Appointing a data protection officer

Stanley Stephens, Solicitor

What is a Data Protection Officer?

A Data Protection Officer (DPO) is the designated individual within an organisation who is responsible for monitoring, advising and organising compliance with UK GDPR and other data protection laws. They act as the main point of contact for data protection matters – both internally with staff and externally with the Information Commissioner’s Office (ICO).

Under Article 39 of the UK/GDPR, the DPO’s key responsibilities include:

1. Monitoring the organisations compliance with data protection laws, including its data protection policies and procedures, compliance infrastructure, organising staff training and raising awareness across the organisation;
2. Overseeing Data Protection Impact Assessments (DPIAs); and
3. Acting as a formal contact for the ICO and for individuals whose personal data is being processed by the organisation.

Importantly, the DPO is not personally liable for any non-compliance with data protection compliance – the organisation is legally responsible. To ensure impartiality, the DPO must be free from conflicts of interest.

When is a Data Protection Officer required?

Under UK GDPR appointing a DPO is required when the organisation is:

1. A public authority or body (e.g. Manchester City Council);
2. Where its core activities require large scale, regular and systematic monitoring of individuals (e.g. A company that operates CCTV systems across public transport); or
3. Where its core activities consist of processing any special categories of personal data on a large scale (e.g. NHS Trusts and large health care providers) or personal data relating to criminal convictions and offences.

An organisations “core activities” are essentially its primary business objectives. If you need to process personal data to meet these then the likelihood is that you will need to appoint a DPO.

Data which falls into “Special Categories” include anything involving racial or ethnic origin, sex, sexual orientation, personal health and/or political / religious beliefs.

Data processed on a “large scale” refers to handling significant volumes of personal data. For example, tracking passenger movements across Manchester’s tram network through bank cards.

The size of the company doesn’t matter– the requirement is based on the nature and scale of data processing, not the number of employees.

Even if your organisation isn’t legally required to appoint a DPO, doing so voluntarily can ensure compliance with data protection laws more generally.

How is a DPO appointed?

There are no formal qualification requirements that a DPO must have, but they must be independent, have an expert knowledge of data protection laws, be adequately resourced and report to the highest management level in the organisation.

You do not need to hire externally if there is already an employee of the organisation capable of carrying out a DPO’s role effectively, but it is imperative that they have the requisite knowledge of data protection laws. It can be more beneficial, particularly for smaller organisations, to outsource the DPO position to a specialist company.

Once a DPO has been appointed, an organisation must:

• Publish the DPO’s contact details;
• Notify the ICO; and
• Make the DPO’s contact details easily accessible to staff (e.g. via intranet or internal directories).

How to assist your DPO?

Under Article 38 of the UK GDPR, organisations must support their DPO by:

• Involving them in all data protection matters.
• Provide adequate resources to enable its DPO to meet their UK GDPR obligations and maintain their expert level of knowledge.
• Ensuring access to personal data and processing operations by the DPO is facilitated and maintained.
• Facilitating regular reports to senior management on all issues concerning UK GDPR.
• Allow the DPO to maintain its independence.

Final thoughts

Appointing and supporting a qualified DPO is a key part of demonstrating compliance with relevant data protection legislation. Failure to do so can have serious consequences such as financial penalties, regulatory action, reputational damage and legal liability.

For tailored advice or support with data protection, please contact our Commercial Team, who have experience guiding organisations through UK GDPR compliance.

Contributors: Imogen Unwin, Trainee Solicitor