Does Every Organisation Need a Data Protection Officer?

The new General Data Protection Regulation (GDPR) represented one of the biggest changes to data security laws in recent memory, requiring businesses of all sizes to make internal changes to the way they handle and process personal data. The European law gave EU citizens enhanced control over their personal information, allowing them to rescind consent for companies to process their data, while also offering additional protection from data breaches.

To manage the internal data handling and storing processes, many businesses have hired or want to hire dedicated data protection officers (DPOs) to oversee their overhauled data policies. But in many cases, the decision to take this step is complicated by a lack of awareness of whether it is legally necessary to do so. This represents an issue on which managers might benefit from greater clarity.

Data protection officers can help a company to account for regulatory requirements that were ushered in by the GDPR - regardless of whether these rules require them to employ one or not. In this article, we explore the role of the data protection officer, list their key responsibilities, and explain whether your business needs one.

What Is a Data Protection Officer?

A data protection officer, also referred to as a DPO, is a role within a company appointed to an employee who is responsible for ensuring compliance with GDPR. This individual will be in charge of implementing and monitoring all of the processes required to store and handle data appropriately, and is responsible for dealing with any issues that arise in relation to this.

What Does a Data Protection Officer Do?

In terms of data protection officer responsibilities, these revolve around ensuring that data protection rules are adhered to. This involves the following tasks:

• Making their organisation compliant with data protection legislation and requirements
• Monitoring an organisation’s compliance efforts and maintaining them through training, audits and raising awareness
• Recording all of an organisation’s processing operations and making the European Data Protection Supervisor aware of any risks
• Ensuring that data subjects and controllers are aware of their data protection rights and responsibilities
• Highlighting areas where an organisation is at risk of not complying with GDPR
• Dealing with complaints or questions around topics of data protection
• Share recommendations and suggestions for the best ways to follow data protection procedures

Appointing a DPO can help your organisation cover a number of key GDPR processes, as they can take responsibility for determining each member of staff's obligations under the GDPR and monitor compliance with the policies in place for the protection of personal data, including staff training and audits. A data protection officer is also responsible for providing advice on data protection impact assessments, and for acting as the main point of contact between the business and the Information Commissioner's Office.

What Is Not the Responsibility of a Data Protection Officer?

When you’re defining the role and understanding what responsibilities the data protection officer has, it’s just as important to also take note of what they are NOT responsible for. Data protection officer jobs are sometimes taken on by existing employees, and therefore it’s necessary to make sure that you don’t end up with a member of staff with conflicting responsibilities.

Whilst a GDPR data protection officer is responsible for educating and overseeing compliance activity, they are not responsible for the execution of data protection within the organisation. They should advise and monitor efforts, but do not have to also implement procedures and should ensure that someone else is appointed to help with this.

Another thing that the role of the data protection officer shouldn’t include is any kind of conflict of interest between their role and the other responsibilities they have as an employee. It’s recommended that a GDPR DPO is not also a head of HR, should not report to a direct supervisor and should not be a short-term employee or someone on a fixed-term contract. This will ensure that they can work independently in their role without influence from elsewhere in the organisation.

Who Needs to Appoint a Data Protection Officer?

For many firms, the choice to hire a DPO will be one they can decide for themselves. But it's vital to remember that other organisations will be legally required to employ one as part of their GDPR responsibilities.

A data protection officer will be compulsory for an organisation that is “a public authority or body, except for courts acting in their judicial capacity” according to official GDPR legislation. This will also be the case when the core activities of the business consist of processing operations that require regular and systematic monitoring of data subjects on a large scale. 

Additionally, DPOs will be needed if your organisation routinely handles sensitive personal data, or information relating to criminal convictions and offences.

Your company must do the legwork to find out whether they are deemed to occupy any of these categories. A failure to adhere to DPO compliance obligations may result in a fine of up to €10 million, or two per cent of annual worldwide turnover - whichever is higher.

Any company that is required to appoint a DPO should do so as soon as possible. However, even those who are not affected by this obligation may find taking on a DPO to be a positive step.

Making the necessary changes and implementing the appropriate learning and development policies to account for the GDPR reforms is likely to be a complex, broad-ranging process, especially for larger organisations. Centralising responsibility for these tasks can help them to go much smoother, while also providing everyone in the company with a designated point of contact.

Moreover, hiring a DPO will act as a demonstration that your business is taking its new responsibilities seriously - a vital consideration if you wish to remain a trusted steward of personal data among clients and regulators in a post-GDPR landscape.

How to Become a Data Protection Officer

The role of the data protection officer can be given to a new employee or an existing employee with the capacity to take on more responsibility. If you want to become a data protection officer, here’s what you need to do.

Although becoming a DPO does not require any specific qualifications, it's important to note that appointees need to be independent, and cannot therefore have any role in the company's current approach to collecting and using personal data. If you want to be the data protection officer in your company, it’s best if you belong to a department that doesn’t have any direct contact with any personal data, which often means that additional training is required to prepare for the role.

The only official requirement for data protection officer jobs, according to official GDPR legislation, is that the individual must have “expert knowledge of data protection law and practices and the ability to fulfil the tasks” required for a company to become GDPR compliant. This knowledge can be the result of previous experience working in data protection, or it can have been gained through completing a GDPR training course.

If you’re looking for an online training course that can help to prepare you for a data protection officer role, we offer ‘The Essentials of Data Protection (GDPR)’ which covers some of the key topics that are relevant to the role.

As well as being knowledgeable on topics around data protection management, a DPO also needs to have the necessary professional qualities to oversee the implementation of data protection procedures. You should be a confident leader, have good communication skills, be a skilled manager, have great organisational skills and be comfortable working independently and managing your own workload and budget.

If you’re searching for a data protection role outside of an organisation that you already work for, you’ll also really benefit from knowledge of the industry and some experience with the kind of personal data that you’ll be working with. In some cases, certain levels of security clearance will also be required to work with types of personal data that some organisations process and store, so you’ll also need this to take on the DPO role.

Becoming a GDPR data protection officer is a great step in a career for those working in data protection, cyber security or just looking for a more senior position handling policy and procedures in their company. It does require a fair amount of experience and insight into specific topics and regulations, but is an essential position in many organisations to help keep them compliant with EU regulations.

FAQs

When does a data protection officer need to be appointed under the GDPR?

If your organisation is legally required to have a DPO then someone needs to be appointed in this role as soon as the organisation begins operating. If a DPO is not required but you still think it would be beneficial in your organisation, there’s no particular time you need to have someone appointed in this role by.

Who is responsible for ensuring GDPR compliance?

Data controllers are the primary body who are responsible for ensuring GDPR compliance. In most cases, this falls on the person who is in charge of an organisation or company, who should take actions such as appointing a data protection officer in order to be compliant. Data protection officers are not personally liable for ensuring that a company is GDPR-compliant, but they are instrumental in ensuring that this compliance is achieved.

What does DPO stand for in data protection?

DPO stands for data protection officer, which is a role appointed to an employee who oversees and informs a company’s initiatives to be compliant with GDPR. Not all companies are legally required to have a DPO, but it’s still a role that appears in many organisations as a way of ensuring continuing data protection compliance.

Summary

The buzz around GDPR and data protection compliance has died down a bit since the new legislation was rolled out. But ensuring continued compliance is a responsibility of all organisations, and appointing a data protection officer is one of the best ways to make sure that you don’t end up falling short. 

If you’re legally required to employ a DPO, understanding the requirements of the role and the skills and experience needed is essential in hiring the right person who will keep your company compliant. Continued GDPR training is just one measure that they might implement to contribute towards this.

If you’re looking for GDPR compliance training or other essential business compliance training, take a look at our collection of online business compliance training courses to help keep you compliant with the latest legislation.