Data Protection Officer

When should a Data Protection Officer (or DPO) be appointed?

1. The controller and the processor shall designate a data protection officer in any case where:

(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 of the GDPR and personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.

The processing of personal data is not considered to be extensive if the processing concerns the personal data of the patients of a particular specialist, healthcare professional or the clients of a particular lawyer. Regular, systematic and large-scale monitoring should mean not only surveillance in the ordinary sense of the word, such as camera surveillance, but also logging activities that record user behavior in great detail. There is also a need for a Data Protection Officer when the main activity of the controller or processor is to process a large number of special categories of personal data or criminal personal data.
We receive many inquiries to ask us for assistance in performing our duties as a Data Protection Officer (DPO). As a first step, we always look at whether that organization needs a data protection officer at all. If we think we don’t, we tend to tell our customers that too, because our general business policy is that we don’t want to provide a service, sell it to organizations that don’t need us. Not all data controllers or data processors have to appoint a data protection officer, this is a misconception.
If we see that those who turn to us need to appoint a data protection officer, then we will develop our organization-specific cooperation proposal.

What are the responsibilities of the DPO?

Viewed from above, in our view, the Data Protection Officer (DPO) has three main functions, control, advisory and enforcement. We will expand the consulting function with the solution delivery function because we will not only tell you what the data controller should do to ensure continued compliance, but we will also give the solution to any gaps identified.

Let’s see the above functions in detail:

1. Control activity

continuously review the adequacy of GDPR compliant documents;
follow changes in legislation;
we examine the reclassification, registration and documentation background of the legal bases of data management;
control the existence and results of balance tests in the case of using a legitimate interest legal basis;
check the elements of the data management register;
verify compliance with the GDPR’s and the controller’s or data processor’s internal rules on the protection of personal data, including the assignment of responsibilities, the training of staff involved in data management operations, and related audits as they arise, with knowledge of control and compliance;

2. Advisory and solution delivery function

in case of discovered documentation and practical non-compliance, we ensure the elimination of the deficiencies and the correction of errors by determining the sufficient time spent and providing the necessary time by the data controller,
using the experience gained in more than 15 years of adult education, we take care of the data protection and data security training of the employees, and increase the data protection awareness necessary for the performance of their work;
ensure that the records required by the GDPR are kept;
before introducing new data management operations, we examine the interests of the data controller and the data subject, we consult with the relevant employees of the data controller

3. Legal protection function

we professionally support the enforcement of the rights of data subjects, in particular the provision of data portability, the right to information, the right to be forgotten, right to erasure etc. by the data controller;
cooperate with the supervisory authority;
we serve as a contact person for the supervisory authority in matters related to data management and, if necessary, we consult with the supervisory authority on any other issues;
perform the tasks set out in the legislation and data protection regulations concerning the reporting and information of the data protection incident

We have a wide range of experience as data protection officers in several organizations, so we consider it important to emphasize that the role of a data protection officer (DPO) is, of course, much more diverse and detailed in everyday life than the list below. Every organization is different, and the tasks are made even more colorful by sector-specific legislation.

Why is this good for you?

If you do not have a suitable employee for this position, you do not have to provide this task with the right professionalism in-house, we will take it over in full. You will receive an outsourced expert who will perform this position fully in the field of data protection and data security.

REQUEST AN OFFER