Skip to main content

What is a Data Protection Officer?

A Data Protection Officer (DPO) is an employee who is responsible for monitoring and ensuring compliance with data regulations in an organisation. According to the EU data regulation (GDPR), it is mandatory for certain organisations to have a DPO. The Data Protection Officer must be able to provide objective advice to the company when it comes to compliance with data regulations.

Who needs a Data Protection Officer?

Companies must have a DPO if they meet at least one of the following conditions:

  • Public authorities and bodies: All public authorities and bodies must have a DPO.
  • Processing of personal data on a large scale: If a company carries out processing of personal data in such a way that it requires regular and systematic monitoring of affected persons on a large scale, or if the company processes special categories of personal data (e.g. health data or information about criminal convictions), they must have a DPO.
  • Public authority or body processing personal data: Although not all public authorities and bodies need to have a DPO, some of them do, especially if they carry out processing of personal data that requires regular and systematic monitoring.

Although it is only mandatory for certain organisations to have a DPO under the GDPR, other companies may also choose to employ a DPO voluntarily as part of their efforts to protect personal data and comply with data protection rules. It may be good practice for any organisation that processes personal data to a significant extent to have a person responsible for data protection and compliance with privacy rules.

Get our Newsletter!

In our newsletter you get tips and tricks for dealing with privacy management from our founder Sebastian Allerelli.

When you sign up for our newsletter you get a license for one user to ShareSimple, which will give you a secure email in Outlook. This special offer is for new customers only, with a limit of one freebie per company.

Who should be your responsible for your data?

To ensure independence and the possibility of providing objective advice to the company, it is a good idea to let your Data Protection Officer be an external consultant. In principle, a DPO can be an internal employee, but in that case it is problematic to ensure impartial guidance. However, we often see that it is the senior IT manager or the senior HR manager who disputes the position.

If you decide that you are not obliged to employ a DPO, it is a wise decision to document your considerations. This serves as documentation that you have thoroughly considered the need for a DPO, which can be valuable in the event of a data audit.

Start your GDPR cleanup where it is needed the most

Sensitive data can tends to accumulate in the employees' e-mails. With a GDPR Risk Scan from DataMapper, you get a report that shows any potential GDPR risks in the company's e-mails.

How to make life easier for your Data Protection Officer

Keeping track of the company’s processing of personal data in a proper manner is a comprehensive task. It involves many processors which are time-consuming and resource-intensive; identification of your files with personal data, preparation of policies, follow-up of employee processes, updating of IT systems, etc. By using specific GPDR software, you can help your Data Protection Officer from the heaviest, manual tasks. Read more about GDPR software here.

Sebastian Allerelli
Founder & COO at Safe Online
Governance, Risk & Compliance Specialist
Follow me on LinkedIn to get tips on GDPR →

GUIDE

How to handle sensitive personal data

GUIDE

How to find personal data with datamapping tool

GUIDE

How to prepare for a data audit