforce monitoring technologies and insurers assessing customer risk profiles may all fall within this category depending on the nature and scale of their processing activities.

• Organisations whose core activities involve processing sensitive personal data. Under the Data Protection Act, sensitive personal data includes information relating to an individual’s health, biometric data, genetic information, race, ethnicity, religious beliefs, family details, property information and other categories requiring enhanced protection. Hospitals, clinics, laboratories, insurance companies, educational institutions, fintechs, SACCOs, human resource service providers and many professional service firms routinely process such information as part of their core business activities.

Importantly, organisations should avoid adopting an overly narrow interpretation of these categories. The question is not simply whether personal data is processed, but whether the nature, scale and purpose of that processing creates sufficient privacy risks to warrant dedicated oversight.

In practice, many organisations that may not be strictly required by law to appoint a DPO would nevertheless benefit from doing so. Businesses increasingly rely on personal data as a strategic asset and effective governance enhances customer confidence, supports regulatory compliance and strengthens corporate reputation.

The Guidance Notes therefore encourage organisations to view the appointment of a DPO not merely as a legal obligation, but as an investment in good governance. As data protection enforcement continues to mature in Kenya, organisations that proactively establish effective privacy governance frameworks are likely to be better positioned to respond to regulatory scrutiny, manage emerging technological risks and maintain the trust of customers, employees and other stakeholders.

Choosing the right DPO model

Recognising that organisations differ significantly in size, structure, resources and the nature of their processing activities, the ODPC does not prescribe a one-size-fits-all approach to the appointment of a Data Protection Officer. Instead, the Guidance Notes recognise three permissible models:

1. an Internal DPO;
2. an External DPO; and
3. a Shared DPO.

This flexibility enables organisations to adopt a governance structure that is proportionate to their operations while ensuring that the DPO can discharge their statutory responsibilities effectively.

The choice of DPO model should therefore not be driven solely by cost considerations. Rather, organisations should consider factors such as the scale of personal data processing, organisational complexity, industry-specific risks, available expertise and the need to maintain independence.

The Internal DPO

Many organisations instinctively assume that the DPO must be an existing employee. While this remains a perfectly acceptable approach, the Guidance Notes make it clear that appointing an internal DPO requires careful consideration.

An Internal DPO may either be an existing member of staff or a new employee recruited specifically to undertake the role. Regardless of how the appointment is made, the organisation must ensure that the individual is able to:

1. exercise independent professional judgment;
2. be free from conflicts of interest;
3. have direct access to senior management; and
4. have sufficient authority to perform their functions effectively.

For larger organisations, particularly those with mature governance structures, appointing an internal DPO often offers several advantages. An employee who understands the organisation’s operations, culture, systems and decision-making processes can identify privacy risks more quickly and provide practical advice that aligns with business objectives. Internal DPOs are also readily available to support projects, respond to incidents and provide continuous guidance to operational teams.

However, familiarity should never come at the expense of independence. One of the recurring challenges observed by the ODPC is the appointment of individuals whose existing responsibilities directly influence how personal data is processed. An employee responsible for determining the purposes or means of processing cannot objectively monitor compliance with decisions that they themselves have made. Such appointments undermine the very purpose of the DPO function.

Consequently, organisations should carefully review the existing responsibilities of any proposed Internal DPO before making the appointment.

The External DPO

One of the most welcome clarifications introduced by the Guidance Notes is the express recognition that organisations may appoint an External Data Protection Officer. This reflects international best practice and acknowledges that many organisations, particularly small and medium-sized enterprises, may lack the internal expertise required to effectively manage increasingly complex data protection obligations.

Under this model, the organisation engages an external individual to perform the DPO function, provided that the individual remains qualified, accessible, independent and free from conflicts of interest.

Importantly, the Guidance Notes clarify an issue that has often generated confusion within the market. Although organisations may engage a consultancy firm or a law firm to provide DPO services, the appointed DPO must always be a specific identifiable individual and not the consultancy or law firm itself.

This distinction is particularly important because the statutory responsibilities of a DPO including advising management, liaising with the ODPC, overseeing compliance and responding to regulatory enquiries must ultimately be exercised by an individual capable of being held accountable for the discharge of those functions.

For many organisations, particularly SMEs and growing businesses, outsourcing the DPO function offers several practical advantages.

1. It provides immediate access to multidisciplinary expertise. Modern privacy compliance requires knowledge of law, information technology, cybersecurity, governance, risk management, records management and emerging technologies such as artificial intelligence. Maintaining this breadth of expertise within a single organisation may be difficult and expensive.

• Outsourcing enables organisations to benefit from greater institutional independence. External DPOs are generally less susceptible to internal organisational pressures and may therefore provide more objective compliance advice.

• Outsourcing allows organisations to access specialist expertise without the cost of recruiting and maintaining a full-time senior compliance professional.

• External DPOs often support multiple organisations across different sectors and are therefore exposed to evolving regulatory expectations, industry best practices and emerging enforcement trends. This breadth of experience frequently enables them to identify risks that may not be immediately apparent to internal teams.

This explains why many organisations increasingly engage specialist law firms or privacy consultancies to provide outsourced DPO services, particularly where privacy compliance forms only one aspect of broader governance obligations.

Nevertheless, outsourcing should not be viewed as transferring legal responsibility.

The Data Protection Act places the primary responsibility for compliance on the data controller and the data processor. An external DPO advises, monitors and supports compliance, but accountability ultimately remains with the organisation’s leadership.

The Shared DPO

The Guidance Notes also recognise circumstances where several related organisations may appoint a Shared DPO. This approach is particularly relevant to corporate groups, holding companies and organisations operating under common ownership or governance structures.

Where appropriate, a single DPO may serve multiple entities, provided that the officer possesses sufficient expertise, capacity and resources to effectively support each participating organisation.

Shared DPO arrangements are particularly suitable for corporate groups and related entities with similar processing activities, provided the DPO remains accessible to each organisation and has sufficient capacity to discharge their responsibilities effectively. However, where related organisations undertake substantially different business activities or process personal data in significantly different ways, separate DPO appointments may be more appropriate.

Ultimately, accessibility remains the overriding consideration. Regardless of the organisational structure adopted, data subjects, management and regulators must be able to access the DPO whenever necessary.

Beyond the DPO: Strengthening Organisational Privacy Governance

Although the DPO occupies a central position within an organisation’s privacy framework, the Guidance Notes correctly recognise that effective compliance cannot rest upon a single individual.

Data protection obligations extend across virtually every department. Human Resources processes employee information. Marketing manages customer databases. Procurement engages third-party processors. Finance handles payment information. Information Technology administers organisational systems. Legal and Compliance oversee regulatory obligations.

Without appropriate coordination, privacy compliance risks becoming fragmented and inconsistent.

For this reason, the Guidance Notes encourage organisations to establish Data Protection Committees composed of senior representatives from key business functions. These committees provide strategic oversight, facilitate cross-functional collaboration and ensure that data protection considerations are integrated into organisational decision-making.

In addition, organisations may designate Data Protection Champions within individual departments.

Unlike the DPO, who retains overall responsibility for advising and monitoring compliance, Data Protection Champions act as operational focal points within their respective business units. They assist in implementing organisational policies, identifying emerging privacy risks and promoting awareness among colleagues.

This layered governance approach recognises an important reality, privacy compliance is ultimately an organisational responsibility rather than the responsibility of a single officer.

Independence of the DPO

Perhaps the most significant contribution made by the ODPC Guidance Notes is the emphasis placed on the independence of the Data Protection Officer.

An organisation may appoint the most qualified privacy professional available, provide sophisticated compliance software and develop comprehensive policies. However, if the DPO lacks the independence necessary to challenge management decisions objectively, the effectiveness of the entire privacy governance framework is significantly diminished.

The Guidance Notes therefore make it clear that the DPO should perform their duties with full professional independence. They should not receive instructions regarding how to conduct audits, provide legal advice, investigate compliance concerns or engage with the Office of the Data Protection Commissioner. Their professional judgment must remain objective and uninfluenced by commercial, operational or political considerations.

This principle should not be misunderstood as suggesting that the DPO operates outside the organisation’s management structure. Rather, independence means that the DPO is free to provide candid advice, even where that advice may be commercially inconvenient.

In practice, organisations that empower their DPOs to speak openly are often better positioned to identify compliance risks early and avoid costly regulatory enforcement later.

Reporting Lines Matter

Closely linked to independence is the issue of organisational reporting.

The Guidance Notes recommend that the DPO should report directly to the highest level of management, such as the Chief Executive Officer, the Managing Director, the Board of Directors or the Board Audit and Risk Committee. This reporting structure ensures that significant privacy risks receive appropriate attention and that the DPO has direct access to organisational decision-makers.

Unfortunately, some organisations continue to position the DPO several layers below executive management, requiring privacy concerns to pass through multiple levels of approval before reaching senior leadership. Such arrangements often delay decision-making and may discourage the escalation of important compliance issues.

Given the strategic nature of privacy risks, the DPO should be positioned alongside other governance functions such as internal audit, enterprise risk management and legal compliance rather than being treated as a purely operational role.

Supporting the DPO

An often-overlooked aspect of privacy compliance is that appointing a Data Protection Officer alone does not guarantee compliance. A DPO who lacks the necessary resources, institutional support and authority is unlikely to discharge their responsibilities effectively, regardless of their qualifications or experience.

Recognising this reality, the ODPC emphasises that organisations must adequately resource the DPO by providing sufficient funding, technical support, staffing and opportunities for continuous professional development to enable them to perform their functions effectively.

This represents a significant shift in how organisations should approach privacy governance. Data protection should no longer be viewed as an unfunded compliance obligation delegated to a single officer. Instead, organisations should treat privacy in much the same way they approach cybersecurity, financial controls or enterprise risk management by investing in the systems, personnel and governance structures necessary to support effective oversight.

Larger organisations may invest in privacy management software, data mapping tools, breach response platforms and specialised training, while smaller organisations should ensure that their DPO has access to external expertise where specialised legal or technical issues arise.

Ultimately, resourcing the DPO demonstrates an organisation’s commitment to accountability. It also enables the DPO to proactively identify risks, conduct compliance reviews, oversee Data Protection Impact Assessments (DPIAs) and respond effectively to regulatory developments.

Avoiding Conflict of Interest

One of the most important principles emphasised throughout the Guidance Notes is that the DPO must be capable of exercising objective and independent judgment. This principle cannot be achieved where the DPO simultaneously occupies another role that determines the purposes or means of processing personal data.

Accordingly, the ODPC advises that the DPO should not hold positions that involve making decisions regarding data processing activities, such as Chief Information Officer, Head of Human Resources, Head of Marketing, Head of IT or any other role responsible for determining the purposes or means of processing personal data.

The rationale is straightforward. A person cannot objectively monitor compliance with decisions that they themselves have made.

Boards and senior management should therefore conduct a conflict-of-interest assessment before appointing a DPO. The assessment should consider not only the individual’s current responsibilities but also whether future organisational changes could compromise the DPO’s independence.

Protecting the DPO from Retaliation

The Guidance Notes further recognise that independence cannot exist where a DPO fears adverse consequences for providing objective compliance advice.

Accordingly, organisations should ensure that DPOs are not dismissed, penalised or otherwise disadvantaged merely because they have raised legitimate compliance concerns or challenged organisational practices that may contravene the Data Protection Act.

This protection serves an important governance purpose. Privacy compliance frequently requires difficult conversations. A DPO may advise against launching a new digital product until privacy risks have been adequately addressed. They may recommend suspending a marketing initiative pending the implementation of appropriate consent mechanisms or require changes to contracts with third-party service providers. While such advice may delay commercial objectives, it ultimately protects the organisation from greater legal, financial and reputational harm.

Importantly, however, the Guidance Notes also clarify that the DPO does not assume legal responsibility for the organisation’s compliance obligations. The responsibility for complying with the Data Protection Act remains with the data controller or data processor. The DPO advises, monitors and supports compliance, but the final accountability rests with the organisation’s leadership.

This distinction reinforces an important governance principle, management makes business decisions, while the DPO provides independent advice regarding the privacy implications of those decisions.

Role of the DPO

Many organisations continue to perceive the DPO primarily as the individual responsible for responding to enquiries from the Office of the Data Protection Commissioner. The Guidance Notes demonstrate that the role is considerably broader.

The DPO serves as the central coordinator of an organisation’s privacy programme, combining advisory, monitoring, governance and educational responsibilities. In many respects, the DPO functions as the organisation’s privacy strategist, ensuring that data protection principles are embedded throughout the entire data lifecycle. Its responsibilities include:

1. Advising management and employees:  Providing guidance on the requirements of the Data Protection Act, 2019 and related regulations, interpreting legal obligations, reviewing new projects and ensuring that privacy considerations are incorporated into organisational decision-making from the outset.

• Monitoring Compliance:  Overseeing the organisation’s compliance with applicable data protection laws, internal policies and procedures through periodic audits, compliance reviews, assessments of third-party processors, reviews of data retention practices and evaluation of technical and organisational security measures.

• Conducting and Advising on Data Protection Impact Assessments (DPIAs): Assisting departments in identifying privacy risks associated with new products, technologies or processing activities and recommending appropriate mitigation measures before implementation.

• Managing Personal Data Breaches:  Coordinating investigations into data breaches, assessing the risks to affected individuals, advising management on notification obligations, liaising with the ODPC where required and overseeing corrective measures to prevent future incidents.

• Facilitating Data Subject Rights: Ensuring that the organisation has appropriate procedures to respond to requests for access, rectification, erasure, restriction, objection and other rights provided under the Data Protection Act.

• Training and Creating Awareness: Developing and delivering privacy awareness programmes, promoting a culture of data protection and ensuring that employees understand their responsibilities when handling personal data.

• Maintaining the Record of Processing Activities (ROPA): Overseeing the preparation and maintenance of an accurate inventory of the organisation’s processing activities, including the categories of personal data processed, purposes of processing, recipients, retention periods and applicable security measures.

• Advising on Data Sharing and Third-Party Relationships: Reviewing data sharing arrangements, vendor contracts and data processing agreements to ensure that appropriate safeguards and contractual obligations are in place.

• Serving as the Primary Contact Point for the ODPC: Acting as the liaison between the organisation and the Office of the Data Protection Commissioner during investigations, inspections, audits and regulatory engagements.

1. Reporting to Senior Management and the Board: Providing regular updates on the organisation’s privacy compliance programme, emerging risks, audit findings, implementation progress and recommendations for strengthening governance.

Collectively, these responsibilities demonstrate that the Data Protection Officer is far more than a regulatory contact person. The role is a strategic governance function that supports organisational accountability, strengthens risk management, promotes a culture of privacy and enables organisations to process personal data responsibly while maintaining the trust of customers, employees and regulators.

Competence and Professional Development

The effectiveness of any Data Protection Officer ultimately depends upon their competence.

Recognising the multidisciplinary nature of privacy compliance, the Guidance Notes emphasise that DPOs should possess an appropriate combination of legal knowledge, technical understanding and organisational expertise. They should understand the Data Protection Act and its subsidiary legislation, appreciate information security principles, be familiar with risk management methodologies and possess sufficient communication skills to advise both senior executives and operational teams.

The ODPC also encourages organisations to support continuous professional development. This is particularly important given the rapid evolution of technology and privacy regulation. Artificial intelligence, cloud computing, biometric technologies and cross-border data transfers continue to introduce novel legal and operational challenges that require ongoing learning.

Accordingly, organisations should regard professional development not as a discretionary expense but as an investment in maintaining an effective privacy governance programme.

Publishing the DPO’s Contact Details

The appointment of a DPO carries with it certain transparency obligations.

Section 24(6) of the Data Protection Act requires organisations to publish the official contact details of their DPO and communicate those details to the Data Commissioner. The Guidance Notes clarify that these details should be readily accessible to data subjects through the organisation’s website or other appropriate communication channels.

Importantly, the ODPC acknowledges that organisations need not necessarily publish the DPO’s personal contact information. Instead, organisations may use a dedicated role-based email address such as dpo@organisation.co.ke provided that data subjects can communicate effectively with the DPO.

This practical clarification strikes an appropriate balance between transparency and the protection of the DPO’s personal information.

Practical Considerations for Board and Senior Management

The publication of the Guidance Notes provides organisations with an opportunity to critically evaluate their existing privacy governance arrangements. Rather than asking whether a DPO has been appointed, boards should ask whether the DPO is genuinely positioned to succeed.

Boards and senior management should periodically consider the following questions:

1. Does the organisation fall within the categories requiring the appointment of a DPO under Section 24 of the Data Protection Act?

• Does the DPO possess the necessary qualifications, expertise and authority to discharge the role effectively?

• Is the DPO independent and free from conflicts of interest?

• Does the DPO report directly to senior leadership or the Board?

• Has the organisation allocated sufficient financial and technical resources to support the DPO?

• Are privacy risks regularly reported to management and the Board?

• Have the DPO’s official contact details been published and communicated to the ODPC as required by law?

• Is privacy viewed as an organisational governance issue rather than solely an IT or legal function?

Organisations that can confidently answer these questions are likely to be better positioned to demonstrate accountability under Kenya’s evolving data protection framework.

Conclusion

The ODPC’s Guidance Notes for Data Protection Officers mark an important milestone in the continued development of Kenya’s data protection framework. Rather than introducing new legal obligations, the Guidance Notes provide practical direction on how organisations should operationalise one of the most important accountability mechanisms established under the Data Protection Act. In doing so, they move the conversation beyond the mere appointment of a DPO and focus on how the role should function effectively within an organisation.

Perhaps the most significant message emerging from the Guidance Notes is that privacy governance is no longer solely the responsibility of compliance teams or information technology departments. It is a board-level governance issue that requires active leadership, strategic oversight and a culture of accountability throughout the organisation. Organisations must therefore ensure that their DPO is appropriately positioned, empowered and supported to provide independent advice, monitor compliance and promote responsible data governance.

As regulatory expectations continue to evolve and organisations increasingly rely on personal data to drive innovation, digital transformation and business growth, effective privacy governance will become an increasingly important competitive advantage. Organisations that invest in robust privacy governance today will be better positioned to maintain public trust, strengthen regulatory compliance, manage emerging risks and demonstrate accountability to customers, employees, regulators and other stakeholders.

Ultimately, a Data Protection Officer should not be viewed merely as a statutory requirement or a regulatory point of contact. A well-supported and independent DPO is a trusted advisor who enables organisations to achieve their business objectives while safeguarding individuals’ constitutional right to privacy. For organisations seeking to build resilient governance frameworks in an increasingly data-driven economy, investing in an effective DPO function is no longer simply a matter of legal compliance, it is a strategic business imperative.