When do we need a Data Protection Officer (DPO)?

A Data Protection Officer (DPO) is an employee who is responsible for monitoring and ensuring compliance with data regulations in an organisation. According to the EU data regulation (GDPR), it is mandatory for certain organisations to have a DPO. The Data Protection Officer must be able to provide objective advice to the company when it comes to compliance with data regulations.

Companies must have a DPO if they meet at least one of the following conditions:

• Public authorities and bodies: All public authorities and bodies must have a DPO.
• Processing of personal data on a large scale: If a company carries out processing of personal data in such a way that it requires regular and systematic monitoring of affected persons on a large scale, or if the company processes special categories of personal data (e.g. health data or information about criminal convictions), they must have a DPO.
• Public authority or body processing personal data: Although not all public authorities and bodies need to have a DPO, some of them do, especially if they carry out processing of personal data that requires regular and systematic monitoring.

Although it is only mandatory for certain organisations to have a DPO under the GDPR, other companies may also choose to employ a DPO voluntarily as part of their efforts to protect personal data and comply with data protection rules. It may be good practice for any organisation that processes personal data to a significant extent to have a person responsible for data protection and compliance with privacy rules.

To ensure independence and the possibility of providing objective advice to the company, it is a good idea to let your Data Protection Officer be an external consultant. In principle, a DPO can be an internal employee, but in that case it is problematic to ensure impartial guidance. However, we often see that it is the senior IT manager or the senior HR manager who disputes the position.

If you decide that you are not obliged to employ a DPO, it is a wise decision to document your considerations. This serves as documentation that you have thoroughly considered the need for a DPO, which can be valuable in the event of a data audit.

Keeping track of the company’s processing of personal data in a proper manner is a comprehensive task. It involves many processors which are time-consuming and resource-intensive; identification of your files with personal data, preparation of policies, follow-up of employee processes, updating of IT systems, etc. By using specific GPDR software, you can help your Data Protection Officer from the heaviest, manual tasks. Read more about GDPR software here.