DPO Services

A DPO’s role includes the review and on-going monitoring of compliance with the data protection legislation.

This typically means that the DPO will complete an annual audit of the organisations compliance and develop and maintain a Privacy by Design Plan.

As part of the compliance monitoring activities the DPO will review how Privacy by Design is implemented into the organisations operational processes and procedures.

This is a specific requirement under Article 25 and must be in place to be compliant.

The DPO should act as the central point of contact for any data breach that occurs within the organisation (assuming this involves personal data).

The DPO should have the experience needed to follow the legal and best practice methodology for managing incidents.  They will provide advice and guidance and ensure that the correct steps are taken to minimise risk.

Note – they will also be the point of contact with the associated Information Regulator (e.g. the UK’s Information Commissioners Office).

The DPO is required to keep an up-to-date record of the processing (ROPA) of the personal data that the organisation processes as a Data Controller and Data Processor.

The ROPA is a legal requirement under Article 30.

Data Subject Access Requests (DSARs) are commonly requested by individuals (i.e. the Data Subject) when exercising their rights under data protection legislation.

The DPO must ensure that the requests are appropriately managed in accordance with the legislative requirements.

A DPO should provide training to all staff on matters of both data protection and information security awareness.

There are specific legal requirements to train staff (under both Articles 5 and 32) so the DPO must ensure that this is in place and is fit for purpose.

Article 27 of the EU and UK GDPR requires that organisations provide a geographically located representative for citizens of the EU and UK.

UK Representative

This applies when an organisation is based in one region (i.e.the EU) and they process UK citizens data.

In this case the UK representative must have an office in the UK.

EU Representative

This applies when an organisation is based UK and they process EU citizens data.

In this case the EU representative must have an office in the EU.

Note – We have offices in both the UK and EU and can support this requirement.