The role in one sentence
A Data Protection Officer is the named person inside an organisation responsible for making sure the organisation complies with the Cyber and Data Protection Act, and for being the contact point between the organisation and POTRAZ.
What the job involves day to day
Day to day, the DPO maintains the processing register — the record of what personal data the organisation holds, why, and where it goes. They advise on new activities before they start: a new app, a new marketing list, a new biometric system. They handle requests from individuals who want to see, correct or delete their data. They coordinate the response to a data breach, keep the breach register, and act as the person POTRAZ speaks to.
Can it be filled internally?
Yes, the role can be filled internally, but only on conditions. The person must have real authority, real time set aside for the work, and independence from the activities they oversee — they cannot mark their own homework. And the appointment must be documented, in writing, not implied. Where an organisation is too small to resource this properly, the role can be outsourced to an external DPO, which is often the more honest arrangement.
The common failure mode
The common failure mode is quiet delegation: the DPO role slides onto whoever runs IT, or whoever is least able to refuse, with no authority, no time, and no paper trail. An inspector can see this in minutes. The appointment in writing is what separates a real DPO from a job title added to someone's existing one.
Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024.
This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.