The General Data Protection Regulation came into effect on 25 May 2018, and profoundly modified the way companies manage their personal identifiable information, as well as providing a modernised, accountability-based compliance framework for data protection throughout Europe. Data Protection Officers (DPO’s) are at the heart of this new legal framework for many organisations, facilitating compliance with the provisions of the GDPR, since they are a means to ensure compliance with the regulation without external intervention by the supervisory authority The Information Commissioners Office (ICO).

Under Article 37(1) of the GDPR, it is mandatory for certain controllers and processors to designate a DPO in three specific cases:

• Where the processing is carried out by a public authority or body;
• Where the core activities of the controller or the processor consist of processing operations, which require regular and systematic monitoring of data subjects on a large scale; or
• Where the core activities of the controller or the processor consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences.

As a first step, businesses should assess whether their organisation requires such an appointment and, if not, whether a voluntary appointment is worthwhile. Even when the GDPR does not specifically require the appointment of a DPO, it is highly encouraged as a matter of good practice since once the full extent of the regulation is understood by the organisation it quickly becomes apparent that it could be a significant risk not to appoint one.

The second step is to select the right person for the role. The DPO should be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks.

The GDPR recognises the DPO as a key player in the new data governance system and lays down conditions for their appointment, and many organisations may find that the responsibilities are a challenge to deliver, given the breadth of knowledge required on data processing, information security, and the legal aspects of the regulation. With this in mind, the regulation allows organisations to outsource the DPO role to independent certified external provider such as QualityCERT.

QualityCERT has developed a ‘DPO-as- a-Service’ offering in response to increased demand in the market, as more clients understand their obligations to protect personal information and as awareness of GDPR grows. We recognise that the appointment of a Data Protection Officer may require time, money and resources, and finding and recruiting a full-time data protection expert is also beyond the budgets of many organisations. Addressing these challenges, the GDPR makes provisions to fill this post on an outsourced basis, which is why QualityCERT offers the DPO role as a service to organisations on favourable terms.

The DPO role, as mandated by the GDPR, covers a broad range of responsibilities, and includes advising the organisation of its data protection obligations, monitoring the organisation’s compliance with data protection law, consulting on the need for Privacy Impact Assessments where relevant, and acting as the organisation’s point of contact with the Data Protection Authority.