Interested in finding out more?

GDPR: Do you really need a Data Protection Officer?

As companies work to meet the 25th May 2018 deadline for GDPR compliance, they are finding that there is a market shortage of individuals trained to handle the DPO’s responsibilities.

Outsourcing the DPO function will help your organisation address the compliance demands of the GDPR while staying focused on your core business activities.

For more information on how Northdoor can solve your DPO challenge, read our service outline below.

Outsourced DPO Service Outline

With this annual subscription service, you will be assigned a DPO who will serve as an independent data protection expert to your organisation as set out under the GDPR.

What is Northdoor “DPO as a Service” (GDPR)

Northdoor can provide the following services:

  • Outlining a GDPR compliance programme based on findings from the GDPR Rapid Response program report (a prerequisite for the DPO service is a GDPR Rapid Response program).
  • Advising on data protection and information security matters pertaining to the GDPR.
  • Reviewing and advising on privacy policies, procedures and documentation.
  • Monitoring the collation of records of personal data processing operations.
  • Informing the training of staff involved in data processing operations.
  • Advising on data protection impact assessment (DPIA), their implementation and their outcomes.
  • Serving as the contact point for data protection authorities for all data protection issues.
  • Data breach management and reporting.
  • Serving as the contact point for data subjects on privacy matters, including subject access requests.
How to tell if you need a Data Protection Officer

GDPR sets out just three cases in which you must appoint a DPO; does your business fall into these categories?

1. Your organisation is a public authority or body
In the UK, all government departments, agencies and other public bodies must appoint a DPO. This includes local councils: 15% of which have yet to appoint a DPO (ICO, March 2017).

2. Your core business activity is monitoring individuals regularly and systematically on a large scale
Surprisingly, this can include paying employees, providing standard IT support, email remarketing and location tracking through apps.

3. Your core business activity consists of processing large-scale special categories of personal data or data relating to criminal offences
GDPR defines ‘special categories of personal data’ as ethnic origin, political opinions, religious beliefs, physical and mental health (among others). If you process this type of data on a large scale, including data relating to criminal offences, you must appoint a DPO.

Contact us to discuss our GDPR DPO Managed Services

Fast Access to DPO Skills 

Under the new GDPR legislation, organisations in the following three categories must appoint a Data Protection Officer (DPO):

1.  Public authorities, including local councils

2.  Businesses systematically monitoring large numbers of people (this can include things like payroll, IT support, email marketing and location-tracking)

3.  Businesses processing sensitive personal data (related to ethic origin, political opinions, mental and physical health, and so on).

Find out more