Governance, Risk, and Compliance in DPO Practice
What governance means for a DPO
Governance is the machinery that makes privacy commitments real: policies, roles, training, records, monitoring, and escalation paths. The DPO is a monitor and adviser, not the owner of every processing activity. Candidates should distinguish the DPO from controllers, processors, and senior management, and understand that accountability rests with the organisation, demonstrated through measures such as records of processing, privacy by design, and documented decisions.
Risk concepts to know
Understand the difference between risk to the organisation and risk to data subjects. A Data Protection Impact Assessment (DPIA) focuses on the latter and is required for high-risk processing - for example, large-scale systematic monitoring or sensitive-data profiling. Know that a DPIA precedes processing, is reviewed when risk changes, and may require prior consultation with the regulator if residual risk remains high.
Compliance also involves third-party management: due diligence on processors, written contracts, and ongoing oversight. Questions often test whether responsibility shifts to a vendor - it does not; the controller remains accountable.
Traps to watch for
- "The vendor is compliant, so we are" - a classic false inference.
- DPIA as an afterthought - it must inform design, not justify a decision already made.
- Confusing DPO advice with decision authority - the DPO recommends; management decides and owns risk.
- Ignoring documentation - undocumented compliance is hard to defend under accountability.
Worked rule of thumb
For any new project, ask: What personal data, for what purpose, with what risk to individuals, and what evidence will show we managed it? If you cannot answer the fourth part, governance is incomplete. A roll-out of biometric access control, for instance, needs a DPIA, a lawful basis, retention rules, and a documented approval trail.