Do you need a DPO?
The GDPR requires the appointment of a DPO (Data Protection Officer), that is responsible for educating the company and its employees about compliance, training staff involved in data processing, and conducting regular security audits. A DPO is needed so that all processes for protecting personal data have a single owner (process owner), who coordinates the efforts of many departments and is responsible for it.
In addition, a DPO will be able to help the organization in maintaining its GDPR compliance as:
- new processes and projects with personal data are introduced;
- the structure of the organization is changing with new departments and divisions, branches and representative offices, where you need to configure the process of protecting personal data again;
- new untrained employees who may violate the Regulation out of ignorance;
- new Data Processing Agreements with customers or contractors are signed.
You can hire an: Inhouse DPO
It is good to have a competent DPO on staff, as:
- s/he knows the processes within the organization well.
- s/he is easily accessible
- information and knowledge remain within the organization.
However, there are very few competent DPOs. Trained specialists are deficient in many areas.
Therefore, companies often appoint one of the existing employees to the DPO role, increasing their workload, as well as investing considerable resources in her/his training.
At the same time, there is always a risk that the DPO trained with your contribution will leave your organisation for better offer.
It is also a common story when personal data tasks, assigned as a part-time job to an employee, are postponed "for later", since the main job remains the priority which may lead to uncompleted tasks and calculated fines.
Another example, the information security specialist who puts on the DPO cap will be primarily concerned with technical measures related to information security, rather than informing data subjects about personal data collected by the company. And s/he will certainly not be able to correctly draft documents such as a privacy policy or a contract with a data processor. The lawyer, appointed by the Data Protection Officer, often continues to work on coordinating business contracts, postponing technical measures that he does not understand.
Or: Outsourced DPO
In accordance with the Regulation, the DPO function can be outsourced. This is often the most profitable decision, because you get an experienced and competent specialist who can quickly make decisions on the GDPR and be responsible for them.
What benefits will your company ultimately receive?
- time saving (experienced DPO will decide in 5 minutes, where unqualified employees may think about it for a month);
- guarantee of correct decisions (avoiding errors and misinterpretations of the Regulation);
- avoidance of sanctions by supervisory authorities (the DPO is able and knows how to communicate with them, what documents to provide them, even if your company has not yet met all the requirements of the Regulation);
- avoid the difficulties and costs of recruiting, adapting and retaining an employee in the DPO position;
- an external DPO is free from possible conflict of interest and remains objective;
- according to the Pareto principle, every minute of an outsourcing specialist’s time is spent most efficiently as 20% of her/his effort will provide 80% of the results;
- no need to create a separate workplace, to provide social benefits, or to introduce a new person to an already cohesive team. Outsourced DPO will not go on vacation, will not take time off, and will not be absent due to illness.
What’s the advantage?
According to Article 37 of the GDPR, Data Protection Officers should have specific competencies, including “expert knowledge of data protection law and practices”.
Since the introduction of the GDPR inevitably entails the optimization of some of the company's business processes, a DPO is required a rare set of competencies in the areas of privacy, management, IT, which our specialists possess.
We have gained extensive experience in implementing the GDPR in companies of various levels of maturity and business areas (banks, airlines, manufacturing companies, online stores, social networks, mobile application developers, IT start-ups, pharmaceutical companies, cloud services), both in the CIS and EU countries;
Our DPOs are constantly improving their professional level and gaining best practices from all over the world, participating in international conferences and being members of the international network of experts of the International Association of Privacy Professionals;
And most importantly: our experts sincerely love and cherish their work, unlike the employee who has been assigned to deal with the GDPR, and for whom it is “another headache”.
Way it works
A DPO should be appointed, according to the Regulation, if the main activity of your company falls under Article 37 of the GDPR, that is in fact on a permanent basis.
We conclude contracts for outsourcing this role for 1 or 2 years. And extend them, if necessary.
Such a long period is necessary because our DPOs usually begin their work by bringing your company in line with the GDPR. This task alone can take several years, subject to the active cooperation of your staff. Therefore, we recommend starting cooperation with the “Full” service package.
In the future, a DPO will be required for all changes in the company, for example, a new project, process or branch, new employees or contractors. But her/his involvement may be lower, and fewer hours of work will be required.
Phases of our DPO outsourcing:
Familiarization with the activities of your company and audit of the current situation. GDPR non-compliance analysis (gap-analysis).
Bringing your company to an acceptable level.
Maintaining the achieved level of compliance. Aligning emerging projects and processes.