Not every company must appoint a data protection officer (DPO). The requirement applies to organizations that process sensitive data on a large scale or systematically monitor people. Even when you are not required to appoint one, appointing a DPO helps organize your processes and reduces the risk of breaching GDPR requirements. Below, you will find practical information about what a DPO does, when you must appoint one, and how we can support you.
What does a data protection officer do?
A DPO is a person who assists a controller or processor on all matters relating to the protection of personal data.
The DPO’s responsibilities
- Advice and information: explains to the controller, processor and their staff what duties arise under data protection rules.
- Monitoring compliance: checks whether the organization follows the rules, conducts audits, organizes training and raises staff awareness.
- Data protection impact assessments (DPIAs): advises on impact assessments and monitors their implementation.
- Contact point for individuals: receives applications and requests from people whose data is processed and supports them in exercising their rights.
- Cooperation with the supervisory authority: acts as a contact point for Poland’s Personal Data Protection Office (UODO) on matters relating to processing.
DPO independence: what it means in practice
- The DPO must be involved in all matters concerning data protection in the company. That is the purpose of the role.
- The DPO must not receive instructions from the controller or processor on how to perform their duties.
- The DPO reports directly to the organization’s highest management level.
When is appointing a DPO mandatory?
Your company must appoint a DPO if at least one of the following conditions applies:
- Your core activities involve large-scale processing of sensitive data, such as health or biometric data.
- Your core activities involve regular and systematic monitoring of people on a large scale, including observing and profiling people online, including for behavioral advertising.
- Your organization is a public authority or body, except for courts acting in their judicial capacity.
Examples: when a DPO is mandatory
- A hospital processing large sets of patients’ sensitive data.
- A security company responsible for monitoring shopping centers and public spaces.
- A recruitment company that creates profiles of individuals.
Examples: when a DPO is not mandatory
- A local doctor processing patient data in an individual practice.
- A small law firm processing its clients’ data.
Why appoint a DPO even when you are not required to?
A DPO is responsible for ensuring that your organization applies GDPR requirements in its day-to-day work. This includes:
- ongoing support in interpreting data protection duties,
- a faster response to incidents and requests from people whose data you process,
- organizing data-processing processes before a review by UODO.
If you are not required to appoint a DPO but process customer, employee or contractor data, consider appointing one. This can reduce the risk of a breach and give you a contact point in the event of an inspection.
How we can help: an external DPO service
The rules allow an external individual or organization to perform the DPO role under a service agreement. You do not have to hire someone as an employee.
What you do not have to handle alone
Working with us means we take responsibility for the issues that usually prompt the most questions:
- How do you create company data-protection documentation and a protection system?
- What should you do if a customer objects to the processing of their data?
- How do you implement privacy by design and privacy by default?
- What should a record of processing activities contain?
- In a given relationship, are you the data controller or the processor?
- How do you prepare for a personal data protection audit?
- How should you respond when UODO announces an inspection?
If your organization already has a DPO
We can support your DPO by acting as:
- a deputy DPO, covering the role during an absence or periods of heavy workload,
- a member of the DPO team, supporting ongoing work and projects that require additional expertise.
What our offer includes
We take on the data protection officer role and provide support with personal data protection. The person performing this role has data-protection law knowledge and many years of practical experience.
We agree a fixed fee based on your organization’s business profile, size and the complexity of its data-processing activities.
Frequently asked questions
When must a company appoint a data protection officer? A DPO must be appointed when at least one of three conditions is met: your company’s core activities involve large-scale processing of sensitive data, such as health or biometric data; its core activities involve regular and systematic large-scale monitoring of people, including profiling and online observation for behavioral advertising; or your organization is a public authority or body. For example, a hospital processing large sets of patients’ data must appoint a DPO, while an individual medical practice does not.
What exactly does a data protection officer do in a company? A DPO advises the controller and staff on duties under data protection rules, monitors the organization’s compliance, conducts audits and training, and advises on data protection impact assessments (DPIAs). The DPO also serves as a contact point for both the people whose data the company processes and Poland’s Personal Data Protection Office (UODO).
Is it worth appointing a DPO if my company is not required to have one? If you process customer, employee or contractor data, yes, appointing a DPO is worthwhile. A DPO provides ongoing help interpreting requirements, helps you respond faster to incidents and individual requests, and can organize data-processing processes before a UODO inspection. This can reduce the risk of a breach and give you a contact point if an inspection takes place.
Can a data protection officer be external, or must the person be an employee? You do not have to hire a DPO as an employee. The rules expressly allow an external individual or organization to perform the role under a service agreement. This model works particularly well for companies that do not want to build the capability internally but need full support with personal data protection.
What does DPO independence mean in practice? A DPO must not receive instructions from the controller or processor on how to perform their duties. This is a condition of independence under the rules. The DPO must be involved in all company matters concerning data protection and report directly to the organization’s highest management level, rather than, for example, the head of IT or HR.
