Sole proprietor has to be the DPO in that instance.

Yup, I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases. But, yeah, I'm not a lawyer too.

Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion)

> CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO?​​​

> Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests.

https://www.dponetwork.eu/faqs.html

> I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases

Being the sole owner and manager and being the DPO is clearly a conflict of interest.

If you're Zuck or anyone working for FB, that'd be true. But what if one of my interests in running my company is the protection of my users' data?

Can you imagine yourself trying to convince a regulator of that?

Like Zuck before senate?

I imagine when running a business one faces many stupid bureaucrats, this could be another one (or they could be competent and understand and accept the technical explanation of how my imaginary company complies with GDPR).

But yeah, why quit because of the n + 1th bureaucrat, when you've dealt with n of them while starting and running of your business?

> Like Zuck before senate?

No, like Google, Microsoft and Intel before the European Commission.

> Being the sole owner and manager and being the DPO is clearly a conflict of interest.

Could you clarify why you think this is so? As an owner, my interests would align with the DPO's interests so it's hard to me to find where the conflict of interest would reside in the case of being the sole employee _and_ DPO.

Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.

No, as an owner your interests do not necessarily align with the DPO. They might, but they do no necessarily.

If you're selling your stored PII to third parties without user consent then yes, it would be.

I would say there is a definite conflict of interest for the sole owner to be the DPO - you are responsible for the entire direction of the company, thus have considerations beyond data protection (rather than an individual who ONLY has to consider the data protection outcomes in the exercise of his duties). Even if you make data protection a paramount concern, and intend to be fully compliant, there is the possibility that you could e.g. make more money or provide a better service by making a different choice, therefore there is a conflict of interest.