Who is responsible internally.
WHAT THE ROLE IS
A person responsible for advising on and monitoring compliance.
WHEN ONE IS REQUIRED
Where the law or regulation specifies, typically based on the nature and scale of processing.
WHY TO APPOINT ONE ANYWAY
Without a named person, nobody does it.
WHAT THE ROLE INVOLVES
Advising on obligations Monitoring compliance Being the contact point for individuals and the regulator Advising on impact assessments Training staff
WHAT INDEPENDENCE REQUIRES
The ability to raise concerns without penalty Reporting to senior management No conflict with other duties
WHAT CREATES A CONFLICT
Holding a role that decides the purposes of processing.
WHAT EXAMPLES LOOK LIKE
The head of marketing The head of technology, in some structures
WHAT TO DO IN A SMALL ORGANISATION
Appoint someone with capacity, and support them.
WHAT SUPPORT MEANS
Time Training Access to advice Authority to be heard
WHAT TO PUBLISH
A contact route for data protection matters.
WHY
Individuals and the regulator need one.
WHAT TO DOCUMENT
The appointment, and the reasoning if you concluded one was not required.
WHAT AN EXTERNAL OPTION PROVIDES
Expertise without a full-time role.
