Some DPOs are dedicated full time to their role but may be appointed as the DPO for a group of companies. What happens when one group company acts as processor for other group companies? Does that create a conflict of interest for the DPO? Some DPOs have other roles to fulfil. If your DPO is also your head of legal, what happens when they need to advise the business on the action they should take in relation to a data breach? The best legal advice may be different to the compliance advice that a DPO needs to provide. Nor are external DPOs immune from the risks of conflict. If an external DPO is appointed as the DPO for multiple organisations, do they have sufficient time to dedicate to each organisation? Are any of their clients competitors or suppliers to another client?