Contrary to popular belief, it is not mandatory for every organisation to have a data protection officer (DPO). However, it’s vital you know:

• What a DPO does.
• Whether or not you need one.
• How to deal with any data problems if you don’t have one.

Choosing Your DPO

A data protection officer is the go-to person within an organisation for any data protection issues. It needs to be someone who is well-versed in data protection law, so that staff can rely on their expertise as and when needed.

Members of the public also need to be able to contact the DPO directly should they wish to discuss the data processing activities of the organisation.

What Does a Data Protection Officer Do?

Your data protection officer’s main responsibilities involve:

• Informing and advising employees of their data protection obligations.
• Monitoring GDPR compliance within the organisation.
• Training the other staff on data protection.
• Liaising with the Information Commissioner’s Office (ICO), the UK’s data protection authority, when needed.

Does My Organisation Need a DPO?

Under UK law, it is not mandatory to have somebody who is employed specifically as a DPO. However, someone will have to be designated to take care of data protection matters alongside their existing role.

A data protection officer helps organisations to minimise the risks intrinsic to the processing of personal data.

When Am I Required to Have a Data Protection Officer?

You are only mandated to have a DPO if:

• You’re a public authority, e.g. a local council.
• Your core activities require large scale, regular and systematic monitoring of individuals.
• Your core activities involve large scale processing of special categories of data (protected characteristics such as age, ethnicity, etc) or data relating to criminal convictions and offences.

For SMEs that only tend to handle a small amount of data, or where the data is not of a sensitive nature, it may be a disproportionate expense to hire a DPO.

It may also be the case that it’s just not worth designating an existing staff member to look after data protection, considering the time and money that is needed for training and ongoing compliance monitoring.

How Can I Prevent Data Breaches Without a DPO?

If you’re not legally obliged to appoint a DPO and doing it yourself internally isn’t a viable option, working with an independent DPO, or GDPR practitioner, is the best thing to do to ensure you meet all your GDPR obligations.

This generally begins with the DPO carrying out a GDPR audit of your organisation. This will highlight any areas of concern in a report, so you can rectify any issues. The DPO can then help you maintain ongoing compliance by periodically reviewing data protection at your organisation. They can also be called upon to advise staff and raise awareness within your company of all relevant data protection issues.

Accountability

Accountability is one of the key principles of GDPR in the UK and EU in the event of any kind of legal dispute. So, it’s imperative that you use a DPO who has expertise in this field so, if needed, you can show you are accountable to the individuals whose data you process.

It’s also important to remember that data protection is not solely the responsibility of the designated staff member or GDPR practitioner. Senior staff members involved in processing data will be held responsible in the event of a data breach. In the event of a serious data breach, the ICO has the power to:

• Issue fines of up to 18 million pounds.
• Or fine a company 4% of the annual global turnover of the preceding financial year.

The higher amount is chosen as the fine penalty. Therefore, making use of an expert practitioner can help you avoid the risk of financial penalties and reputational damage, which can be hard to recover from.

Getting Help

Whether you need the support of a Data Protection Officer or just need occasional help with getting your procedures and documentation in place, Allott and Associates is here to support you.

Our GDPR experts can provide comprehensive support to guide you through your obligations and help you maintain ongoing compliance.

For a free, confidential and no obligation discussion about your GDPR requirements, get in touch here.

Additional Resources:

There’s a Hole in My Breeches: Why You Should Care About a Data Breach.

What Does EU GDPR Mean for Your Marketing Strategy?

UK GDPR Regulation Updates.