That the DPO should, as a result of the wide range of expertise and skills required in this role, including any data strategy roles and ability to access the highest level of management, occupy a senior position within an organisation.
That the requirement of reporting to the “highest management level” should be interpreted pragmatically and flexibly to refer to “true” reporting lines to those within management that have authority to make relevant decisions and that organisations should be given appropriate leeway to operationalise this requirement within their own corporate structures.