July 2026 Appointing a DPO is the easy part. The DPC's Annual Report 2025 makes clear that under-resourcing one is an infringement of the GDPR — and that the DPC is checking. Introduction The Data Protection Commission (DPC) Annual Report 2025 (Annual Report) turns the spotlight on the Data Protection Officer (DPO) — and on the organisations that appoint them. The message is blunt: designation is a starting point, not a defence. Where a DPO is not properly resourced, supporte