What it asks for. The data protection officer must inform and advise the controller or processor and its staff on their data protection obligations, monitor compliance with the GDPR and internal policies, advise on data protection impact assessments, and cooperate with and act as the contact point for the supervisory authority.
In practice. A working DPO has a written mandate, direct access to senior management and enough time and budget to do the job. They run a monitoring plan covering assignment of responsibilities, awareness and training, and internal audits, and they review high-risk projects before launch. Evidence includes DPO reports to the board, advice logs showing where advice was followed or overruled and why, DPIA opinions, training records and correspondence with the authority. The DPO should prioritise by risk, as the article requires them to have due regard to the risk of processing.
Common gaps. The DPO is often a part-time role combined with a conflicting job such as head of IT or legal counsel defending the business, is consulted too late, or has no record showing what advice was given and how management responded.