DPO (data protection officer)
DPO · data protection officer · DPD · privacy officer · délégué à la protection des données
The person who makes sure an organisation complies with the GDPR, advises it and acts as the point of contact for the data protection authority and the people whose data is processed.
In practice
Appointing one is mandatory for public authorities and bodies, and for organisations whose core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data or criminal records data (GDPR, Article 37). The DPO can be an employee or an external provider, possibly shared, and in France the appointment is declared online to the CNIL, the French data protection authority. The DPO acts independently: they take no instructions on their tasks, cannot be penalised for performing them and report to the highest level of management (Article 38). They advise, but responsibility for compliance stays with the organisation.
Fictional case: a private clinic processing health data on a large scale must appoint a DPO. It chooses an external DPO shared with two other facilities in its group, who is consulted before every new processing activity and as soon as a data breach is suspected.
