FAQs

GDPR is a new EU General Data Protection Regulation which strengthen existing data protection laws and practices. The UK Government has confirmed that UK businesses need to comply.

The UK is currently still in the EU and must follow EU law. When the UK leaves the EU, it is anticipated that GDPR will effectively become part of UK law since the UK will have to comply with EU standards if it is to conduct business with EU members.

For many organisations outsourcing is likely to be more cost effective than employing a full-time or in house DPO. Additionally, many organisations do not have anyone with the required expert knowledge of UK and EU data protection law and practices who is sufficiently independent of decision making within the organisation. Avoiding such internal conflicts of interest is a significant requirement of GDPR.

Article 39 of GDPR lists the minimum tasks that should be fulfilled by the Data Protection Officer. The principal task is to monitor an organisation’s compliance with legislative and regulatory requirements. As such, the DPO is to inform and advise the Data Controller, Processor and Board on data protection matters including the protection of personal data, assignment of responsibilities, awareness raising and training of staff.

The DPO is not personally responsible for non-compliance under GDPR. The DPO is responsible for advising the data controller and processor on how to ensure that their organisations achieve compliance.

GDPR states that the following require a DPO:

1. Public authorities or bodies. These are defined as those organisations subject to the Freedom of Information Act in England and Wales and the Freedom of Information (Scotland) Act in Scotland.
2. Organisations whose core activities consist of processing special categories of data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) or data relating to criminal convictions or offences on a large scale, e.g. law firms and GP/dental practices.
3. If the core activities of the organisation require regular and systematic monitoring of data subjects on a large scale.

“Core activity” is activity that is inextricably part of the function of the organisation and is not a support activity. “Large scale” relates to the number/proportion/volume and/or different types of personal data. Even if they do not require to have a DPO, many other organisations that handle personal data will need to put policies and practices in place to ensure that they comply with the GDPR and an outsourced DPO service from RGDP can help them do this.

The DPO can be an internal appointment or shared jointly between organisations. However, there is a requirement for the DPO to be independent and so, to avoid conflicts of interest and / or when a full time DPO is not required, outsourcing the DPO function to an organisation such as RGDP is a cost effective option.

The DPO should report to the top level of management and have access to the Board to make recommendations.

Yes, if you are processing personal data of EU citizens and your Company requires a DPO in accordance with GDPR (Article 37).

Yes, if you have data subjects in the EU and/or as directed in GDPR (Article 3).