GDPR DPO: duties, responsibilities and real cost for a business

Since the General Data Protection Regulation (GDPR) came into force in May 2018, the role of Data Protection Officer (DPO, or DPO) has established itself as a central pillar of digital compliance. Yet many directors of micro-businesses, SMEs and startups still do not know whether they are actually required to appoint a DPO, what this person concretely does, and how much it costs.

In 2025, the CNIL issued 83 sanctions for a record amount of 486 million euros in fines across all sectors. SMEs, associations, local authorities: no organisation is immune. Understanding the issues surrounding the DPO means protecting your business before it is too late.

This article gives you a clear, legally reliable and practical overview of what the DPO role entails, who is concerned, what its statutory duties are, how to avoid common pitfalls, and what budget to plan for depending on the size of your organisation.

What is a DPO and what is its place within the GDPR?

The DPO is the central figure for compliance with personal data protection rules within an organisation. The role is provided for and governed by Articles 37, 38 and 39 of the GDPR, as well as by the French Data Protection Act as amended by the order of 12 December 2018.

Its primary mission is to steer the organisation's compliance with the GDPR: it informs, advises, monitors, documents and acts as the liaison with the CNIL. The CNIL itself describes the DPO as the "conductor" of data protection within the entity that appointed them.

Contrary to common belief, the DPO is neither an IT manager nor merely a lawyer. The role combines cross-disciplinary skills: personal data law, IT security, risk management, internal communication. It is a hybrid profile, increasingly sought after, operating at the intersection of legal, technical and organisational matters.

Does the DPO replace the Data Protection Correspondent (CIL)?

Yes. The DPO role succeeded that of the Data Protection Correspondent (CIL), which existed under the former regime of the 1978 French Data Protection Act. However, the DPO has significantly enhanced powers and obligations, particularly with regard to independence, allocated resources and documentary traceability.

Who is required to appoint a DPO?

This is often the first question directors ask. The answer is precise: Article 37 of the GDPR sets out three situations in which appointing a DPO is mandatory.

Which types of organisation are subject to the obligation to appoint a DPO?

The obligation applies in the following cases:

• Public authorities and bodies (except for courts acting in their judicial capacity),
• Organisations whose core activity consists of carrying out regular and systematic monitoring of individuals on a large scale (for example: marketing profiling, e-commerce platforms processing millions of users, telecommunications operators),
• Organisations whose core activity consists of processing special categories of data on a large scale (health data, biometric data, data relating to criminal convictions, data revealing ethnic origin or political opinions, etc.).

Apart from these three cases, appointment remains strongly recommended by the CNIL for any business handling a significant volume of personal data, particularly in the e-commerce, human resources, finance and digital marketing sectors.

My company does not fall within a mandatory case: should I still appoint a DPO?

In practice, the answer is often yes. Appointing a DPO, even on a voluntary basis, sends a strong signal to the CNIL, to your clients and to your business partners. It is also a way to structure your compliance approach and avoid the costly mistakes that are subject to growing sanctions.

Worth noting: in early 2024, more than 34,000 DPOs were registered in France with the CNIL, compared with 21,000 in 2019, an increase of 62% over five years. This trend reflects genuine awareness within the business community.

What are the DPO's statutory duties?

The DPO's duties are defined in Article 39 of the GDPR. They are broad, demanding and cannot be delegated to a person lacking the required skills.

What are the five main DPO duties provided for by the GDPR?

1. Inform and advise the organisation and its employees about their data protection obligations. This includes raising staff awareness, drafting internal memos and training employees in good practices.

2. Monitor compliance with the GDPR and national law, in particular the French Data Protection Act. The DPO ensures the proper upkeep of the record of processing activities (mandatory for any data controller, pursuant to Article 30 of the GDPR), the legitimacy of the legal bases relied upon, and respect for individuals' rights.

3. Advise on impact assessments (DPIA, for Data Protection Impact Assessment) and verify their performance. Where processing is likely to result in a high risk to the rights and freedoms of individuals, a DPIA is mandatory before the processing is implemented (Article 35 of the GDPR).

4. Act as the contact point for data subjects, that is, respond to requests to exercise rights: right of access, right to rectification, right to erasure ("right to be forgotten"), right to data portability, right to object.

5. Cooperate with the CNIL and serve as the primary point of contact in the event of an inspection, complaint or sanction proceeding. In the event of a personal data breach, the DPO coordinates the notification to the CNIL, which must be made within 72 hours (Article 33 of the GDPR).

What can the DPO not do?

The issue of the DPO's independence is central. Article 38 of the GDPR guarantees that the DPO may not receive instructions from management regarding the performance of its duties. Nor may the DPO be dismissed or penalised for performing its functions.

Above all, the DPO cannot be both "judge and party": it cannot simultaneously hold functions that involve determining the purposes and means of a data processing operation. In practice, this means that a chief information officer (CIO), a marketing director or a human resources director generally cannot combine these roles with that of DPO.

A concrete example: An e-commerce SME appoints its IT manager as DPO to save costs. This manager also handles the customer databases and decides which CRM tools are used. This combination of roles creates a conflict of interest expressly prohibited by the GDPR and exposes the company to a CNIL sanction in the event of an inspection.

What are the DPO's responsibilities in the event of a breach?

This is a point that is often misunderstood. The DPO does not personally bear legal liability for GDPR breaches. That liability falls on the data controller, that is, the company itself and its management.

However, the DPO incurs contractual liability if it fails to perform its duties in accordance with its mandate. An external DPO also incurs professional liability under the service agreement binding them to the company.

What does a company that fails to appoint a DPO when required risk?

The risks are serious and well documented:

• An administrative fine of up to 10 million euros or 2% of worldwide annual turnover (whichever is higher),
• A formal notice or an injunction to appoint, with a binding deadline,
• Enhanced scrutiny from the CNIL, with an increased risk of an extended inspection covering other aspects of compliance,
• Reputational damage to the company in the eyes of its clients, partners and service providers.

In 2024, the CNIL carried out more than 340 inspections and several dozen sanctions exceeded one million euros. SMEs are no longer spared.

Summary table: DPO mandatory or recommended depending on the company's profile

DPO obligation according to the company profile