Do I need a Data Protection Officer? Data Protection Officers (DPOs) are a role that was brought in by the GDPR. Although this is an EU regulation it has been brought into UK law under the Data Protection Act 2018. This means that most UK based organisations that process personal data generally do need one, or at a minimum access DPO services from time to time.
Statutory Data Protection Officer
For some organisations having a DPO is a statutory requirement. This apples to:
- most public sector organisations e.g. local authorities;
- organisations systematically processing data about a large number of people or in large volumes, as part of their core activity;
- organisations processing what is called “special category” data – broadly information about health, criminal offences, or other types of sensitive personal data.
It doesn’t matter if you are a data processor or a data controller for these purposes.
That covers who has to have a DPO. However, most organisations still need one. This is because the Information Commissioner’s Office (ICO), who enforces the Data Protection Act, requires organisations to ensure that they have the staff and resources in place to comply with their statutory duties.
Non-Statutory Data Protection Officer
The ICO also says a DPO can help you operate within the law by advising and helping to monitor compliance, and argues a DPO can be seen to play a key role in your organisation’s data protection governance structure and to help improve accountability.
Therefore if you choose not to have a DPO you will need to ensure that you can show this is justifiable and you are compliant in other ways.
Sign Up Here:
Overall the conclusion for almost all organisations that process personal data is: yes, you do need a Data Protection Officer. Fortunately there are a number of DPO solutions available that can provide the expertise and support you need at a low cost. Firstly you can appoint a member of your existing team to be your Data Protection Officer. You then train them to develop the skills they need to become well versed in the GDPR. The advantages of this are you will have someone who is familiar with your organisation and the work it does. They will understand the data you need to use and how you use it. As you are not hiring someone new this can be relatively low cost. However, there will be costs related to training and skills development. The disadvantages are that there could be a conflict of interests between your in-house DPO’s “day job” and their data protection duties. They will also need the time and space to exercise their DPO role. Alternatively you can outsource your DPO activity on a contractual or call-off basis. While this may be a little more expensive, it can be easily affordable and has a number of other advantages. Your DPO will be a GDPR expert and can help you move quickly to compliance. They may not know your business and industry as well as you will. However, they can work with you to achieve the right balance between your business needs and the risks of using data. Therefore, although it is very like you will need a DPO, there are ways in which you can have one that are both efficient and effective. Find out more about our Data Protection Officer here Gain the practical skills you need to identify and manage data protection and GDPR with this five-star rated training course. Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.Finding a Data Protection Officer
We offer both world class DPO services and five star rated GDPR training.
