Data protection officers (DPO) & GDPR

My new client has grown organically in the past decade to achieve an annual turnover of £65M+, specialising in human capital management (HCM). It is a data-centric business requiring the extensive sharing of subject data both internally and publicly for current and future customers/suppliers.

So, what is a data protection officer (DPO)?

A DPO is a person who is employed or retained by a company to ensure that they remain compliant with their obligations under the DPA 2018 (UK) and GDPR (EU) directives, ensuring processes and practices are in place to ensure that core obligations can be met to protect subject data.

The DPO plays a crucial role in helping the organisation fulfil its data protection obligations and has a duty of care to the organisation, to minimise any privacy processing shortfalls or failures that could result in potential fines.

To deliver the capability of a DPO, he / she must have an understanding of the strategic and operational use of data within that organisation i.e. its information lifecycle model.

Responsibility of the DPO

The DPO provides due diligence and oversight. However, he / she is not personally liable for data protection compliance. The controller or processor of the organisation remains responsible to ensure compliance with the GDPR.

The responsibility of the DPO can be segmented into five areas, which are discussed in no order:

1. Monitor internal compliance

The DPO must oversee both formal and informal data controls, ensuring they cover the full information lifecycle i.e. data ingestion (including all channels), extraction, manipulation, transformation and publication of subject data.

A key artefact that requires scrutiny is the breach process and data subject access requests (DSAR). DPOs should be exposed to these asap.

During business as usual (BAU) activity, especially with new projects or programme of new work, individuals will be tasked to ensure that data protection impact assessment (DPIA) are in place and completed. This is a core project artefact / deliverable and identifies and minimises risks. The following ICO recommendation highlights the minimum for a DPIA:

• The nature, scope, context and purposes of the processing;
• Assess necessity, proportionality and compliance measures;
• Identify and assess risks to individuals; and
• identify any additional measures to mitigate those risks.

It would be prudent to ensure that the DPIA is embedded in a organisation’s governance process as it represents a key project artefact and, where possible, any early draft should provide greater value to the DPO.

Note: Article 38 of the GDPR stipulates that the controller and the processor shall ensure that the DPO is ‘involved, properly and in a timely manner, in all issues which relate to the protection of personal data’.

2. Reinforce the obligations for data protection

The DPO must ensure that:

• All members of staff are fully conversant with their obligations under the GDPR.
• Data privacy across the organisation is promoted via training, internal social media, intranets or any other cost-effective means.
• Staff are aware that any data subject requests are actioned immediately and the DPO is notified.

3. Consultant adviser

The DPO should be considered as a trusted impartial adviser to the organisation, one who will instil best practices and confidence both internally and externally of the organisation.

The DPO should, as a trusted adviser, consider the following:

Organisational information / system processes

Understanding the data flows, from how data is captured (the channels) and permissions obtained, to how the data is processed, transformed, retained and used is fundamental to ensuring that information integrity is maintained. Something which must be understood by the DPO to ensure they can answer any requests or queries that may emerge with confidence.

Technically, it would be prudent to understand the system processes and the associated production systems to ensure that any ‘data touch points’ are fully understood or at least documented / audited regularly.

Practices (formal / informal)

The DPO must understand organisational culture (ways of working), the market it operates in, and its operational practices to ensure that the best processes regarding data management and data usage are maintained.

Whilst this may be documented, I would strongly recommend the DPO occasionally undertakes a ‘sitting with Nel’ exercise to perform random checks with staff to ensure they are comfortable with actual data processing policy enforcement.

The DPO should be familiar with all data capture channels, layers of the enterprise technology landscape and data air gaps that may be prevalent and advise on possible attack vectors to pre-empt any possible breaches of data privacy.

To ensure consistency between the DPO and the data controller or processors all decision-making with regards to requests or DPIA outcomes must be documented, including any difference of opinion that may arise during the governance meetings.

Organisation information patterns

During his tenure as the DPO the individual should, where possible, add value by highlighting common patterns observed and, more importantly the remediation actions for the controllers to introduce.

A DPO is in a favourable position as they can step back and highlight common reoccurring patterns that may be missed by the data controllers / processors.

4. Central point of contact for the supervisory authority

The DPO is the primary point of contact for the ICO i.e. the UK Information Regulator.

Any communication between the DPO and the ICO must be documented and relayed to senior management of the organisation in a timely fashion.

5. Central point for data subjects

The DPO is the primary point of contact for all data subjects (employees, business partners and customers) and thus a key contact for any data subject requests (DSARs), be they employees, business partners and customers or any third party that the organisation may hold information on.

This is a crucial element of his / her duties - any subject access request should be managed promptly and communication by the DPO and the data subject must be rapid and prompt.

How could / should a data protection officer (DPO) perform their duties?

This is not an easy question to address as no two organisations have identical systems or processes in place. Thus, the DPO should embrace the technology, culture, processes and patterns of his specific organisation and industry sector when providing oversight.

To deliver their duties the DPO must play an active part of the data governance process and in many cases may serve as the gatekeeper on some projects.

The DPO should chair monthly schedule meetings to ensure that any requests are put into motion and tracked, but also, as a background process, validate these actions.

The DPO must be alerted to and be notified to inform and manage stakeholders immediately in the event of any breaches and ensure that all immediate risks are mitigated.

The DPO is a ‘service provider’ in terms of managing the organisational obligations under GDPR and, as such, should also be subject to performance metrics, where possible?

However, as data governance and compliance will always trace back to a GDPR directive it would be prudent to ensure artefacts exist which support the GDPR functioning processes.

Please note that each item could result in multiple documents and templates e.g. the DSAR, would result in documents to ensure we capture the ‘who, what, when, how’ and should ideally be represented using standard notations (BPMN,UML).

Below is a list of key documents which should be available for review and provide a foundation for the compliance integrity check (CIC) during the DPO monitoring phase.