While the role of data protection officer has come into the spotlight given the EU General Data Protection Regulation, with that prominence may come personal liability. As the titular head of the data protection and privacy program, the DPO may be interpreted as the final decision maker surrounding the use of personal data, and in some jurisdictions that role can come with personal civil and criminal liability.

In this white paper overview, IAPP Legal Extern Carissa Hanratty, CIPP/US, explores some of the jurisdictions in which personal liability exists, with an appendix linking to the various legal texts.