Monitor compliance with GDPR by making sure the privacy measures put in place by the company are implemented properly and are up to standard.
Be a point of contact in the company to inform and advise the data controller (the person/organisation that decides why and how personal data is processed) and the data processor (the person/people that actually perform the data processing on the controllers behalf) as well as employees of the company on how to comply with relevant data protection laws.
Develop, coordinate and manage a company’s data protection strategy.
Provide training sessions to staff to make them aware of their GDPR obligations, what counts as a data breach, the signs/how you will know there has been one and who to involve in the process.
The DPO has a complex role. They have to play the role of the advocate and represent the rights of individuals who, for example, send a SAR to the company, and maybe push the company to release information they don’t want to release because the DPO knows this is how to comply with GDPR.
At the same time, the DPO also has a representational role for the company they work for. In court, they should be as neutral as possible but at the end of the day the DPO is a member of the company and, in reality, there’s often corporate loyalty. It can be difficult to balance these two roles.