A guide for organisations processing personal data
The EU and UK GDPR contain a requirement for certain organisations to appoint a data protection officer (DPO). A good DPO is fundamental for the success of an organisation, bringing an organised, efficient and most importantly, expert approach to data protection compliance which will free up time and resources for your organisation to focus on other commercial objectives without worrying about data protection compliance.
What is a DPO?
A DPO is an individual or entity which is responsible for a number of data protection related tasks within an organisation. At HelloDPO, your DPO will:
- Inform and advise the organisation about its compliance obligations and how to meet them under the GDPR.
- Monitor compliance with the GDPR, AI, and internal policies, including the assignment of responsibilities, awareness-raising, training individuals involved in the processing of personal data and undertaking monitoring and audits to demonstrate compliance.
- Provide data protection and privacy advice, and where required, advice in relation to data protection impact assessments and AI risk assessments.
- Be the point of contact for data protection authorities such as the UK Information Commissioner’s Office.
- Provide advice and support on personal data breaches and data subject rights’ requests.
- Be the point of contact for individuals internally and externally at your organisation, for other third parties and for data protection authorities.
DPOs are also independent and report to the highest level of the board and their role includes preparing and inputting into board reports and other risk management reporting.
Do we need a DPO?
The GDPR requires organisations to appoint a DPO if any of the following apply:
- The organisation is a public authority or body;
- As part of its core activities the organisation monitors individuals regularly and in a systematic way on a large scale, for example,they undertake tracking and monitoring of individual’s behaviour on the internet or via the use of CCTV; or
- As part of its core activities the organisation processes large volumes of special category data (which includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, processing genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data about a person’s sex life or sexual orientation) or criminal offence data.
The concept of “large scale” is not specifically defined in the GDPR nor in regulator guidance, but you will need to consider the following factors when deciding if you need to appoint a DPO:
- the number of individuals whose personal data is being processed;
- the volume of personal data processed;
- the type of personal data;
- the duration of the processing i.e. is this one off or ongoing over a period of time; and
- the geographical extent of the processing i.e. where is this happening.
Even if you don’t have to appoint a statutory DPO under the GDPR, you can choose to appoint a voluntary DPO. If you decide to voluntarily appoint a DPO, you should be aware that the statutory requirements set out in the GDPR will apply to the voluntary DPO in the same way as if a statutory DPO appointment was triggered. These responsibilities include the requirement for the DPO to act independently, to fulfil the duties set out in the GDPR and to be provided with adequate resources to fulfil those duties.
If you handle large volumes of data or you undertake complex processing, having a DPO could help you improve your data protection compliance and will provide a dedicated point of contact for data subjects and data protection authorities for any data protection matters.
What if we decide we don’t need to appoint a DPO?
If you decide you are not caught by the requirements set out in the GDPR to appoint a statutory DPO, you do not need to appoint one. However, it is important that you are confident in your assessment as, if a DPO is not appointed when one is required, this will be a breach of the GDPR, which could lead to a fine of up to 2% of annual global turnover or about £8.5 million/€10 million, whichever is greater. You should carefully document your decision not to appoint a DPO in writing as evidence of your thought process so you can justify this to a data protection authority if necessary should this be challenged.
What are the benefits of outsourcing the role of the DPO to HelloDPO?
Whilst you can appoint an in-house DPO, there are clear benefits to appointing HelloDPO as your outsourced DPO:
- Independence – As we don’t work in your organisation , it is much easier for us to take a balanced, independent look at the data protection challenges you face. Many internal DPOs that we speak to say they can feel conflicted between their duties as a DPO and the other elements of their role, something which the GDPR requires organisations to avoid.
- Resource – The GDPR requires organisations who appoint a DPO to ensure the DPO has necessary resources to complete their tasks. Rather than risk overstretching your current team, we can provide dedicated resources to tackle data protection issues.
- Expertise – The GDPR requires a DPO to have expert knowledge of data protection law and practices. At HelloDPO we work with clients across many sectors and have a team that is experienced in a wide range of data protection issues. This means we can get to the heart of issues quickly and provide simple, commercial and effective privacy advice. We can also provide organisations with the opportunity to benchmark what they do against other organisations in a similar sector or of a similar size. We bring a different perspective to the table and provide you with the confidence that you are handling a matter, for example a data breach or a data subject access request, in the way that a regulator would expect.
Can you help me to make the decision about appointing a DPO?
Yes! You can either download our GDPR toolkit, which contains a number of documents designed to get you started on your compliance journey (including our DPO assessment template) or you can get in touch by emailing hello@hellodpo.com and we can carry out a tailored DPO assessment for you.
FAQs
Who should be our DPO?
A DPO should be someone with:
- Expert knowledge of data protection law and practices in line with the nature and sensitivity of the data processing undertaken
- The ability to operate independently without conflicts of interest.
- The ability to fulfil the tasks of the DPO – someone with integrity, whose focus is to ensure compliance with the GDPR and who has a position in the organisation which will allow them to properly fulfil their tasks
They cannot be in a role that determines how data is processed (e.g. Marketing Director) because that would create a conflict of interest.
Is there a fine for not having a DPO?
Yes, failure to appoint a DPO where you are required to do so under GDPR would be a breach of the GDPR and could attract an administrative fine of up to EUR 10 million/£8.7 million or 2% of global turnover, whichever is higher. Failing to appoint a DPO can also expose you to greater risk of fines generally if this leads to a failure to properly manage your responsibilities under GDPR.
Can we share a DPO?
Yes, a group of companies can appoint a single DPO as long as the DPO can effectively carry out their tasks across the different businesses.
Are there any industries exempt from the need to appoint a DPO?
There is no industry-wide exemption. The requirement to appoint a DPO depends on the nature of your processing, not your sector.
As mentioned in the information above you must appoint a DPO if:
- You are a public authority or body (except courts acting judicially).
- Your core activities involve regular and systematic monitoring of individuals on a large scale.
- Your core activities involve large-scale processing of special category data or data about criminal offences.
This applies to both controllers and processors.
