WHEN TO HIRE A DATA PROTECTION OFFICER

24 July 2018

• data protection
• GDPR
• general data protection regulation
• data privacy
• Data Protection Officer
• DPO
• Data protection act 2018
• data
• risk management
• data protection laws

 Under the GDPR, you must appoint a data protection officer (DPO) if you:

1) are a public authority (except for courts acting in their judicial capacity);
2) carry out large scale systematic monitoring of individuals (for example, online behaviour tracking); or

3) carry out large scale processing of special categories of data or data relating to criminal convictions and offences.

If your business does not perform any of the above, it may still decide to voluntarily appoint a DPO. However, even though in this regard it would not be mandatory, there is no ‘DPO-lite’. There is an obligation in Article 37(5) to ensure you appoint a person who is adequately resourced and has ‘expert knowledge of data protection law and practices’ and on the basis of their ‘professional qualities’.

The Guidelines suggest that the level of expertise ‘must be commensurate with the sensitivity, complexity and amount of data an organisation processes’ and that prospective DPOs ‘should have expertise in national and European data protection laws and practices and an in-depth understanding of the GDPR.’ It is expected that experience would be garnered from backgrounds which include risk management, legal and accreditation from processes such as ISO27001, CIPP-E certifications, etc.

The ICO provides guidance useful in respect of DPOs https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/accountability-and-governance/