You may already know that the implementation of the GDPR in 2018 marked a turning point for data protection worldwide. Organisations across various industries faced the challenge of adapting data protection principles to their processes and systems.

Can you guess one of the key factors that played a significant role in helping organisations to comply with the GDPR?

It was the appointment of DPOs. Yes, the inclusion of DPOs in organisational structures emerged as a key driver in ensuring compliance with the GDPR.

Within just a year of the implementation of the GDPR, approximately 500,000 organisations across Europe had appointed DPOs, as revealed by a study conducted by the International Association of Privacy Professionals (IAPP) in 2019. This statistic highlights the rapid adoption and recognition of a DPO's role in ensuring compliance with data protection regulations.

Furthermore, in recent years, numerous additional data protection laws have been introduced or updated, and most of them now mandate organisations to have a DPO in place. This emphasises the growing importance and demand for DPOs in safeguarding individual privacy and enabling organisations to navigate the evolving data protection landscape.

Should all organisations appoint a DPO

No, the requirement for appointing a DPO under the GDPR is based on specific criteria. Article 37 of GDPR talks about the criteria for determining the necessity of appointing a DPO. This depends mainly on three factors:

(i) If the organisation is a public authority.

(ii) If the core activities of an organisation require regular and systematic monitoring of data subjects on a large scale.

(iii) If the organisation carry out large-scale processing of sensitive personal data or personal data relating to criminal convictions and offences.

However, appointing DPOs can be a matter of good practice, even if not explicitly required by the GDPR. It might seem obvious to you while we discuss the functions and roles of a DPO in the section below.

What are the roles and functions of a DPO?

The role of a DPO is vital in ensuring compliance with data protection regulations and safeguarding the privacy rights of individuals. Let us check out some of the roles and responsibilities of a DPO:

(i) Data protection expertise and knowledge: A DPO is a designated individual within an organisation who possesses specialised knowledge in data protection laws and practices. They stay updated on the latest regulations, guidance, and best practices related to data privacy.

(ii) Monitoring GDPR compliance within the organisation: One of the primary responsibilities of a DPO is to monitor the organisation's compliance with the GDPR requirements. They assess the data processing activities, policies, and procedures to ensure they align with the principles and obligations outlined in the GDPR.

(iii) Providing guidance and advice: DPOs offer guidance and advice to the organisation, its employees, and other stakeholders regarding data protection matters. They assist in implementing privacy-enhancing practices, ensuring data security measures are in place, and fostering a privacy-aware culture within the organisation.

(iv) Conducting data protection assessments and audits: DPOs perform Data Protection Impact Assessments (DPIAs) to evaluate the potential risks associated with specific data processing activities. They also conduct regular audits to identify compliance gaps, potential vulnerabilities and recommend remedial actions to mitigate risks.

(v) Training and awareness: DPOs play a crucial role in raising awareness and providing training on data protection and privacy matters. They educate employees about their responsibilities, train them on data handling practices, and promote a culture of privacy and data protection throughout the organisation.

(vi) Incident response - A DPO plays a pivotal role in ensuring a swift and effective response to data breaches or incidents involving personal data. They coordinate the incident response plan, assess the impact of the incident on individuals' privacy, and work closely with relevant stakeholders to mitigate risks and minimise harm. 

(vii) Serving as a point of contact: The DPO acts as a point of contact for individuals and supervisory authorities (regulators). Individuals can reach out to the DPO to exercise their rights, ask questions, or raise concerns regarding the processing of their personal data. The DPO also coordinates with supervisory authorities, facilitating communication and cooperation when required.

Now that you have understood the roles and functions of a DPO, it is important to highlight their independence and position within the organisation.  Article 38 of the GDPR places a strong emphasis on the position of a DPO within an organisation.

Independence & reporting structure of a DPO

The independence of the DPO allows them to perform their duties objectively and without conflicts of interest. It ensures that their recommendations and decisions regarding data protection are based on the best interests of individuals and compliance with applicable regulations. Being independent enables the DPO to provide unbiased advice to the organisation.

Can a person holding other organisational responsibilities be appointed as a DPO?

Yes, the GDPR allows a person holding other organisational responsibilities to be appointed as a DPO.  However, the person appointed must be able to fulfil the duties and requirements of the role in an independent manner. Suppose the DPO holds other responsibilities within the organisation. In that case, those roles should not result in a conflict of interest or compromise the independence and effectiveness of the DPO's data protection duties.

As per Article 38, a DPO should not be influenced or directed by the organisation in any way regarding the execution of their tasks. Additionally, the GDPR protect DPOs against any kind of penalty or dismissal by the controller or processor for carrying out their tasks. This helps to ensure that the DPO can function in a safe and secure environment without any fear of repercussions.

Article 38 explicitly states that a DPO must report to the highest management level of the organisation. This reporting structure helps maintain the DPO's autonomy and allows them to freely communicate their findings, recommendations, and concerns related to data protection. It also facilitates efficient decision-making and prompt action on data protection matters.

A DPO should have access to all relevant information and be included in decision-making processes that impact data protection. A strong reporting structure and a positive relationship with senior management help the DPO to fulfil their obligations and ensure that privacy considerations are integrated into strategic decision-making processes.

Challenges and Best Practices for DPOs

DPOs face several challenges in fulfilling their role. Let us check some of them.

(i) Limited resources - One of the primary challenges is limited resources. DPOs often struggle to secure sufficient budget, staff, and technological tools to carry out their responsibilities effectively. This can hinder their ability to implement robust privacy practices and properly assess data processing activities.

(ii) Balancing compliance with business needs - This is another significant challenge for DPOs. They must find the right balance between ensuring data protection compliance and meeting the operational requirements and goals of the organisation. Striking this balance often involves working closely with various departments, such as legal and IT, to integrate privacy measures effectively.

(iii) Organisational culture - DPOs may encounter resistance or a lack of awareness regarding the importance of data protection within the organisation. Overcoming this challenge requires the DPO to raise awareness among stakeholders and promote a privacy culture throughout the organisation.

(iv) Evolving regulatory landscape - DPOs must stay updated on changes in data protection laws and regulations and ensure that compliance practices are implemented accordingly.

What are some best practices to overcome these challenges?

DPOs can follow best practices to overcome these challenges. DPOs should clearly communicate their needs to senior management. They should emphasise the importance of adequate staffing, training, and technology. Promoting a privacy culture within the organisation is equally important. This can be achieved through raising awareness, providing training sessions, and fostering a privacy-conscious mindset among employees.

Staying updated on all the regulations and collaborating with relevant stakeholders, such as legal and IT departments, allows DPOs to navigate the evolving regulatory landscape effectively. Conducting regular risk assessments helps identify potential vulnerabilities and prioritise mitigation efforts. DPOs should maintain detailed records of data protection activities and incidents. They should also provide regular reports to senior management and supervisory authorities to demonstrate accountability and transparency.

You might now be convinced of the importance of appointing a DPO for your organisation. However, creating a new DPO role in an organisation involves certain cost considerations. The global median salary of a DPO ranges from $100,000 to $200,000, which may be feasible for larger or mid-sized organisations with dedicated resources. However, for small firms with limited budgets, it can pose a challenge.

Fortunately, the GDPR recognises this reality and allows for an alternative solution. Organisations can opt to appoint an external DPO, either on a part-time or consultancy basis, to fulfil their data protection obligations. This allows smaller firms to access the expertise and guidance of a qualified DPO.

By outsourcing the DPO function, small organisations can benefit from the knowledge and experience of an external professional without the burden of a full-time salary and associated expenses. Hence, small organisations can comply with GDPR requirements and ensure data protection compliance without straining their financial resources.