A controller appoints a Data Protection Officer but also makes that person Head of Marketing with conversion-rate KPIs that conflict with privacy advice. What requirement is most clearly breached?

A public body or private organisation that appoints a Data Protection Officer while also loading that person with Head of Marketing conversion-rate KPIs most clearly breaches the requirement that the DPO perform tasks independently and without a conflict of interest. Independence exists so privacy advice can protect residents, customers, and staff even when growth metrics pull the other way; conflicting commercial KPIs undermine that civic safeguard and hollow out the appointment. Requiring an EU Member State law degree before marketing advice fails by inventing a credential rule that is not the independence test—expertise matters, but the scenario’s breach is structural conflict, not missing diploma paperwork. Publishing the DPO’s salary band in the privacy notice fails by mistaking transparency theatre for organisational independence; salary disclosure is not how GDPR proves a conflict-free DPO role. Treating marketing KPIs as automatically transferring DPO duties to the lead supervisory authority fails conceptually: SA competence and one-stop-shop rules do not absorb day-to-day DPO tasks merely because incentives are poorly designed. Exam caveat: dual hats are not automatically unlawful in every organisation, but roles that determine purposes of aggressive personal-data use for revenue commonly create impermissible conflicts under GDPR and EDPB DPO guidance. Operational check: separate DPO reporting lines from marketing P&L, remove conversion KPIs from the DPO’s objectives, document no-conflict assessments, and escalate if leadership overrides privacy advice for campaign volume.