Question

A mid-sized organization subject to GDPR appoints a Data Protection Officer (DPO). To save on headcount, senior management asks the DPO to also lead the marketing analytics team, which determines how customer data is processed for targeted campaigns. The DPO would report directly to the Chief Marketing Officer. As the privacy solutions engineer advising on governance, which concern should you raise as the MOST significant?

Accepted Answer

The dual role creates a conflict of interest because the DPO would be determining the purposes and means of processing they are required to independently monitor

Answer

The DPO lacks sufficient marketing experience to lead the analytics team effectively

Answer

The DPO should report to the IT security function rather than to marketing

Answer

The organization is too small to be required to appoint a DPO at all