July 2026 Appointing a DPO is the easy part. The DPC's Annual Report 2025 makes clear that under-resourcing one is an infringement of the GDPR — and that the DPC is checking. Introduction The Data Protection Commission (DPC) Annual Report 2025 (Annual Report) turns the spotlight on the Data Protection Officer (DPO) — and on the organisations that appoint them. The message is blunt: designation is a starting point, not a defence. Where a DPO is not properly resourced, supporte

July 2025 Being a Data Protection Officer (DPO) is no easy task, and there have been many learnings and challenges during the last seven years. The learnings apply to both the DPO and the organisations they work with to understand the role and how that role best fits within the organisation. The opening line of the DPO section of the DPC Annual Report of 2024 sums up the importance of the DPO role: "The role played by organisational Data Protection Officers (DPOs) is critical