14 Cartoons About Data Protection Officer That'll Brighten Your Day

Learn concerning the DPO's role in managing organizational information defense and overseeing GDPR conformity in Data Protection 101, our series on the basics of details safety.
A Definition of Data Protection Officer

An information security policeman (DPO) is a business security management role needed by the General Data Protection Regulation (GDPR). Data security police officers are in charge of overseeing a company's information security strategy and its implementation to make certain conformity with GDPR needs. The video clip below provides a review of the role of a DPO, and also is from our webinar, A Practical Approach to GDPR: Featuring IDC's Duncan Brown.

Which Companies Need Data Protection Officers?

GDPR was presented by the European Parliament, the European Council, and also the European Commission to enhance and improve information security for European Union residents. It calls for the obligatory appointment of a DPO at every organization that refines or shops individual data for EU residents. DPOs have to be, "appointed for all public authorities, and also where the core activities of the controller or the cpu entail 'organized and also normal tracking of data subjects widespread' or where the entity carries out large-scale processing of 'unique groups of individual data,'" such as race, ethnicity, or religious ideas.

The language of GDPR shows that the size of an organization is not what necessitates the requirement for a DPO, but instead the size and also scope of information dealing with. GDPR does not particularly specify what they take into consideration to be "big range" data handling. There are four key factors that controling authorities are utilizing to establish if a DPO will certainly be needed.

The information protection officer is a mandatory role for all companies that collect or process EU people' personal information, under Article 37 of GDPR. DPOs are in charge of enlightening the firm and also its workers regarding conformity, training staff involved in information handling, as well as conducting regular safety and security audits. DPOs additionally work as the point of get in touch with between the business and any kind of Supervisory Authorities (SAs) that supervise tasks associated to data.

The GDPR does not include a details list of DPO credentials, however Article 37 does need an information defense officer to have "expert knowledge of data security law and methods." The guideline also defines that the DPO's competence should straighten with the organization's information processing procedures and the level of data security needed wherefore is processed by data controllers and also data processors.

DPOs may be a controller or processor's team member, and associated companies may make use of the exact same individual to supervise data security jointly, as long as the DPO is conveniently obtainable to anybody at those relevant organizations. It is required that the DPO's information is published publicly and also offered to all regulatory oversight agencies.

Information Protection Officers need to not have a dispute of rate of interest, suggesting that the DPO must not have any current duties or responsibilities that remain in conflict with their surveillance obligations. As an example, a legal advise who might represent the business in a legal case would certainly be taken into consideration to have a dispute of passion, and as a result would not be qualified to function as the DPO Companies that breach this need might be subject to penalties up to EU$ 10 million or 2 percent of the company's globally turnover, whichever is higher.

Ideal Practices for Hiring a DPO.

Since firms that manage the data of EU citizens go through GDPR also if they are not located in the EU, it is forecasted that tens of thousands of DPOs are required for all regulated companies to accomplish GDPR conformity.

An existing employee may be marked as the DPO, or the DPO can be hired externally. The appropriate DPO will certainly be both trustworthy and also independent, with no prior dedications that would certainly conflict with the tracking duties of the DPO role.

Ideally, check here a DPO needs to have excellent management abilities as well as be able to user interface conveniently with both internal team in all degrees as well as outside authorities. The ideal DPO will also make sure internal conformity as well as inform the authorities regarding circumstances of non-compliance, even if the company may be subjected to significant fines.


An information defense officer (DPO) is an enterprise security management function called for by the General Data Protection Regulation (GDPR). DPOs should be, "designated for all public authorities, and also where the core activities of the controller or the cpu involve 'regular and also organized monitoring of data subjects on a huge range' or where the entity carries out large handling of 'unique groups of individual information,'" such as race, ethnicity, or religious beliefs.

The finest DPOs will have proficiency in information defense law and also a full understanding of their business's IT facilities, modern technology, as well as technical as well as business structure. An existing worker might be marked as the DPO, or the DPO might be hired externally. The right DPO will be both independent and also trustworthy, with no prior dedications that would conflict with the tracking responsibilities of the DPO role.