The Data Protection Officer has an important job, but they're not the one legally responsible for GDPR compliance. So who is? And what is the DPO's role?