Fractional Chief AI Officer and Data Protection Officer
Independent, senior oversight of how your organisation uses AI and personal data. Part of your leadership team, without a full-time seat.
Most organisations now use AI somewhere. Many also handle personal data at a scale where the law expects a Data Protection Officer. These are not separate problems. The AI tools your teams use run on the data your DPO is there to protect.
We act as your fractional DPO, your fractional Chief AI Officer, or both. You get one senior person who sees the whole picture and reports straight to your leadership team.
Why The Two Roles Belong Together
AI governance and data protection used to sit in different places. Now they meet in almost every AI decision.
A customer service chatbot processes customer conversations. A recruitment tool screens CVs. A sales assistant reads your CRM. Each one is an AI question and a data protection question at the same time.
When those questions sit with different people, things fall through the gap. A tool gets approved before anyone checks the lawful basis. A DPIA gets written after launch. A supplier changes its model and nobody notices.
A combined fractional Chief AI Officer and DPO closes that gap. One senior person holds both views, so your board gets one clear answer.
What Your Fractional DPO Does
The DPO is a defined role under the UK GDPR, with defined tasks. As your fractional DPO, we:
advise your leadership team and staff on their data protection obligations
act as your point of contact for the ICO and for people who want to exercise their data rights
monitor compliance with the UK GDPR, other data protection laws and your own policies
support you through personal data breaches, including the decision on whether to report
advise on Data Protection Impact Assessments (DPIAs) before high-risk processing starts
report directly to the highest level of management
We also handle the practical work around the role. That includes staff awareness, records of processing and keeping privacy notices current.
If you are weighing up a new AI tool, our guide on when the law expects a DPIA is a good place to start.
What Your Fractional Chief AI Officer Does
A Chief AI Officer owns an organisation's approach to AI. Large enterprises are starting to hire for this role full-time. Many organisations need the same oversight without a permanent seat.
→ develop your AI strategy and roadmap in alignment with your business goals and compliance obligations, and identify opportunities for improvement
→ build and maintain an inventory of the approved AI tools in use, including AI that arrived inside software you already pay for
→ establish an AIapproval process to assess new AI tools and use cases before adoption and for AI solutions that have operational changes
→ perform vendor suitability assessments that involve reviewing data processing agreements, data breach notification and responsibilities, the need to conduct a DPIA and/or an International Data Transfer Agreement (IDTA) if data is being transferred and processed by destinations that don’t have strong protections in place.
→ write and maintain your AI policies to establish practical rules for AI use and help employees understand how to apply them to everyday tasks.
→ run due diligence on AI suppliers before contracts are signed, including how they handle business and personal information
→ provide leadership and board reporting on AI adoption, risk, incidents, company training progress to support informed decision-making
→ align your AI governance with relevant standards and legislation by applying frameworks such as ISO/IEC 42001, alongside applicable privacy laws and other legal requirements like Data (Use and Access) Act 2025, proportionate to your business
→ develop and implement online training programs covering responsible AI use, security, privacy and other relevant business risks
→ develop, maintain, and provide guidance on AI incident response and recovery plans for identifying, escalating, responding to and recovering from AI-related incidents, integrated with existing incident response, business continuity, and disaster recovery plans
→ facilitate tabletop exercise and recovery simulations using realistic, scenario-based exercises with leadership and operational teams to test their readiness for AI-related incidents, system failures, data breaches, internal teams oversharing information, and business disruptions, allowing the identification of gaps and recommendation of improvements
→ review and provide suggested changes on an organisation’s privacy policy to ensure the document considers AI
→ establish who owns each AI systems, who is responsible for monitoring its performance and who is responsible if something goes wrong
Our view stays the same throughout. AI should be the tool, not the objective. We help you use it with confidence, and we say plainly when something is not ready.
For organisations that want project-based support first, our AI governance consultancy is often the starting point.
Why Your DPO Often Needs To Sit Outside The Business
The UK GDPR requires a DPO to be independent. They must be an expert in data protection, be properly resourced and report to the highest level of management. They must not take instructions on how to carry out their tasks, and they cannot be penalised for doing them.
They also cannot have a conflict of interest. That rules out many obvious internal choices. A director, head of IT or head of marketing usually decides how personal data is used. Asking them to monitor those decisions means checking their own work.
An external DPO solves this. We sit outside your management structure, so our advice stays independent. You still have a senior expert close to the work.
Not sure which role you need? Talk it through with Marnie or Roger.
Our clients take governance seriously. They want it done properly, not quickly. They usually fit one of these descriptions:
Who We Work With
Organisations with a legal duty to appoint a DPO, because they process special category data or monitor people at scale
Leadership teams rolling out AI across several functions, with no single owner for the risk
Businesses facing AI and data protection questions in customer due diligence, tenders or procurement
Boards that want regular, plain reporting on AI risk
Organisations whose current DPO arrangement has gaps, or sits with someone who has a conflict
We work with organisations across the UK, the US and Australia.
How It Works
A first conversation
You speak with Marnie or Roger about where you are and what you need. There is no sales team and no obligation.
A scope of
work
We set out what the role covers, how often we meet and what you can expect from us. It costs nothing to receive.
A baseline
review
In the first weeks, we look at your current AI use, data processing and key documents. Then we agree priorities with you.
Ongoing
support
We work on an agreed rhythm, with regular reporting to your leadership team (e.g. monthly leadership check-in, quarterly board report) and support when something urgent comes up.
Marnie and Roger
You work with the principals. We lead the work ourselves. You speak directly to the person with the answer. Marnie and Roger are both members of the International Association of Privacy Professionals (IAPP) and between them have more than 10 years of data protection and governance experience.
Client Work
One of our clients engaged Marnie as fractional DPO. Prior to the engagement, the client had no governance over software and tool use, no knowledge of what handled their confidential data, and what their reporting obligations were to the UK ICO. Supported by Roger, Marnie implemented a change management request and approval system to control the use of software, including AI-powered software, created and maintained documentation mapping data flow across the organisation, introduced incident response and incident reporting documentation and procedures, built out an AI privacy and security compliance platform, developed an AI data protection roadmap that aligned with ISO/IEC 27001, ISO/IEC 42001, UK GDPR, UK Data (Use and Access) Act 2025 (DUA), PERC 2003, FCA Consumer Duty (PS22/9), PCI DSS, and NIST, and updated the organisation’s privacy and cookie policy to meet UK GDPR obligations and align with how they function.
Frequently Asked Questions
-
A fractional DPO is an external Data Protection Officer who works with your organisation part-time. They carry out the full DPO role under the UK GDPR, but you are not hiring a full-time employee. The UK GDPR allows a DPO to be a member of staff or to work under a service contract.
-
You must appoint a DPO in three cases:
you are a public authority or body
your core activities involve regular and systematic monitoring of people on a large scale
your core activities involve large-scale processing of special category or criminal offence data
Many other organisations appoint one voluntarily. If you do, the same duties and protections apply. The ICO's guidance on Data Protection Officers helps you check, and we can talk it through in the first conversation.
-
Usually not. A DPO must be independent, report to the highest level of management and be free of conflicts of interest. A business owner or director who decides how personal data is used will generally fail that test, because they would be reviewing their own decisions.
-
It can work, but it needs care. A DPO must not be the person who decides how personal data is used. So we set the roles up so that your leadership team keeps the decisions, and we provide oversight, advice and challenge. If an engagement would put us in a conflict, we will tell you and suggest another structure.
-
An AI consultant usually joins for a project and then leaves. A fractional Chief AI Officer stays. They join your leadership team, track AI use over time and report to your board. Some organisations start with a project and move to a fractional role once the foundations are in place.
-
Every organisation is different, so we do not publish fixed prices. After the first conversation, we send a no-obligation scope of work. It sets out what the role covers, the time involved and the cost.
-
Yes. We work with clients in the UK, the US and Australia. The DPO role comes from UK and EU data protection law, so it matters most if you handle personal data of people in the UK or EU. The Chief AI Officer role applies wherever you operate.
Find Out What Your Organisation Needs
Whether you need a DPO, a Chief AI Officer or both, the first step is a conversation. You will speak with Marnie or Roger, and you will leave with a clearer view of what the role should look like for you.