Outsourced DPO Consultancy

A Data Protection Officer will typically undertake several tasks including:

• Provide expert guidance on data protection and privacy
• Report to Top Management on data protection related matters
• Undertake data protection audits 
• Give advice on Data Protection Impact Assessments (DPIA)
• Participate in the response and handling of personal data breaches (and other non-compliances with data protection legislation)
• Assist with Data Subject Access Requests (DSAR) and SAR
• Provide privacy and data protection training to staff
• Monitor compliance with UK GDPR and other data protection regulations 
• Prepare data protection policies and procedures
• Be the contact point for liaison with data subjects and ICO
• Ensure adequate data protection records are maintained

A Data Protection Officer should have expert knowledge of data protection legislation. A good certification is the IAPP Certified Information Privacy Professional/Europe qualification (CIPP/E).  

There are several organisations offering professional data protection certification however the most popular (as used by many lawyers specialising in privacy) is the International Association for Privacy Professionals (IAPP).

A DSAR (also known as a Subject Access Request or Right of Access), is a right of individuals to access and receive a copy of their personal data held by an organisation, who is the data controller. Whenever a data controller receives a DSAR, they must respond by following the procedure set out in Article 12 GDPR. DSAR's can be made either verbally or in writing, including via social media and typically must be fulfilled within a month. 

An Appropriate Policy is a UK Data Protection Act 2018 (DPA 2018) compliance requirement for organisation’s that process special category and/or criminal offence data. See also ‘  What must be covered in an Appropriate Policy?  ‘ in this FAQ.

An Appropriate policy shows how the processing of special category and/or criminal offence data Is compliant with the requirements of GDPR Article 5. In particular, it should cover the retention policies for these data types.

As a takeaway, any organisation seeking DPA 2018 compliance, that processes employment or social security data, must have an appropriate policy document.

A Data Protection Impact Assessment (DPIA) is a type of risk assessment that helps organisation’s record and minimise the data protection risks to individuals, as a result of their planned processing operations.

DPIA’s must be completed in advance of the planned data processing.  For any processing likely to result in a high risk to individuals and cannot be reduced, you must consult the ICO before the processing is undertaken.

GDPR compliance signifies that an organisation falling under the jurisdiction of GDPR is obligated to adhere to the standards for appropriately managing personal data as defined by the law. The GDPR establishes specific responsibilities that organisations must abide by, imposing limitations on the use of personal data.

The ICO says ‘You must ensure that:

• the DPO is involved, closely and in a timely manner, in all data protection matters;
• the DPO reports to the highest management level of your organisation, ie board level;
• the DPO operates independently and is not dismissed or penalised for performing their tasks;
• you provide adequate resources (sufficient time, financial, infrastructure, and, where appropriate, staff) to enable the DPO to meet their UK GDPR obligations, and to maintain their expert level of knowledge;
• you give the DPO appropriate access to personal data and processing activities;
• you give the DPO appropriate access to other services within your organisation so that they can receive essential support, input or information;
• you seek the advice of your DPO when carrying out a DPIA; and
• you record the details of your DPO as part of your records of processing activities. ‘

Source:  UK ICO

UK GDPR requires organisation’s to appoint a Data Protection Officer if their core activities involve the large scale processing of special categories of data or data relating to criminal convictions and offences. This is particularly relevant for healthcare companies accessing and processing NHS patient data, as part of their service.

DPO’s must also be appointed if you are a public authority or your core activities require large scale, regular and systematic monitoring of individuals (e.g. online behaviour tracking)

ICO guidance recommends the following items should be described:

Description of personal data processed – give a brief description of the special category and / or criminal offence data involved.

Schedule 1 condition for processing – provide the name and paragraph number of your applicable Schedule 1 condition(s) for processing

Procedures for ensuring compliance with the DPA 2018 principles – describe how your organisation complies with the accountability principle, lawfulness, fairness and transparency principles, the purpose limitation principle, the data minimisation principle, the accuracy principle, the storage principle, and finally the integrity and confidentiality (security) principle.

Retention and erasure policies – how long will the personal data be retained for each category of together with details as to how will the data will be securely erased.

Next review date – when the policy will be re-assessed and signed off by senior management

It's important to note, that the Appropriate Policy must be retained for 6 months after the date your organisation stops processing the relevant data.