Cyber Career Week: The Data Governance Lead (Where Cyber Meets Compliance)

National Cyber Security Career Week banner emphasizing shared cyber security roles in schools and trusts.

: Tammy Buchanan; Information/Cyber Security; 22 October 2026

Cyber Career Week: The Data Governance Lead (Where Cyber Meets Compliance) | October 22

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.

So this week, instead of career pathways, we’re looking at who already holds a piece of cyber security in their day-to-day role: from the Headteacher or CEO, through the Data Governance Lead and DPO, to IT support and governors, and what each of them actually needs to be doing.

The Independent DPO

When something goes wrong, a phishing click, a ransomware alert, a stolen laptop, everyone’s instinct is to ask “where’s the DPO?” It’s the wrong question, and the ICO’s own guidance explains why: the independent DPO isn’t personally liable for data protection compliance, and their role isn’t operational firefighting at all. It’s advisory and oversight-based. The controller, your school or trust, stays responsible for compliance. The DPO’s job is to inform, advise, monitor, and flag risk, not to personally resolve the incident at 4pm on a Friday.

Two different jobs that share a name’s worth of confusion

It’s worth being precise about this, because the terms get used loosely: the DPO and the Data Protection Lead/Champion (or Data Governance Lead at trust level) are not the same role, and they’re not interchangeable.

The DPO: for DPE’s clients, that’s DPE itself, is the independent, external, advisory-only role required under UK GDPR. The DPO informs, advises, monitors compliance, and is the contact point for the ICO. They hold no operational responsibility for the school’s day-to-day data protection work, and specifically can’t be the person deciding how data gets processed, because that would compromise their independence.
The Data Protection Lead/Champion (school) or Data Governance Lead (trust) is an internal role, held by someone who works at the school or trust. This is where the operational work actually happens: logging breaches, handling SARs, keeping records current, running training ; the things an external, advisory-only DPO structurally can’t and shouldn’t be doing themselves.

The two roles work together constantly, but they’re not a hierarchy with the DPO “above” the internal lead. The DPO advises; the internal lead delivers; and keeping those genuinely separate is what makes the DPO’s independence mean something in practice, rather than just on paper.

What the DPO actually does

Per the ICO, the DPO’s core tasks are:

Informing and advising the organisation and its staff of their data protection obligations
Monitoring compliance, including awareness-raising, training, and audits
Advising on and monitoring DPIAs
Acting as the contact point for the ICO

And critically: the organisation must take account of the DPO’s advice, and if it decides not to follow it, it should document why.

Why this has to stay separate from “doing”

The ICO is explicit that a DPO can hold other tasks, but not if they create a conflict of interest, specifically, the DPO can’t be the person who decides the purposes and means of processing, and shouldn’t have to balance data protection against competing operational objectives.

For schools, the practical version of this is: the person patching servers, running backups, or deciding which systems to buy shouldn’t be the same person whose job is to independently check whether that processing is lawful and proportionate. Combine the two, and the second job quietly stops happening whenever it’s inconvenient.

DPE’s own split: SLT lead and operational lead

We’ve written about this directly in our Data Protection Lead/Champion role, for larger organisations, splitting the internal champion role in two:

SLT lead: strategic oversight, driving cultural change, assessing risk, allocating resources, reporting to governors
Operational lead (often admin staff): the day-to-day: subject access requests, privacy notices, breach investigations, training logistics, being the actual first point of contact

Neither of these is the DPO firefighting an incident personally. Both exist precisely so someone covers compliance work even when the DPO is focused elsewhere, and so the DPO’s independent voice never gets absorbed into “just get it fixed.”

School-level vs trust-level: two similar names, two different jobs

In a single school, the Data Protection Lead/Champion is the internal role we’ve just described, operational, hands-on, the first point of contact for SARs, breach logging, and day-to-day privacy practice within that one school.

In a multi-academy trust, the Data Governance Lead sits one level up, and the job changes shape:

Consistency across schools, not delivery within one. A trust’s Data Governance Lead isn’t personally running SARs for every academy, they’re making sure every school in the trust handles SARs the same way, to the same standard, using the same templates and timescales.
The bridge to the DPO, trust-wide. Where a school’s Data Protection Lead liaises with the DPO about that school’s issues, the trust-level Data Governance Lead works with the DPO (often outsourced, as DPE is for many of our MAT clients) on patterns across the whole trust, which academies are falling behind, where risk is concentrating, what needs escalating to the CEO or board.
Governance and reporting, not casework. This role is closer to the SLT lead end of the school-level split than the operational end, but at trust scale: consolidating risk registers across schools, standardising policy, and reporting upward to the CEO and trustees rather than downward to individual staff queries.
Still not the DPO. The same independence principle applies at trust level as at school level, the Data Governance Lead coordinates and standardises, but doesn’t replace the DPO’s independent advisory role, and shouldn’t be the person deciding processing purposes either.

Aligned in purpose: both exist to make sure data protection actually happens, not just gets written down, but genuinely different jobs: one is hands-on delivery in a single school, the other is oversight and consistency across many.

Where this meets cyber security directly

Per the Digital Leadership and Governance standard covered on Day 21, the DPO is specifically consulted on cyber risk advising on data risks and emergency responses, flagging safeguarding concerns in disaster scenarios. That’s input into decisions, not ownership of the response. When a cyber incident happens, IT and SLT run the technical and operational response; the DPO’s job is making sure the data protection consequences such as breach notification, affected individuals, documentation don’t get missed in the rush to get systems back online.

How this lines up with the DfE Digital and Technology Standards

This isn’t a side issue for the standards as it’s threaded through them. Across the DfE’s Digital and Technology Standards guidance, “data protection” is referenced more than 30 times, and the Digital Leadership and Governance: Core Standard is where the Data Governance Lead’s role is made explicit: it names the data protection officer as someone to involve when keeping registers up to date, planning disaster recovery, and setting your digital technology strategy. The Cloud Solutions standard goes further, requiring that cloud providers are covered by a data sharing agreement, that they notify you promptly if a breach occurs, and that your DPO carries out a Data Protection Impact Assessment (DPIA) before you adopt a new cloud solution. None of this is optional small print; it’s written as a “must” requirement, not a recommendation. In practice, that means the Data Governance Lead and the DPO have to be working from the same page before a new system, platform, or supplier is signed off, not brought in once it’s already live.

💡Your Daily Cyber Tip

If your DPO is also the person who’d be first on the scene technically fixing a cyber incident, that’s worth a second look, not because they’re doing anything wrong, but because no one is then checking their work independently.

InfoSec / Cyber