All news
EDPB / EDPS February 17, 2026 4 min

EDPB: DPOs are under-resourced and disconnected from top management

Coordinated Enforcement Action 2024 report on the DPO role

The European Data Protection Board published the final report of the coordinated enforcement action on DPOs. The picture is not encouraging: many DPOs operate with insufficient resources, lack access to top management, and in some cases find themselves in potential conflict of interest situations.

The 7 main issues identified

  • Insufficient resources allocated to DPOs (both time and budget)
  • DPO expert knowledge not adequate for the business context
  • Risk of conflicts of interest (DPOs with other operational roles)
  • DPO tasks not always properly assigned
  • Lack of systematic involvement of DPOs in decision-making processes
  • External DPOs 'spread too thin' across too many clients
  • Internal DPOs used 'part-time' or diverted to other tasks

Key quote from the report

External DPOs 'may end up spreading themselves too thinly' across clients, while some companies use internal officers only 'on a part-time basis' or 'divert some of their DPO's time to other tasks'.

The Italian situation

In Italy the phenomenon is particularly felt in the local Public Administration sector, where many municipalities appoint an external DPO with fees of a few hundred euros per year, making it structurally impossible for the professional to dedicate adequate time. The ScoreGDPR dataset found that 53.7% of Italian municipalities do not make DPO contacts accessible on their institutional website.

What can an external DPO do

  • Limit the number of clients to those actually manageable (suggestion: max 15-20)
  • Have tools that allow you to dedicate the right time to each (deadline management, automatic alerts)
  • Document the time dedicated to each client to justify the rate
  • Have standardized processes instead of redoing everything from scratch for each client
Official source:EDPB coordinated enforcement sheds light on DPO compliance (IAPP)

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
12-14gli articoli sotto esame

In 2026 every European authority is looking at the same thing: privacy notices

Each year the EDPB picks a topic and every national authority checks it together, in the same period, through questionnaires and inspections. For 2026 the topic is transparency: how controllers tell people what happens to their data. In scope are Article 13, where data comes from the data subject, and Article 14, where it comes from elsewhere. The Czech authority has already written the theme into its inspection plan.

Aug 10, 2026New 6 min
EDPB / EDPS
28 agotermine per candidarsi

Competition and data protection: the EDPB opens the table, and there is a deadline

After the DSA and before the DMA and the AI Act, the fourth piece of the European regulatory mosaic concerns the relationship between competition and data protection. This is not theoretical: it touches data as a market asset, mergers, and the position of those who process data because they dominate a market. The EDPB and the Commission are asking for input before they write, and this time the deadline is close.

Jul 30, 2026New 6 min
EDPB / EDPS
10 lug 2027quando si potra' condividere

Anti-money laundering and privacy: the EDPB and AMLA write the sharing rules together

On 1 July 2026 the EDPB and the European Anti-Money Laundering Authority announced joint guidelines on a question neither could solve alone: how banks, professionals and authorities can share information about suspicions without building unchecked lists of suspects. The possibility applies from 10 July 2027 and the public consultation is expected in the first half of that year. Anyone advising obliged entities has a year to prepare.

Jul 01, 2026New 6 min