What does a Data Protection Officer actually do for a HealthTech company?

A valuable asset or a tick-box appointment?

The role of a Data Protection Officer has long been established in law, but across healthtech it is appointed and utilised in different ways, quite different to that of other roles such as Clinical Safety Officers (CSOs). So, what is a DPO, do healthtech companies need one, and what should organisations look out for when appointing one?

The starting point.

The first thing to note is that the DPO is a statutory role. This means the individual undertaking the role has statutory tasks they must undertake. These are primarily to:

1. Provide advice and guidance on data protection law

2. Monitor the organisation’s compliance with data protection law

3. Act as the point of contact with the data protection regulator 

The position of the DPO is also set out in law. A DPO must:

1. Not receive instruction on how to exercise their tasks

2. Have no conflict in exercising their tasks. This means a C-suite executive (CEO, CTO, CDO etc.) is unable to be the Data Protection Officer.

3. Be involved in a timely manner in all issues relating to data protection.

4. Be able to report to the highest level of management

5. Be appointed on the basis of their ‘professional qualities and, in particular, expert knowledge of data protection law and practices’ [UK GDPR Article 37(5)].

In some instances, a DPO is mandated by data protection law, including where the core activities of the organisation involve large-scale processing of special category data (including health data).

Both controllers and processors may be required to appoint a DPO, depending on their processing activities.

What this means in practice.

As a statutory role, if a DPO is appointed, the individual undertaking that role, and the organisation appointing the role, must ensure that the DPO is involved in all aspects. It cannot be a ‘lip-service’ role.

What your DPO will be doing:

1. Providing advice and guidance to any new or changing product features.

2. Monitoring your organisation’s compliance with UK/EU data protection laws. 

3. Keeping you up to date with changes in law and guidance and providing proactive advice and recommended changes based on this.

4. Reviewing Data Protection Impact Assessments.

5. Having routine calls with relevant teams/groups in the organisation. 

6. Supporting data breach management, qualification and communication.

7. Supporting advice and guidance in relation to individual rights.

8. Advising on the set-up and management of personal data involved in any clinical investigation or study in relation to your product.

9. Supporting conversations with commercial partners and NHS IG teams.

10. Advising on implementation of data strategy.

11. Supporting due diligence of potential suppliers.

A good DPO can be far more than a compliance function, acting as a strategic advisor when properly integrated into the organisation and involved in decision-making.

Practical steps to a DPO in HealthTech.

The first question is whether your organisation is legally required to appoint a DPO.

If the answer is yes, a DPO must be appointed. If no, then you need to decide whether you want to appoint one voluntarily, or whether you want to appoint a data protection lead in a non-statutory position.

Note: Although the Digital Technology Assessment Criteria (DTAC) Version 2 removed the question regarding DPO appointment, this has not changed anything in law and you are still required to appoint a DPO in the circumstances noted above.

If appointing a DPO, this can be done internally or externally. 

If appointing internally it is recommended that you:

• Assure yourself there is no conflict of interest, where the individual also makes decisions in the organisation about using personal data. This means that the individual should not be a CEO, CTO, CDO or Head of Marketing, for example.

• Assure yourself they have the relevant experience and knowledge to advise on data protection law.

If appointing externally it is recommended that you:

• Understand the experience of your named DPO

• Understand whether your named DPO has experience in health

• Understand the inclusions of the service: how do they undertake all the statutory tasks?

• Understand the flexibility of their services. Some limit contact by hours, or pre-assigned days.

Takeaway

A DPO is a statutory role in law with the tasks they must undertake also set out in law. If appointing a DPO, either internally or externally, they can be of immense value. 

Whether you are looking to undertake an innovative project utilising data, looking to gain approval from local NHS Information Governance Teams for your product or have an overview of your information risk exposure, the DPO should be a key part of your team.

Whether you are looking for a statutory Data Protection Officer, reviewing your current supplier or looking for strategic support for a growing organisation, l

earn more about Iniver's Outsourced DPO service here or contact our team to discuss your requirements.

Summary: A Data Protection Officer (DPO) is more than a compliance requirement for many HealthTech companies. This guide explains when a DPO is legally required, the statutory responsibilities of the role under UK GDPR, what effective DPO support looks like in practice, and how a DPO can become a strategic advisor for organisations handling health data, working with the NHS, or scaling innovative digital health products.

When Does a Healthtech Actually Need a DPO?

One of the most common questions about data protection from healthtech founders is:

“Do we actually need a Data Protection Officer yet, or is that something for later?”

It’s a good question. Most healthtechs are moving fast, building products, working towards NHS adoption or enterprise deals, and trying not to over‑engineer governance too early.

But data protection, and specifically when a healthtech needs a DPO, is one of those areas which can cause not just legal issues, but also can stunt fast-paced, compliant, growth.

First: What a DPO Is (and Isn’t)

Under UK GDPR and EU GDPR, a Data Protection Officer (DPO) is an independent, statutory role in law. They must:

1. Provide advice and guidance to the organisation

2. Monitor organisational compliance

3. Act as the point of contact for the data protection regulator.

   
   

What this means in practice is that a good DPO should be your sounding board and go-to person to ensure you are complying with your data protection obligations in a way which is proportionate and scalable to your organisation.

A DPO is not:

• Just the person who writes privacy policies

• A compliance admin role

  
  

And crucially, the DPO must be independent under GDPR, which means senior operational roles such as CEO, CTO, or Head of Product cannot lawfully act as DPO, a point routinely checked during NHS and customer assurance.

That’s why this decision often ends up being more strategic than founders expect.

The Legal Question: When Is a DPO Actually Required?

In some instances, a DPO Is required in law, in others it's best practice. The main catch to healthtechs is where processing health data is core to your product.

Health data is classed as special category data under GDPR. If processing health data is central to what your product does, not incidental, you’re likely already close to the threshold.

This includes things like:

• Digital therapeutics

• Mental health or wellbeing platforms

• Remote monitoring, wearables, or diagnostics

• Clinical decision support tools

• AI models trained on patient or symptom data

  
  

What matters isn’t team size or revenue, it’s whether health data processing is a core activity, and whether it’s happening at a large scale.

Many early‑stage healthtechs assume they’re “too small” for a DPO. Legally, that’s not how the test works, it relates to the scale of special category held.

Real‑World Healthtech Scenarios Where a DPO Is Usually Expected

In practice, most healthtech founders end up appointing a DPO when they reach one (or more) of these points:

• Moving from pilot to live service

• Entering NHS or public‑sector procurement

• Scaling user numbers or datasets

• Introducing AI, profiling, or automation

• Preparing for investment, due diligence, or certification

“What If We Don’t Appoint One Yet?”

If a DPO is legally required and you don’t appoint one, that is itself a GDPR compliance failure and you should document the risk decision to not appoint.

Beyond the legal position, addressing the DPO question early often helps healthtech teams move faster and with more confidence, particularly through procurement, product level decisions and growth phases.

Why Some Healthtechs Appoint a DPO Earlier Than Required

Even where the legal threshold isn’t crystal‑clear yet, many founders choose to appoint a DPO proactively.

Common reasons include:

• Signalling maturity to NHS and enterprise buyers

• Reducing founder dependency on compliance decisions

• Creating space to scale safely

• Avoiding conflicts of interest internally

  
  

For early‑stage and founder‑led businesses, this is why outsourced DPO models are common, they give senior expertise without locking the role into the org chart too early.

The Takeaway

If you’re building a healthtech product that:

• Handles real health data

• Informs and supports real decisions

• Is heading towards NHS or regulated environments

  
  

Then the question is “At what point does not having one start to slow us down?”

Addressing the DPO question early, and explicitly, is one of the cleanest ways to remove friction as you scale.

Access our HealthTech DPO checklist here.

Looking to outsource your DPO? Read our guide to picking the right supplier here

At Iniver we offer a 'Full-Service' Outsourced DPO, born from the complex health and healthtech sector. Find out more about our offering here

We also have specific packages for start-ups and scale-ups to meet financial and operational needs.

1. Start-Up: https://www.iniver.co.uk/start-up

2. Scale-Up: https://www.iniver.co.uk/scale-up

Do We Need a DPO? A Practical Checklist for Healthtech Founders

For many healthtech founders, the Data Protection Officer (DPO) question doesn’t come up because of regulation alone, it usually surfaces during procurement, NHS assurance, or a moment of growth where governance starts to matter more.

This checklist is designed to help you sense‑check where you are now, and whether appointing a DPO should already be on your roadmap.

Healthtech DPO Requirement Checklist

Work through the sections below honestly.If you tick any one item in the first section, it’s usually time to take the DPO question seriously.

Factors That Indicate You May Need a DPO:

• ☐ Your product processes health data (including mental health, wellbeing, diagnostic, monitoring, or symptom data)

• ☐ Processing health data is central to your product, not just an internal or incidental activity

• ☐ You process health or other special category data on an ongoing, repeat basis

• ☐ Your platform monitors users regularly or continuously over time

• ☐ You use profiling, scoring, or automated decision‑making, including AI or machine‑learning models

• ☐ You deliver services into NHS or public‑sector care pathways

• ☐ You process patient or service‑user data on behalf of NHS organisations

• ☐ You routinely need to complete Data Protection Impact Assessments (DPIAs) for new features or integrations

• ☐ Buyers, NHS partners, or customers are already asking: “Who is your DPO?”

  
  

Factors That Indicate You May Not Need a DPO Yet, But Should Review Regularly:

• ☐ You are genuinely pre‑product or in early R&D with no real user data

• ☐ Health data is not yet processed, or only used in tightly controlled testing

• ☐ You are running small, time‑limited pilots with clearly defined datasets

• ☐ Your product does not yet involve regular or ongoing user monitoring

  
  

Healthtechs in this stage often cross the DPO threshold earlier than expected as pilots expand or customers go live.

HealthTech Best Practice (Even Before It’s Mandatory)

Many healthtech founders appoint a DPO before it becomes strictly required when:

• ☐ Preparing for NHS or enterprise procurement

• ☐ Scaling beyond founder‑managed governance

• ☐ Introducing AI or higher‑risk processing

• ☐ Getting ready for investment or due diligence

• ☐ Wanting clearer separation between product decisions and compliance oversight

  
  

In these cases, an outsourced or fractional DPO is often the most practical way to meet independence requirements without hard‑wiring the role too early.

Important Structural Point for Founders

The DPO role must be independent from operational decision‑making.Because of this, senior roles such as CEO, CTO, or Head of Product cannot act as the DPO.

This separation is expected by regulators, NHS bodies, and private buyers, and is routinely checked during assurance and procurement reviews.

One‑Line Rule of Thumb

If health data, user monitoring, or NHS delivery is core to your product, the DPO question should already be on your roadmap.

Read more about when a healthtech company may need a DPO here.

Looking to outsource your DPO? Read our guide to picking the right supplier here

At Iniver we offer a 'Full-Service' Outsourced DPO, born from the complex health and healthtech sector. Find out more about our offering here

We also have specific packages for start-ups and scale-ups to meet financial and operational needs.

1. Start-Up: https://www.iniver.co.uk/start-up

2. Scale-Up: https://www.iniver.co.uk/scale-up