Who requires a DPO? - IT Governance Blog