DON’T: Under-Resource your DPO
Apart from reporting to the ICO or its representative, the DPO must also monitor the state of a company’s compliance and provide advice as to whether corporate or administrative policy will affect said compliance. To do this, the DPO needs tools. What’s more, if you don’t procure reasonably adequate tools for the Data Protection Officer, this will become a factor in the ICO’s penalty judgement if and when you breach compliance.
I think that even not procuring of tools for DPO is one of the reason of penalty since it is a independant job.