What is the recommended reporting line for a Data Protection Officer (DPO) within large financial organizations, specifically a bank that operate in the Middle East?

Ideally a C-level and different from a CDO or CIO to ensure the governance enforcement over the units responsible for the execution.

Compliance or corporate risk management in my opinion (and experience in banking).

To ensure change can be effected and individual rights upheld the DPO should report to a high level. Depending on the roles in C-suite this could be the Chief Data and Analytics Officer, the Chief Information Security Officer, Chief Technology Officer or Chief Risk Officer.