7 Things to Keep in Mind When Hiring a Data Protection Officer (DPO)

The General Data Protection Regulation has introduced a lot of rules to be implemented by organizations under the European Union. One of the most major and controversial topics has been the role of the Data Protection Officer (DPO). This post deals with whether you need a DPO or not and if you do, what are the requirements of the DPO.

Before we look into the requirements, we answer the most asked question:

“Do I HAVE TO hire a DPO no matter what?”

The answer to this question is NO. If your business is a large organization dealing with personal and sensitive information, you will need to hire a DPO. Any organization that takes regular and systematic information needs to have a DPO. For example, if you search data through search engines and connect with your clients frequently you need a DPO. However, if your business is a food shop sending brochures once a year to random people you definitely do not need a DPO.

Now that you have decided whether you should hire a DPO or not let’s look at the  7 characteristics your Data Protection Officer should fulfil:

1) Works independently.
You have to let your Data Protection Officer work independently on making sure that all data is rightfully handled. This means that your DPO has complete freedom and not be liable to any particular department.

2) Monitors every data related action by GDPR protocols.
The DPO is in charge of looking at whether GDPR protocols are being followed. For example, if the data given by a client is with the full consent or not. Hence the DPO must have complete knowledge of GDPR.

3) Performs training of data processors and controllers.
The data processors and controllers are equally liable for handling data so the DPO must guide your data processing team about how to follow GDPR rules and laws.

4) Liable for presenting detailed records of data.
GDPR allows your client to have complete authority over their own data. So in case your client questions whether their data is secured or any issue whatsoever, your company’s DPO should be able to prove through records that everything is done rightfully by GDPR laws.

5) Reviews every data processing activity.
Your business might have a lot of branches dealing with various data from an array of clients and vendors, the DPO has to overlook each of these data processing activity and monitor if they are being done correctly.

6) Responsible for internal audits and profiling.
The DPO is liable for assessment and profiling of employees within the organization as well. Since you are taking information from your employees and your employees might take data from your consumers, your DPO needs to have a full assessment of everyone involved.

7) Has to present reports on board with members.
The DPO of your organization has to successfully report the proceedings of whether GDPR is being implemented successfully. GDPR has made it clear that privacy of data must be given as much priority as other board meeting issues.

Some of you might be wondering, “Can one of my current employees act as the Data Protection Officer?”

YES. The data protection officer, in case your business is a small organization, that still deals with a lot of data processing can hire a member of the data processing team to act as the Data Protection Officer. The DPO has to know all the regulations and protocols of the GDPR. The DPO is still to be considered a separate post and the person in question should be given full independence to work as a DPO. However, for large-scale organizations, it is best advised and mandatory to hire a trained Data Protection Officer.

Have you hired a DPO for your organization yet? What checklists did you follow? Let us know below!