It's not a separate position. It's a role that one of your upper management plays. It's saying someone at the company must respond to data protection requests, and that person is the data protection officer. Every law that mandates companies do things implies that someone at the company has to do those things.