Section 71Tasks of data protection officer

(1) The controller must entrust the data protection officer with at least the following tasks—

(a)
informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person's obligations under this Part,
(b)
providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,
(c)
co-operating with the [^F1Commission] ,
(d)
acting as the contact point for the [^F1Commission] on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the [^F1Commission], where appropriate, in relation to any other matter,
(e)
monitoring compliance with policies of the controller in relation to the protection of personal data, and
(f)
monitoring compliance by the controller with this Part.

(2) In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—

(a)
assigning responsibilities under those policies,
(b)
raising awareness of those policies,
(c)
training staff involved in processing operations, and
(d)
conducting audits required under those policies.

(3) In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 71(1)(c)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

I1 S. 71 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-71.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.