25 March 2025

Outsourcing the Role of Data Protection Officer to AI

By Jess Pembroke, Director of Information Law Services 

The Prime Minister recently stated, “No person’s substantive time should be spent on a task where digital or AI can do it better, quicker, and to the same high quality and standard.” This prompted me to consider whether my own role as a Data Protection Officer (DPO) could be replaced by Artificial Intelligence (AI).

In my daily work, I often use AI to refine my communication or summarise text for presentations. However, the true value of a DPO, or any experienced advisory professional, lies in their ability to understand the nuances of their organisation and apply the law in a way that makes sense to their colleagues.

I posed a few typical questions to a well-known AI solution, similar to those we encounter in our role as DPOs for various clients, such as:

• “What should we do with this Freedom of Information Request?”
• “What questions should I ask a prospective supplier before using their software for customer personal data?”
• “What training should my staff complete on data protection, and how often?”

The AI provided reasonably good answers and directed me to additional resources. However, while AI can answer these questions, there are several critical aspects it cannot address:

1. Independent Advocacy: The role of a DPO, as defined in the General Data Protection Regulation (GDPR), includes being “involved, properly and in a timely manner, in all issues which relate to the protection of personal data.” The legislation also mandates that DPOs serve as a point of contact for data subjects and the Information Commissioner.
2. Proactive Questioning: Organisations staff are often preoccupied with their own important tasks and may not have considered the type of privacy and data support they need. A good DPO builds relationships across departments, ensuring they know when to seek support. Sometimes, the DPO must proactively engage and challenge departments on their use of personal data ensuring privacy by design throughout any projects or initiatives.
3. Accountability: Accountability is a cornerstone of data protection. Being able to evidence why an organisation made certain decisions is crucial in determining the level of action by regulators or the impact on customers and suppliers if and when mistakes are made. The justification “AI said it was okay” is unlikely to be well-received.

While AI, much like Microsoft Word, can expedite certain aspects of my job, the full-scale replacement of key professionals is hopefully not on the horizon. The human element in understanding, advocating, and ensuring accountability remains irreplaceable.

Did you know that outsourcing the role of Data Protection Officer (DPO) to Naomi Korn Associates can save time and money? Our Team of professionals can build relationships across your organisation to ensure that risks and requirements of the law are considered and implemented in a supportive way, see what a recent client has to say here: https://naomikorn.com/projects/liverpool-school-of-tropical-medicine/. To find out more please contact info@naomikorn.com.