Under the GDPR, you must appoint a DPO if you’re a public authority or body, or if your ‘core activities’ require large scale, regular and systematic monitoring of individuals, especially special categories of data or data relating to criminal convictions and offences.
But, even if you don’t fall under this, we recommend assigning the role of a DPO if you can anyway. If a breach or complaint happens you may be asked by the ICO whether or not you have a DPO and you need a good reason for why you do not.
Tips on who to hire:
- Ideally you should hire someone from within the company. Being the DPO could be an additional/part time role for them. This way, they will know how the organisation and industry works, where the main issues are and will also have an existing relationship with the other employees. The DPO should be independent and advisory but ideally have a human relationship with the company to ensure honesty and communication. You will need to train this person properly if they come from within the company.
- The GDPR doesn’t specify the exact credentials a DPO needs to have but does say that it should be proportionate to the type of processing they carry out, taking into consideration the level of protection the personal data requires.
Things you need to do:
- You should fill in a form that gives the DPO protection by relieving them of sole responsibility if there’s a serious data breach or their advice is ignored, otherwise the DPO is at risk of being sued. If you decide not to follow the advice given by your DPO, you should document your reasons to help demonstrate your accountability.
- The DPO needs the means to carry out their role, be that financial or personal. This will need to be assessed.
- Set out a clear hierarchy in your company to you need to make it clear to your employees who the DPO is and what their role entails.
- There needs to be a constant flow of communication between decision makers and the DPO to ensure that no privacy issues are missed.