S2 Ep29: How AI Is Reshaping the DPO Role in 2026
Hosted by Caine Glancy and Amber Sivill
Caine Glancy and Amber Sivill discuss how AI is changing DPO workloads, advice, risk assessments and governance, and why human oversight still matters.
S2 Ep29: How AI Is Reshaping the DPO Role in 2026
Data Protection Made Easy podcast with Caine Glancy and Amber Sivill
Artificial intelligence is changing how Data Protection Officers work.
AI tools can help with research, training, risk assessments and routine administration. However, they can also produce inaccurate advice, encourage confirmation bias and create new governance risks.
In this episode of the Data Protection Made Easy podcast, Caine Glancy and Amber Sivill discuss how AI is affecting DPO workloads and why professional knowledge and meaningful human oversight remain essential.
What Does This Episode Cover?
During the episode, Caine and Amber discuss:
- The increase in AI-generated Subject Access Requests
- How AI is affecting DPO workloads
- The risks of using AI for data protection advice
- How AI could support RoPAs, DPIAs and LIAs
- The importance of checking AI-generated policies
- Confirmation bias in AI responses
- Why human oversight and professional knowledge still matter
How Is AI Affecting Subject Access Requests?
The discussion explored the growing number of Subject Access Requests, or SARs, that appear to have been generated using AI.
These requests can look formal and detailed. However, they may ask for information that does not fall within the normal scope of a SAR.
Amber explained:
“It also fuels a lot of misunderstanding. A lot of the time, you see a request and most of it does not even fall under the scope of what a SAR generally covers.”
Caine also shared that SAR-related cases handled through the DPP Support Desk have increased significantly.
AI may make it easier for people to create requests, complaints and follow-up correspondence. This can place additional pressure on data protection teams, particularly where requests are vague or based on incorrect information.
Can DPOs Rely on AI for Data Protection Advice?
AI can provide a useful starting point. However, it should not replace professional knowledge.
Amber explained:
“You need to have the base knowledge in order to be able to use these systems.”
An experienced practitioner may recognise when an AI response refers to the wrong legislation, misses important context or provides an answer that is too confident.
Someone with less experience may not spot those problems.
Data protection decisions are rarely black and white. The correct answer often depends on the organisation, the processing activity and the people who may be affected.
Could AI Support RoPAs, DPIAs and LIAs?
AI may help DPOs complete some routine or administrative tasks.
For example, it could help pre-populate a Record of Processing Activities, or RoPA, using information about an organisation’s activities and data sharing.
It may also provide a starting point for a Data Protection Impact Assessment, or DPIA, and a Legitimate Interests Assessment, or LIA.
However, organisations must consider what information they enter into an AI system. DPIAs and other assessments may contain sensitive or confidential information.
Amber said:
“There is a limit as to what you can provide the model with in terms of confidentiality and not oversharing any information.”
Any AI-generated assessment must be checked against the organisation’s actual processing, systems and risks.
Why Does Human Oversight Matter?
AI can produce clear and convincing answers even when those answers are incomplete or incorrect.
It may also agree with the direction of a prompt instead of challenging the user’s assumptions. This is known as confirmation bias, which means favouring information that supports an existing view.
Caine explained:
“It is a fantastic tool that will hopefully be able to help in the role as a DPO. But what matters is that you can supplement it with your pre-existing knowledge.”
Amber added:
“The human element needs to be someone overlooking it who actually knows what they are talking about.”
Human oversight must be meaningful. The person reviewing an AI output needs the knowledge and authority to identify problems, challenge the result and make the final decision.
Is an AI-Generated Policy Better Than No Policy?
An AI-generated policy is not useful simply because it exists.
A policy must reflect how the organisation actually works. It must be practical, accurate and followed by staff.
Amber explained:
“If you have a policy in place and it does not align with your business, it is not workable and people are not following it, then there is ultimately not really anything there in place anyway.”
AI may help structure a first draft. However, the final policy should be reviewed by someone who understands the organisation, its legal duties and its operational risks.
What Should DPOs Take Away?
AI can support DPOs, but it should not replace them.
Organisations should:
- Use AI to support work rather than make final decisions
- Check AI outputs against current law and ICO guidance
- Avoid entering unnecessary personal or confidential information
- Keep meaningful human oversight in place
- Document how AI tools are approved, monitored and reviewed
- Make sure policies and assessments reflect real business practices
The DPO role is becoming broader and more connected to technology, governance and organisational risk.
AI creates opportunities to work more efficiently. It also makes professional judgement, scepticism and accountability more important.
Meet Your Hosts
Caine Glancy
Caine is the Data Protection Support Desk Manager at Data Protection People. He works with organisations every day to help them understand and respond to practical data protection challenges.
Amber Sivill
Amber is a Data Protection Consultant at Data Protection People. She supports organisations with data protection compliance, governance and emerging technology risks.
Watch or Listen to the Episode
Watch the full episode on YouTube or listen on Spotify.
Need Support With AI Governance?
If your organisation is adopting AI, Data Protection Made Easy can help you understand the risks, strengthen governance and meet your data protection responsibilities.