Finding a qualified DPO is pretty critical because they are involved in every aspect of an organization’s data protection framework and require a wide variety of skills in addition to those required by the GDPR, such as expertise in data protection and information risk management.
Generally, there are two options to consider when choosing a DPO. You can hire someone full-time within your organization, or you can outsource a contractor. Either way, it is important to vet the DPO as they will be responsible for a wide range of activities.
That’s why we’ve put together this checklist to help you know what to look for when hiring a Data Protection Officer for your businesses.
🚀Jump directly to What to look for when choosing your DPO (based on GDPR requirements) →
Under the GDPR, the Data Protection Officer (DPO) helps the data controller or processor set up, apply and monitor a data protection strategy in line with legal requirements.
The DPO should also be knowledgeable about IT process management, data security, and other essential concerns related to handling personal and sensitive data.
The DPO’s job entails many responsibilities, including acting as the organization’s point of contact with supervisory agencies, educating workers on compliance obligations, and training personnel in charge of data processing.
Additionally, the DPO performs routine security audits and offers recommendations to encourage adherence to laws and industry standards.
The obligation to designate a DPO is laid down in Article 37 of the General Data Protection Regulation (GDPR). In general, this is a requirement that must be complied with by all companies for which the GDPR applies and that process a significant amount of personal data, regardless of whether it is done in the capacity of Data Controller or Data Processor.
GDPR requires the *designation of a DPO* in the following circumstances:
👉 Where there is large-scale regular and systematic monitoring of users (For example, processing with video surveillance systems);
👉 Where the processing is carried out by a public authority (except for courts or independent judicial authorities);
👉 Where the organization is performing complex operations with user data (in particular sensitive user data provided for in article 9 of the GDPR).
The appointment of a DPO is dependent not only on the actual number of employees but also on the nature of the data processing activity. If your organization does not fit into one of these categories, you are not required to appoint a DPO.
Credibility
Legal expertise
IT expertise
The ability to communicate clearly
Self-starter
Leadership skills
Global Expertise
📌 Credibility
Under the GDPR, your DPO is required to:
✅ be unbiased and avoid conflicts of interest.
DPOs shouldn’t act based on commissions from service providers, or the nature of this relationship will fall under the principle of conflict of interest.
This is important as it ensures that you’re getting the best advice in line with your business needs rather than personal interest.
✅ be devoted, whether they are in your organization full-time or as an outsourced contractor.
The DPO is only allowed one role within your organization. For instance, a DPO that oversees information security will conflict if its security risk assessments and mitigation strategies are assessed in the context of its DPO function. If you have outsourced your DPO, make sure they have the time to devote themselves to your organization.
🗣 The GDPR specifies that DPOs are allowed to fulfil other tasks as long as:
any such tasks and duties do not result in a conflict of interests.
UPDATE February 2023
The Court of Justice of the European Union has ruled that data protection officers are allowed to continue doing additional responsibilities as long as they do not create a conflict of interest.
📌 Legal expertise
Under the GDPR, your DPOs are required to:
✅ possess a level of skill in data protection law depending on the type of processing done.
This means that DPOs should be certified lawyers and informed of all privacy and associated laws in every country where their organization conducts business or outsources activities.
🗣 The GDPR specifies:
“a person with expert knowledge of data protection law and practices” to assist the controller or processor, and be “bound by secrecy or confidentiality,” and “perform their duties and tasks in an independent manner.”
📌 IT expertise
Under the GDPR, your DPO is required to:
✅ provide guidance on risk assessments, countermeasures, and data protection effect analyses;
✅ have substantial hands-on expertise in privacy assessments, privacy certifications/seals;
✅ have information security standards certifications; and
✅ have substantial knowledge of privacy, security risk assessment, and best practice mitigation.
These abilities should be based on broad IS audits, IT infrastructure, and programming expertise.
📌 Leadership expertise
Under the GDPR, your DPO is required to:
✅ possess leadership and project management skills to be able to solicit, organize, and direct the resources required for their responsibilities;
✅ critically evaluate their knowledge to identify any gaps, then ask for training in those areas; and
✅ possess a broad range of business knowledge and be sufficiently familiar with the data controller and processor industries to comprehend how privacy should be handled so as to seamlessly fit in with how each company develops, markets, and generates money from its products and services.
🗣 The GDPR specifies:
The controller and processor shall support the DPO … by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
📌 Self-starter
Under the GDPR, your DPO is required to:
✅ be self-starters who have the knowledge and abilities to perform the duties assigned to them without supervision and the ability to locate the information they need;
✅ possess board-level presence and the ability to communicate with seasoned corporate professionals who may not be familiar with DPO duties.
🗣 The GDPR specifies:
The controller and processor shall ensure that the DPO does not receive any instructions regarding the exercise of those tasks … The DPO shall directly report to the highest management level of the controller or the processor.
📌 The ability to communicate clearly
Under the GDPR, your DPO is required to:
✅ handle requests and grievances from data subjects in clear terms, not legalese or technical talk.
✅ have skills in both legal training and awareness raising to make sure that all data subjects are aware of their rights and obligations and to aid in training others to help data subjects with specific requests
🗣 The GDPR specifies that data subjects are allowed to contact the DPO:
with regard to all issues related to the processing of their personal data and to the exercise of their rights.
📌 Global expertise
Your DPO is required to:
✅ engage with processors and controllers from many cultures and countries;
✅ manage various ways of thinking and doing business and possess the adaptability to direct these variations toward a good conclusion.
Ultimately the decision to choose a qualified DPO with these required skills lies with each organization.