The internal or external data protection officer answers data protection questions from within the company. He or she advises the management on the handling of personal data in accordance with the EU General Data Protection Regulation when introducing new processes, writes statements on the permissibility of planned or already implemented data processing activities. The data protection officer is also the contact point in data protection for the supervisory authority. In this position, he or she communicates with the supervisory authority on issues relating to the company or in the course of data protection audits. A recurring task of the data protection officer is to support the company in conducting a data protection impact assessment (DPIA). The internal or external data protection officer provides decisive advice on whether a DPIA should be carried out, advises on the strategy for carrying it out and, in the follow-up, on whether the DPIA was carried out correctly and whether the conclusions are in compliance with data protection laws.
Continuous training in data protection is also an important aspect of the day-to-day work of an internal or external data protection officer. On the one hand, he or she constantly educates himself or herself on issues relating to data protection and data security, and on the other hand, he or she trains your employees in accordance with the EU General Data Protection Regulation and raises their awareness to current requirements of a data processing activity. In addition, the data protection officer serves as a contact person for data subjects in the company for all questions relating to the processing of their personal data and the exercise of their rights in data protection.