The data protection officer under GDPR reports directly to the highest level of management within the organization such as the controller or the processor.