What is a Data Protection Officer (DPO)? | UK GDPR Advanced Training | iHASCO

A Data Protection Officer, or DPO, is somebody appointed by an organisation to help them monitor GDPR compliance and help them stay on track; to inform and advise them on their responsibilities; to help complete and manage their record-keeping obligations; and to act as a point of contact for both the ICO and individual data subjects.

This video is taken from our UK GDPR Advanced Training, this course gives an in-depth look into the GDPR and provides users with a background of the GDPR, covers the principles of the GDPR, individual rights and some scenario-based learning.

Get started with your free no-obligation trial today...
https://www.ihasco.co.uk/courses/deta...

-------------------------------------------------------------------------------------------------------------------
VIDEO TRANSCRIPT:

Sometimes we can all use a little help from our friends, but under the GDPR, it’s a legal requirement. A Data Protection Officer, or DPO, is somebody appointed by an organisation to help them monitor GDPR compliance and help them stay on track; to inform and advise them on their responsibilities; to help complete and manage their record keeping obligations; and to act as a point of contact for both the ICO and individual data subjects.

However, you only need a DPO if:

• You’re a public authority or a public body
• Your core activities require large scale, regular, and systematic monitoring of individuals, or
• Your core activities consist of large scale processing of special category data or criminal conviction data

OK, that was a bit wordy. Let’s unpack it a little.

Firstly, a “public authority” includes - but isn’t limited to - any government departments at both a local and a national level, legislative bodies, the armed forces, NHS services, state run schools, the police force, and so on. Basically, if you’re already considered a public authority under the Freedom of Information Act, then you’ll still be considered a public authority under the GDPR.

Secondly, what are core activities? Simply put, this is any processing which helps your organisation achieve its goals or business objectives. So, if systematically monitoring people is central to your organisation’s success, then you’ll most likely need a DPO. But if you systematically monitor people using CCTV for security reasons only, for example, then this isn't a core activity and you won’t need a DPO - at least not for that reason.

Lastly, just how large is “large-scale”? This really comes down to your ability to justify yourself. If you think that you can reasonably argue that your processing is small-scale, then you won’t need a DPO. When making your decision, consider the amount of data you’re using, the number of individuals you take it from, the sensitivity of the data, and how long you’ll be using it for. But bear in mind, the scale of your processing only matters if it’s a core activity. So, for example, the HR department of a large financial business will process the data of thousands of employees. They’d be hard-pressed calling that “small-scale” but since HR is a secondary function rather than a core process in this instance, they won’t need a DPO for that reason.