Can a legal counsel simultaneously serve as a Data Protection Officer (DPO) within a controller's organization?

ANSWER

Legal counsels, as professionals providing legal services, may perform the function of a Data Protection Officer (DPO) provided that they possess the additional qualifications required to carry out the duties of a DPO.

The Polish Data Protection Authority (UODO) addressed this issue in an article published on 28 June 2019: UODO – Can a legal counsel act as a DPO?

Since UODO has not excluded such a possibility, it is generally accepted that a legal counsel may perform the function of a DPO. However, the controller must ensure that holding both roles within the organization does not give rise to a conflict of interest, as referred to in Article 38(6) GDPR.