Who guards the guardians? Governing the independence and impartiality of data protection officers under the GDPR

Data Protection Officers (DPOs) are established as a cornerstone of the GDPR’s internal compliance framework, responsible for monitoring, advising and supporting accountability within the organisations they serve. This institutional arrangement raises the question of how DPOs’ independence can be protected when their tasks are closely linked to controllers’ operational interests and internal workflows. Although the GDPR requires DPOs to avoid conflicts of interest, their organisational placement can blur the distinction between oversight and execution, especially when DPOs are involved in handling individual data subjects’ rights cases. The article combines doctrinal analysis of the GDPR, CJEU case law, and EDPB guidance with empirical evidence from a 2025 survey of Slovenian public-sector DPOs. The findings indicate that DPOs are often embedded in departments that also process personal data, directly involved in handling data subjects’ rights requests, and rarely apply recusal mechanisms. These practices suggest that conflicts of interest arise less from intentional bias than from institutional structure and role conflation. The article concludes that clearer conflict of interest rules, explicit recusal procedures and stronger reporting lines are necessary for DPOs to serve as a credible and independent internal oversight mechanism.