Data Protection Officer (DPO)

What is a Data Protection Officer (DPO)?

“DPO” means Data Protection Officer. A Data Protection Officer (DPO) is a data protection law expert whose primary functions are to inform an organisation about the GDPR compliance requirements, to advise on compliance with the GDPR, and to monitor an organisation’s GDPR compliance effort on an ongoing basis.

When an organisation collects and processes sensitive personal data such as health data or when it monitors the behaviour of individuals via tools such as tracking cookies, it exposes its customers, website visitors, and/or its employees to high risks to their privacy due to the nature of the processing activities.

Therefore, such an organisation should seek an expert’s advice on how to comply with the EU and the UK GDPR’s strict requirements and monitor its GDPR compliance at all times.

This is where the concept of a Data Protection Officer comes into the picture: The EU and the UK GDPR require organisations to appoint a Data Protection Officer if they fulfil certain criteria.

When Must an Organisation Appoint a Data Protection Officer?

Under the EU and the UK GDPR, you are required to appoint a DPO if you fulfill one of these three criteria:

Your core activities require “large scale, regular and systematic monitoring of individuals”

As you can infer from this definition, three elements need to be satisfied.

Firstly, “core activities” refer to your primary business objectives and if you collect and use personal data to achieve your primary objectives, you may fulfil this criteria.

Secondly, your processing of personal data should consist of regular and systematic monitoring of individuals. This would include online tracking, profiling, and behavioural advertising

Thirdly, the monitoring of individuals should be conducted on a large scale. While there are no set thresholds, you need to consider various criteria such as the number of individuals concerned, the volume of personal data, and the range of personal data.

Your core activities “consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.”

When you collect and use sensitive personal data such as health data or data related to racial or ethnic origin, it exposes individuals to higher risks. Therefore, if you process such data on a large scale, you are required to appoint a DPO.

If you are a public authority or body.

If you are a public authority or body, you must appoint a DPO. However, public bodies acting in a judicial capacity are exempt.

What are the Key Responsibilities of a Data Protection Officer?

Article 39 of the GDPR lists the key responsibilities of a DPO, which are as follows:

To inform and advise both the organisation and its employees about the GDPR and other data protection law requirements

A DPO is tasked with informing an organisation and its employees about the requirements of both the GDPR and other relevant data protection laws. For instance, the PECR would be another relevant data protection law in the UK.

In discharging this duty, a DPO may draft decisions to establish new processes or revise existing processes. For example, a DPO may advise that the organisation make changes to existing processing activities to ensure compliance with the GDPR’s data minimisation principles. Furthermore, drafting internal policies and rules related to data protection laws such as data retention policies would also fall under the scope of this task.

To oversee the organisation’s compliance with the GDPR and other privacy laws

Under article 39.1.(b) of the GDPR, a DPO is required to monitor an organisation’s compliance with the GDPR and other data protection laws on a continuous basis.

To discharge this duty, a DPO may ask for information from different departments within the organisation to identify personal data processing activities and it may review the existing data processing activities’ compliance.

Providing advice on data protection impact assessments(DPIAs)

Article 39.1. (c) of the GDPR requires that a DPO provides advice in relation to data protection impact assessments upon request in accordance with Article 35 of the GDPR.

In its Guidance on DPOs, the WP29 recommends that the DPO can provide advice on a variety of issues such as whether to conduct a DPIA, confirm whether a DPIA has been carried out in compliance with the GDPR and how to carry out a DPIA.

Acting as the first point of contact for the Supervisory Authority and cooperating with the Supervisory Authority

A Supervisory Data Protection Authority such as the UK’s ICO can exercise various powers such as the investigative and corrective powers listed in article 58 of the GDPR.

For instance, a Supervisory Authority may start an investigation and ask for internal documents from an organisation.

Therefore, a DPO is tasked with being a point of contact for the Supervisory Authorities and enabling the Authority to gain access to the necessary documents and information.

Acting as the first point of contact for individuals whose data are handled by the organisation

When an individual exercises the rights listed in article 13-23 of the GDPR such as the right of access or the right to deletion of their data, a DPO should act as the first point of contact and advise on how to handle data subject access requests.

What Qualifications and Skills Should a DPO Have?

Article 37(5) of the GDPR states that an organisation shall appoint a DPO “on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices”.

Furthermore, the organisation should also consider a DOP’s capability to fulfill the key tasks of a DPO listed in Article 39 of the GDPR such as providing advice on data protection impact assessments.

As you may notice, the GDPR does not specify any particular qualifications for a DPO.

However, both the ICO’s and the EDPB’s Guidance on DPOs states that a DPO should have expert knowledge of both the EU GDPR and other data protection laws.

In terms of the level of expertise, the ICO’s Guidance on the DPOs states that the level of expertise of the DPO should be commensurate with the level of risks to the personal data and the types of processing activities.

The ICO also recommends that a DPO has knowledge of the specific sector your organisation operates.

Last but not least, strong communication and organisational skills are also critical to the key tasks of a DPO because a DPO must communicate with various stakeholders on an ongoing basis.

Ensuring the Independence of the Data Protection Officer

A DPO can carry out his/her duties successfully only if he/she is allowed to provide the most objective and accurate advice. Therefore, it is vital to ensure the independence and autonomy of the DPO.

Article 38(3) of the GDPR requires that an organisation cannot instruct a DPO to act in a certain way, or cannot fire or penalize a DPO for performing his/her tasks.

Furthermore, Recital 97 to the GDPR clarifies that even when an existing employee of an organization is appointed as a DPO, the DPO shall still act independently and autonomously when performing his/her tasks.

For example, an organisation cannot require that the DPO interpret the GDPR requirements in a particular way or it cannot give instructions on how to handle data subject requests or which data breaches to report to the supervisory authority.

DPO - FAQs

Can a DPO hold other positions within the organisation?

Yes, article 38(6) of the GDPR states that a DPO can perform other functions within the organisation as long as there are no conflicts of interest.

What are the potential conflicts of interest for a DPO?

If another role requires the DPO to determine the purposes and the means of processing personal data, this would give rise to conflicts of interest.

How often should a DPO conduct data protection audits?

There are no specified intervals for carrying out a data protection audit. A DPO should take into account various criteria such as the volume of personal data processed, categories of data, and the organisational needs to determine how often to conduct audits.

What are the consequences of not appointing a DPO when required?

If you fail to appoint a DPO under the UK GDPR, you may face fines up to £8.7 million or 2% of the total annual worldwide turnover in the preceding financial year, whichever is higher.

Under the EU GDPR, you may face administrative fines of up to 10 million Euros, or up to 2 % of the total worldwide annual turnover of the preceding financial year.

Best Practices for Managing the Role of a DPO

Data protection law is a highly complicated and dynamic area of law where new developments occur almost every day.

Therefore, DPOs should follow certain best practices to stay up-to-date and to facilitate GDPR compliance.

Firstly, a DPO should receive regular training on data protection laws and educate themselves on the relevant data protection laws. For instance, they may sign up for courses or attend events and seminars organised by the supervisory authorities.

Secondly, DPOs should conduct audits on a regular basis to identify any non-compliant processes or practices so that they can advise organisations on how to bring their data processing activities into compliance.

Furthermore, DPOs should be transparent and honest when it comes to communication with data subjects and supervisory authorities.

July 29, 2024

Data Protection Officer (DPO)