Why Data Protection Officers Burn Out

DPOs carry the weight of compliance without the power to enforce it. This post looks at some of the reasons why burnout happens and how to reduce the chances of it happening.

DPO Job Surprises

Nobody warns you that the hardest part of being a DPO isn’t the law, but the context in which data protection operates. Below are some scenarios when DPOs might burn out, followed by what the DPO themselves and the organisation employing them could do to help.

When GDPR Compliance Becomes Personal

At its core, the DPO role is advisory. It is a running theme on this blog, and in life, that the DPO may give the most thoroughly researched, fully compliant and best thought-through advice, but their employer as the controller can just not go with it.

A DPO can consider all these situations of their advice not being followed as personal failures. There are only so many failures someone can take before they give up.

If every hill becomes the one to die on (because the DPO cares about the job or believes there’s a certain way to do things), it is easy to start losing sleep over decisions advised against, and just waiting for the worst to happen.

Giving up might look like “quietly quitting” the job or burning out depending on the DPO’s own character. Just like organisations will have different appetite for risk, so can the DPO. When they reach their limit, they have also reached their own personal capacity to be ignored – and that will show.

Difficult Data Subjects Access Requests (DSARs)

What I didn’t know when I first started in data protection is that DSARs would be a door to someone’s professional and personal life as well as what their colleagues and sometimes friends thought about them.

Ex-staff members sending a DSAR for me to deal with probably didn’t appreciate I knew them rather well by the end of the deadline (and beyond) despite not ever seeing their face. I knew their illnesses, problems, grievances, wrongs they had done or wrongs that had been done to them. Sometimes it was too much. I didn’t want to know all the details but the law, as usual, doesn’t care about your wants or feelings.

If a DPO works in a DSAR-heavy environment, especially when they are contentious and the requester already has a grievance, the material can become heavy and emotionally loaded. Not everyone is prepared and doing this day in and day out does affect the team, however brave a face they put on.

Investigatory Material You Didn’t Want to See

When I first started in data protection, I also didn’t appreciate the fact that when a police request comes in, you may come across material that is disturbing, including visually. It’s hard because you cannot un-see it and you don’t know how many disclosure requests will include such material.

If you're like me, you'll struggle to leave that part of the job at your desk. Repeated exposure to such information could either desensitise you to it and you stop processing it as a way of coping, or you become so affected by it that a colleague needs to step in.

Other General Work

Many DPOs or data protection advisors I know have done slightly different jobs before getting into GDPR compliance. A lot of DPOs are also helpful by nature and they will take on other jobs if they can help.

That is a double-edged sword.

Swamping a busy data protection advisor with other general work – marketing, contracts, legal, general compliance – just because they can do it can lead to both burnout and a conflict of interest in the DPO’s duties.

Find out how to structure a strong privacy team instead.

Dealing with a Backlog

Sometimes data protection teams expand or DPOs are hired to deal with a backlog, usually one involving information requests.

While this is a positive step in terms of general organisational compliance, being always on the back foot can leave a DPO feeling like they are swimming against the tide all the time.

If there’s a backlog already, it is likely that the stream of requests does not stop for this controller. Responding to them is only one part of GDPR compliance, so there are likely to be other streams of work that are either yet untouched or also lagging behind.

Responsible DPOs and their team members know the importance of spinning plates. If the majority of them break all the time or are not even in the air, it can feel like the work is for nothing or is not valued.

Protecting Yourself as the DPO Without Caring Less

We all have different capacities to deal with a varying amount of stress. Of course, the scenarios above happen occasionally and are a normal part of a DPO’s work life, but when they are cranked up, there’s a person in there who is trying to keep their ahead above water. They may or may not say there is a problem.

Document and Let Go

The fact that the DPO’s role is only advisory swings both ways.

If you have done everything in your abilities and within the expectations of a reasonable professional of your knowledge and experience, this is where the end is for you.

The rest is up to the controller, with whom accountability lies.

Choose Your Battles

Decide which hill is worth dying on. Distinguish between what would be unlawful and “just” bad practice so you can channel your energy in the right things.

Find Your Allies

You may be a lone DPO but you will have other colleagues in the organisation who understand and appreciate why you are there. You need to be talking to them and making a case together when needed.

Recognise the Final Straw

There comes a point when there is only so much you can do. Your health is more important than any job and you won’t get a prize for getting ill while working.

I, for example, was so proud and pleased when I got a job with the data protection regulator.

However, being on the helpline for many hours as part of my job and having to take calls from verbally abusive, rude and passive aggressive members of the public (sometimes completely unrelated to the GDPR) was too much. Because I had phone shifts at home too, it felt like I was being shouted at by strangers in my own home. I couldn’t keep going.

What Organisations Can Do Differently

I have been lucky to have employers who understood the mental toll the data protection role in the specific sector could take on the person dealing with GDPR.

It's worth remembering that much of what helps a DPO isn't just good practice; it's a legal requirement. If you are reading this and are in a position to help with the DPO's wellbeing, the options below are a good place to start, and most of them are already expected of you.

Don’t Leave the DPO on Their Own

If the industry the company is in requires significant GDPR work, don’t have a sole privacy person with no team. This is a recipe for backlogs, non-compliance and burn-out DPOs.

Under Article 38(2), the controller must give the DPO the resources necessary to carry out their tasks, and a lone DPO facing a significant workload is unlikely to meet that bar.

Avoid Blurred or Combined Roles

A DPO who does multiple things might end up doing nothing well enough. They are likely to stress about it and you as the controller run the risk of introducing conflicts of interest in how the DPO role operates.

Article 38(6) allows a DPO to take on other tasks, but only if they don't result in a conflict of interest.

Support Staff Exposed to Difficult Material

If your DPO or privacy team handles contentious DSARs or disclosure requests involving distressing material, recognise that this is emotionally demanding work, not just administration.

Where possible, share the heaviest casework across the team rather than leaving it with one person, and give staff a chance to talk it through afterwards, whether that's a regular check-in with a manager or access to an employee assistance programme.

Warning someone before they open something you know is difficult also goes a long way. None of this is expensive, but it tells the person dealing with it that you know what you're asking of them.

Involve the DPO Early

If you have a DPO, reap the benefits.

Anytime there is a personal data question or decision, involve them there and then. Delaying the DPO conversation jeopardises data protection by design and by default, which means losing other staff’s time later when they have to go back and fix things the DPO has found to be non-compliant.

Article 38(1) requires the DPO to be involved properly and in a timely manner, so bringing them in late isn't just inefficient, it falls short of the law.

These will benefit both the organisation and the DPO.

Bottom Line

The DPO role will always involve responsibility without authority. That's how it is designed, and no amount of caring will change it.

What a DPO can control is how much of the controller's decisions they carry home with them, and what an organisation can control is whether it gives its DPO the support, resources and early involvement the law already expects.

Burnout isn't a sign that a DPO cared too much; it's often a sign they were left to care alone.