What it asks for. The controller and processor must involve the data protection officer properly and in a timely manner in all data protection matters, provide the resources needed and access to data and processing operations, and ensure the DPO does not receive instructions on how to carry out their tasks. The DPO cannot be dismissed or penalised for performing their tasks, reports to the highest management level and must not have tasks that create a conflict of interest.
In practice. Organisations give the DPO a defined reporting line to top management, a budget and staff appropriate to the organisation, and involve them early in projects, DPIAs and breach decisions. Evidence includes the DPO's mandate, reporting to the board, records of DPO advice and how it was considered, and a conflict of interest assessment.
Common gaps. Conflicts of interest arise when the DPO also decides on purposes and means of processing, for example as head of IT or legal. DPOs are also often consulted too late.