Who can be the Privacy Protection Officer — and who cannot

Adv. Arthur Kartun · 27 September 2026 · Amendment 13 and the practical duties · Updated 7 October 2026

Once an organisation realises it must appoint a Privacy Protection Officer, the next conversation is usually short: “the CTO will do it”, or “our IT manager already handles security”. But section 17B3 of the Privacy Protection Law, and the opinion the Privacy Protection Authority published on 14 July 2026, make both of those answers more of a problem than they sound.

What the officer must know

Section 17B3(a) requires the officer to be a person with deep knowledge of privacy protection law, adequate understanding of technology and data security, and familiarity with the fields the organisation works in. All three have to be found in one person. The law does not require a particular certificate, degree or profession, only knowledge, and the Privacy Protection Authority may test it. If you appoint an officer who lacks the required knowledge and skills, that is one of the officer-related defaults for which the Privacy Protection Authority can issue a cessation order (section 23KE).

Inside or outside the organisation

Section 17B3(b) says expressly that the officer does not have to be an employee of the organisation. The Privacy Protection Authority's opinion adds that only a natural person can be appointed, not a company. The engagement itself, however, can run through a company that employs the individual.

Conflicts of interest: where appointments fail

Section 17B3(c) bars the officer from holding an additional role, or reporting to an office-holder, where that is liable to place the officer in a conflict of interest. The opinion explains when this happens: where the person holds the authority or responsibility to set policy on the processing of personal data, or reports to someone who does. That includes deciding the purposes for which the data is processed, and making material decisions on the methods and means of processing it.

In practice, the opinion looks at several familiar roles. A marketing director, customer director, finance director or CTO may be conflicted. The head of information systems is conflicted as a rule, and so is anyone who reports to that role. As for a CISO holding both roles, the opinion says this “raises questions”. The final version softened the position taken in the draft, but still requires each case to be examined on its own facts with the reasoning documented. It also notes that the CISO will not necessarily meet the requirement to report directly to the CEO.

The prohibition applies both to an officer who is an employee and to an external officer who provides the organisation with a service.

What the organisation owes the officer

Two duties fall on the organisation, not on the officer. The first is to give the officer the conditions and resources the role needs, and to make sure the officer is properly involved in every matter touching privacy law (section 17B2(b)). The second concerns the reporting line: the officer must report directly to the CEO, or to an employee who reports directly to the CEO (section 17B2(c)). If the organisation fails on either, that too is a default for which the Privacy Protection Authority can issue a cessation order.

The practical sequence

1. Confirm that the duty to appoint an officer actually applies to you, and under which of the situations section 17B1(a) lists.
2. List the internal candidates and test each one against the conflict rule in section 17B3(c) and the opinion's list of roles. In most organisations, the natural candidates turn out to be the conflicted ones.
3. Decide between an internal officer, whose reporting line will change, and an external officer, and record the decision in writing.
4. Publish the ways to contact the officer, accessibly and simply (section 17B2(a)(4)).

Privacy self-check · 3 min