What Does a Data Protection Officer Do?

The role of a Data Protection Officer (DPO) is to provide expert advice and support to organisations on compliance with data protection legislation. They need to be experts in this field, particularly on the General Data Protection Regulations, and have access to senior managers to do their work.

A DPO’s Core Work

A DPO will do this in several different ways:

• maintain an overview of the organisation’s data processing activity;
• provide advice and support to people who need to collect and process new data;
• help ensure the organisation complies with people’s data rights;
• work to address any data breaches, including being the first point of contact for the Information Commissioner

A Data Protection Officer’s work will therefore involve:

• undertaking exercises mapping data flows across the organisation;
• ensure your privacy statement and Record of Processing Activity are accurate and up to date;
• support the completion of Data Privacy Impact Assessments to analyse the risks of new activities that involve people’s data;
• support the organisation’s response to things like subject access requests.

They will also maintain an overview of data protection risks. They will work with other colleagues to provide assurance on the management of those risks.

DPOs act in an advisory capacity. They must be able to work independently and not be subject to interference from senior managers. Therefore a lot of organisations appoint an external Data Protection Officer, ensuring there are no conflicts of interest as well as finding a cost-effective way of bringing in expertise.

Technical and Organisational Measures

At its core the role of a Data Protection Officer is to ensure an organisation has the right technical and organisational measures to comply with data protection legislation and with people’s rights.

Technical measures means IT security and similar solutions to help keep personal data safe. Organisational measures refers to the training, processes and culture of an organisation – the more human side. This means a DPO should not be focussed on IT or electronic systems. Instead they should be able to apply their data protection expertise in the context the organisation works in and what the people in it are asked to do.

Achieving a Balance

Overall a DPO must strike a balance between statutory compliance and the resources available to achieve it. They must reconcile the need to obtain and process personal data for an organisation to function and achieve its objectives. Therefore alongside their in depth understanding of the law they must act in an enabling capacity and have a good understanding of risk and risk management too.

Ultimately a DPO will help ensure you take reasonable and proportionate steps to comply with your obligations while supporting the use of data to achieve your aims.

Find Out About Our DPO Offer

WuDo Solutions are experts in GDPR and experienced Data Protection Officers. If you are looking for DPO support, find out more about what we can do for you here.