Services
Outsourced DPO
Serving as your Privacy Protection Officer (DPO) from outside your organisation. The Privacy Protection Law allows the officer to be someone who is not your employee. One of our lawyers fills the role for you: answering questions, training staff, overseeing compliance and reporting to management, without you having to hire for it.
When you must appoint an officer
The Privacy Protection Law requires an officer in four situations. If one of them describes your business, the duty applies.
| # | Question | Why it is decisive |
|---|---|---|
| 1 | Do you hold a public body’s database? | The duty applies whatever the scale. Public bodies include government ministries, local authorities, HMOs and public hospitals. |
| 2 | Do you collect data to pass it to others, as a business or for payment — direct-mailing services included? | The duty applies where that is your main purpose and the database holds data on more than 10,000 people. |
| 3 | Is regular and systematic monitoring of people part of your core business? | The duty applies when the monitoring is at significant scale — a test with no numeric threshold. |
| 4 | Is processing specially sensitive data part of your core business? | The duty applies when it is done at significant scale. Sensitive data only about your own staff is not enough. |
What the officer does
The officer carries out the duties the law places on the role, and reports to management on what was done.
- Availability for day-to-day questions, and a documented annual training cycle
- A written control programme and a periodic report to management
- Your data security procedure and database definitions document exist, are current, and are approved on the record
- A published dedicated contact channel, and a documented request log
- A single point of contact with the Privacy Protection Authority
- A fresh look at the appointment duty and the security level whenever the business changes: growth, a new product, a new type of data
Your part: provide the officer with the conditions and resources for the role, make sure the officer is properly involved in every matter touching privacy law, and have the officer report directly to the CEO or to an employee reporting directly to the CEO.
Conflict of interest
The Privacy Protection Law bars the officer from holding an additional role that is liable to place the officer in a conflict of interest. Under the Privacy Protection Authority’s opinion, a conflict generally arises for your head of information systems and those reporting to that person, and may arise in roles such as marketing, customer or finance director, or CTO.
How it runs
The role starts with getting to know your organisation, and continues as ongoing support.
- Initial fit call
- A first discussion of the need, the scope of the role and priorities.
- Scope letter
- The scope of the role, timetable and terms of engagement, in writing, before work starts.
- Getting to know you
- Learning your databases, systems and existing documents, and conversations with the relevant people on your side.
- Control programme
- A written control programme, and a schedule for training and reporting to management.
- Ongoing support
- Availability for questions, controls according to the programme, and periodic reports to management.
- 1. Fit call
- 2. Scope letter
- 3. Getting to know you
- 4. Control programme
- 5. Ongoing support
Questions people ask
Can the officer be someone outside the company?
Yes. The Privacy Protection Law allows an officer who is not your employee. Under the Privacy Protection Authority's opinion, only an individual may be appointed, though the engagement may run through a company that employs him.
Can our CTO, CISO or head of IT be the officer?
Not where the role is liable to create a conflict of interest. Under the Privacy Protection Authority's opinion, the head of information systems (and those reporting to him) is conflicted as a rule, a CTO may be, and a CISO dual role needs a reasoned, documented case-by-case examination.