[krfsm]

There are limitations, namely:

"There must not be a conflict of interest between the duties of the individual as a DPO and her other duties, if any."

Specifically they recommend against also being the data controller. I.e. you shouldn't be responsible both for handling personal data and verifying compliance of said handling.