What can I do with one month till GDPR comes into force?
April 30, 2018
What can GDPR do for accountants?
May 24, 2018
Do I need to appoint a Data Protection Officer?
The General Data Protection Regulation (GDPR) requires that somebody in your company takes responsibility for data protection but we look at whether that means you need to appoint a Data Protection Officer.
A DPO has special legal protection and in some ways must act independently of the company so they can whistle-blow without fear of being disciplined. They must not have any responsibilities for privacy management systems in your company – they’re supposed to be able to audit your systems and identify where you need to improve.
What is a Data Protection Officer?
A Data Protection Officer (DPO) is a formal role required by the GDPR as having overall responsibility for compliance. It is a mandatory position for certain organisations such as those processing large amounts of data or organisations subject to Freedom of Information requests.A DPO has special legal protection and in some ways must act independently of the company so they can whistle-blow without fear of being disciplined. They must not have any responsibilities for privacy management systems in your company – they’re supposed to be able to audit your systems and identify where you need to improve.
So does an SME require a DPO?
It is unlikely that a small business is required to have a DPO unless processing large amounts of data. If you are in any doubt, we recommend that you contact the ICO small business line by email here.
Unless you are required to appoint a DPO under GDPR, we recommend you appoint someone who would carry out many of the same tasks and be the ‘go-to’ person in your company but won’t fall under some of the specific issues and requirements in the regulations. They will put the right technical and organisational systems in place to ensure your company meets the principles of the regulations.
This person should report directly on data protection and privacy matters to the senior manager with overall accountability for compliance with GDPR in your company, such as the senior partner or director.
Unless you are required to appoint a DPO under GDPR, we recommend you appoint someone who would carry out many of the same tasks and be the ‘go-to’ person in your company but won’t fall under some of the specific issues and requirements in the regulations. They will put the right technical and organisational systems in place to ensure your company meets the principles of the regulations.
This person should report directly on data protection and privacy matters to the senior manager with overall accountability for compliance with GDPR in your company, such as the senior partner or director.
