--- title: First 90 Days as a DPO | Free eBook | TSC description: Essential guidance for new Data Protection Officers on building strong data protection foundations in their first 90 days. image: https://thesecuritycompany.com/hubfs/Guide-first-90-days-as-DPO.webp --- [Skip to content](https://thesecuritycompany.com/blog/90-days-as-a-new-dpo-ebook#main-content) [![TSC Logo large](https://thesecuritycompany.com/hs-fs/hubfs/TSC%20Logo%20large.png?width=95&height=78&name=TSC%20Logo%20large.png)](https://thesecuritycompany.com/) - [Human Risk Platform](https://thesecuritycompany.com/tscs-human-risk-management-platform) - [Products & Services](https://thesecuritycompany.com/productsandservices) - [Success Stories](https://thesecuritycompany.com/success-stories) - [Resources](https://thesecuritycompany.com/our-resources) - [Blog](https://thesecuritycompany.com/blog) [Book a demo](https://thesecuritycompany.com/contact-us) ![Search icon](https://5018647.fs1.hubspotusercontent-na1.net/hubfs/5018647/Design/Icons/Font%20Awesome/search.svg) [Book a demo](https://thesecuritycompany.com/contact-us) [All posts](https://thesecuritycompany.com/blog/all) July 22, 2026 # How to make an impact in your first 90 days as a new DPO   The Security Company  ·  2 minute read ![Data Protection Officer presenting to colleagues in a meeting room, representing DPO responsibilities, data protection leadership and GDPR compliance planning.](https://thesecuritycompany.com/hs-fs/hubfs/Guide-first-90-days-as-DPO.webp?width=1920&height=1080&name=Guide-first-90-days-as-DPO.webp) Navigate your first 90 days as a new DPO with practical guidance on GDPR compliance, data protection culture, DPIAs, SARs, and data breach response. ## How to make an impact in your first 90 days as a new DPO: Essential guidance for new Data Protection Officers As a new Data Protection Officer (DPO), the foundations you build in your first 90 days will shape your organisation's data protection compliance, privacy risk management, and security culture for years to come. With 95% of cyber security incidents linked to human error and more than 120 nations adopting data protection rules, DPOs play a critical role in protecting personal data, supporting GDPR compliance, and reducing the risk of costly data breaches. This guide explains the core responsibilities of a DPO, from Data Protection Impact Assessments (DPIAs) and Subject Access Requests (SARs) to data breach response, data mapping, regulatory liaison, stakeholder engagement, and employee data protection training. It also explores how DPOs can build a stronger data protection culture through awareness campaigns, gamified learning, continual training, and clear communication with IT, legal, HR, marketing, senior leaders, and employees. **In this free eBook, you'll discover:** The typical strategic and day-to-day activities of a Data Protection Officer How to conduct Data Protection Impact Assessments (DPIAs) effectively Managing Subject Access Requests (SARs): timelines, process and common pitfalls How to prepare for, detect and report a data breach within GDPR obligations Building relationships with key stakeholders to embed data protection across teams Staying current with GDPR, UK data protection law and new regulations Designing effective data protection awareness and training programmes for employees How to liaise with the ICO and other regulators during audits and investigations --- ### Start strong as a new DPO TSC helps organisations strengthen data protection through practical awareness training that builds GDPR knowledge, supports DPOs, reduces human error and embeds a strong data protection culture. [View eBook](https://thesecuritycompany.com/hubfs/FINAL-TSC-How-to-make-an-impact-in-your-first-90-days-as-DPO-eBook-FINAL.pdf) [Book a demo](https://thesecuritycompany.com/contact-us) --- ## First 90 days as a new DPO FAQ ### What should a new DPO focus on in the first 90 days? A new Data Protection Officer should focus on understanding the organisation's data processing activities, reviewing data protection policies, mapping personal data, monitoring GDPR compliance, and building relationships with key teams such as IT, legal, HR, marketing, and senior management. ### Why are DPIAs important for data protection compliance? Data Protection Impact Assessments (DPIAs) help organisations identify, assess, and reduce privacy risks before launching new projects or changing data processing activities. They are essential for demonstrating accountability, protecting personal data, and reducing the risk of data breaches or regulatory non-compliance. ### How should a DPO manage Subject Access Requests? A DPO should create a clear Subject Access Request (SAR) process, verify requester identity, collect relevant personal data, protect third-party information, respond within required timeframes, use secure communication channels, and keep records for audit and compliance purposes. --- ## Related pages [Human Risk Platform](https://thesecuritycompany.com/tscs-human-risk-management-platform) [Products & Services](https://thesecuritycompany.com/productsandservices) ## Related posts [![](https://thesecuritycompany.com/hubfs/help-employees-care-about-data-webinar-4.webp)](https://thesecuritycompany.com/blog/help-employees-care-about-data) [WEBINAR](https://thesecuritycompany.com/blog/tag/webinar) ### [Help employees care about data](https://thesecuritycompany.com/blog/help-employees-care-about-data) [![](https://thesecuritycompany.com/hubfs/gdpr-ebook-guide-2.webp)](https://thesecuritycompany.com/blog/guide-gdpr-ebook) [eBOOK](https://thesecuritycompany.com/blog/tag/ebook) ### [Your guide to GDPR](https://thesecuritycompany.com/blog/guide-gdpr-ebook) [![](https://thesecuritycompany.com/hubfs/Digital%20footprint.webp)](https://thesecuritycompany.com/blog/take-control-of-your-digital-footprint-how-the-risks-and-protection-advice) [ARTICLE](https://thesecuritycompany.com/blog/tag/article) ### [Take control of your digital footprint: how, the risks and protection advice](https://thesecuritycompany.com/blog/take-control-of-your-digital-footprint-how-the-risks-and-protection-advice) ![](https://thesecuritycompany.com/hs-fs/hubfs/bug.webp?width=80&height=80&name=bug.webp) ![](https://thesecuritycompany.com/hs-fs/hubfs/bug_white.webp?width=80&height=80&name=bug_white.webp) Go further with emerging threat intelligence, expert analysis and guidance [![TSC White Logo large](https://thesecuritycompany.com/hs-fs/hubfs/TSC%20White%20Logo%20large.webp?width=100&height=82&name=TSC%20White%20Logo%20large.webp "TSC White Logo large")](https://thesecuritycompany.com/) **©** The Security Company (International) Limited 2026 Office One, 1 Coldbath Square, London, EC1R 5HL, UK Company registration No: 03703393 VAT No: 385 8337 51 [linkedin-in icon](https://uk.linkedin.com/company/thesecurityco) [Home](https://thesecuritycompany.com) [Human Risk Platform](https://thesecuritycompany.com/tscs-human-risk-management-platform) **[Products & Services](https://thesecuritycompany.com/productsandservices)** [Contact us](https://thesecuritycompany.com/contact-us) [Privacy &](https://thesecuritycompany.com/tsc-policies)[Cookie Policies](https://thesecuritycompany.com/tsc-policies) [Terms & Conditions](https://thesecuritycompany.com/tsc-policies) **Resources** - [eBooks](https://thesecuritycompany.com/our-resources) - [Reports & Whitepapers](https://thesecuritycompany.com/our-resources) - [Cyber Security Calendar](https://thesecuritycompany.com/blog/security-awareness-calendar) - [Webinars](https://thesecuritycompany.com/our-resources) - [Blog](https://thesecuritycompany.com/blog) Copyright © 2026, The Security Company Ltd ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The Security Company", "url" : "https://thesecuritycompany.com/blog/author/the-security-company" }, "dateModified" : "2026-07-30T19:05:44.742Z", "datePublished" : "2026-07-22T15:33:13.000Z", "headline" : "First 90 Days as a DPO | Free eBook | TSC", "image" : [ "https://thesecuritycompany.com/hubfs/Guide-first-90-days-as-DPO.webp" ], "mainEntityOfPage" : { "@id" : "https://thesecuritycompany.com/blog/90-days-as-a-new-dpo-ebook", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://thesecuritycompany.com/hubfs/TSC%20Logo%20large.png" }, "name" : "The Security Company" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://thesecuritycompany.com/#organization", "@type" : "Organization", "description" : "Cyber security awareness training and human risk management for businesses of every size.", "logo" : "https://thesecuritycompany.com/hs-fs/hubfs/TSC%20Logo%20large.png?width=190&height=156&name=TSC%20Logo%20large.png", "name" : "The Security Company", "sameAs" : [ "https://www.linkedin.com/company/thesecurityco/", "https://www.youtube.com/@thesecurityco", "https://vimeo.com/user31176192", "https://thecpdregister.com/providers/cpd-group-providers--790118", "https://ico.org.uk/ESDWebPages/Entry/Z4812822", "https://find-and-update.company-information.service.gov.uk/company/03703393", "https://registry.blockmarktech.com/certificates/19d457f5-bf79-4f85-8f6e-dd2db181ff76/", "https://www.gartner.com/reviews/product/the-security-company-security-awareness-training" ], "url" : "https://thesecuritycompany.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://thesecuritycompany.com/#website", "@type" : "WebSite", "name" : "The Security Company", "publisher" : { "@id" : "https://thesecuritycompany.com/#organization" }, "url" : "https://thesecuritycompany.com/" } ```