Are you juggling many hats?

DPOs now have to deal with AI and cyber in addition to their data protection responsibilities, and sometimes FOI as well. Speaking at the ICO Annual Conference, Information Commissioner John Edwards said that while the world of data protection has changed much, we need new eyes: “It is not a crazy time. I have worked in privacy for 35 years, and this is the most exciting time, a reflection point. DPOs can demonstrate the value of data protection in their organisations. It is not a burden. What you do is mission critical.”

Recently, we have seen many high-profile data breaches. The Ministry of Defence data breach that disclosed details of Afghan citizens is one of the most severe. The ICO says it is pleased that the government has now committed to creating a central, coordinated approach for managing cross-government data protection accountability and compliance. This will mean establishing a crossgovernment Technology Risk Group, chaired by DSIT,(1) and new information management training for all civil servants.

At the same time, the government needs to use new technologies to transform public services and find efficiencies. The government recently announced a consultation on AI growth labs(2) – pioneering cross-sector sandboxes that would oversee the deployment of AI-enabled products and services. The intention now is to establish which of the current regulations hinder growth in this area.

Not all breaches are cyber-related and DPOs need to be alert to the basics to avoid human error and procedural issues. They also need to make sure that staff are adequately trained, specifically to recognise complaints – and the DUAA requires new processes in terms of setting up a complaints mechanism. Another DUAA novelty is “recognised legitimate interest” as our correspondents report.

Laura Linkomies
Editor, Privacy Laws & Business

November 2025