The DPO, or Data Protection Officer, is a role that has been discussed at length as the GDPR has moved from concept to reality.
The DPO is responsible for:
- Informing the organisation on its GDPR obligations
- Monitoring that compliance
- Being the first point of contact for employees and supervisory authorities
- Training Staff
- Conducting audits and supporting data protection impact assessments
There are requirements about how the role fits into the organisation. It must report to the highest level (to a board member) and have access to appropriate resources. The DPO must not be at risk of dismissal or penalty for doing the job. Conflicts of interest, such as decision-making responsibility for how data is processed, are not allowed.
You can assume that all the requirements were made with large organisations in mind.
Some organisations must appoint a DPO. Public bodies like schools and organisations that process large amounts of personal data must have a DPO in place for May 25th 2018. For others there is no mandatory requirement.
The question is, should you appoint a DPO anyway?
Organisations rely on accurate, well managed information, it makes great customer service easier and can be the basis of improved efficiency.
It may seem that the Data Protection Officer must be an IT expert but, in fact, it’s a process role. The best person to deal with the task may well sit in an Operations role or if you have someone responsible for quality management. This should avoid the conflict of interest issue, but there may still be some reassurance needed that they will be supported.
Thinking about compliance as a process you integrate with the day to day operation of the organisation, rather than an unknown external risk can remove the fear factor. Whether you give the title to a person or not, the tasks of the DPO can become part of business as usual.
Does your organisation need awareness training?
