If your organisation requires a Data Protection Officer (DPO) – whether mandatory or not – it may be beneficial to outsource this role, rather than appoint a DPO in-house. There are certain challenges and complications associated with having an internal DPO, and while this is an arrangement that works for some organisations, that won’t be the case for all. Therefore, being aware of these challenges can help your organisation to make a more informed decision as to which route to take.
The role of the Data Protection Officer
Under the UK GDPR, there is a duty for organisations to appoint a DPO, depending on the types of processing carried out, the size of the organisation, or if they are a public body/authority. The DPO plays an integral role in assisting their organisation in its GDPR compliance. They do this through advising on data protection obligations, providing advice regarding Data Protection Impact Assessments, and acting as the point of contact for data subjects and the Information Commissioner’s Office (ICO), amongst other things.
To properly carry out this role, the DPO must be independent, an expert in data protection, and adequately resourced. Additionally, they will need to report to the highest level of management. For a more detailed overview, you can visit the ICO’s website for more information on the various requirements of the Data Protection Officer.
Due to the varying criteria that a DPO must meet, it makes more sense for some organisations to opt for outsourcing this position. But why is this?
No conflict of interest
An internal DPO, even if subconsciously, may be biassed towards the company’s interests. This can lead to mistakes and taking risks with personal data.
An external DPO will always consider the data protection implications over the implications for the organisation. Yes, an internal DPO will naturally have a better understanding of how the business works, but the downside to that is that this knowledge is a result of building relationships within the organisation. An internal DPO who has established relationships within the organisation may not be willing to make decisions that could possibly hurt these if needed to fulfil their role.
Something else to bear in mind is that if the internal DPO also has another job role within the company, they may inadvertently prioritise the work of their other role and not their DPO functions. This would obviously cause issues regarding the fulfilment of the DPO role that wouldn’t arise if the role were outsourced.
An outsourced DPO may have more expertise
The requirement for a DPO to be an expert in data protection is also something to consider.
By implementing an existing employee into the role, there is the risk that they may not have the full knowledge to match an external DPO, who will have a massive range of data protection knowledge. Because they are experts in the industry who provide outsourced data protection services, you can be more confident that this individual has the appropriate skills and experience. As it is a legal requirement for the DPO to be an “expert”, this is essential.
Additionally, if the external DPO is working as part of a data protection services company, not only do you have the knowledge of that individual at your disposal, but also the wider company. The DPO will be able to discuss matters with their colleagues – also well versed in data protection – should they need any affirming advice or support.
In the same vein, due to outsourced DPOs performing a singular function within an organisation, they’re able to better stay abreast of developments like changing privacy laws. Here at DPAS, for example, our data protection experts are always up to date with current legislation and ongoing trends. It’s better to have a DPO who really has their ear to the ground in this way, which an outsourced DPO – with their subject matter expertise and industry focus – is more likely to have.
Your external DPO would be adequately resourced
To meet the requirement that a Data Protection Officer must be “adequately resourced”, an internal DPO will need the business or organisation to supply them with this. An external DPO, on the other hand, will already have these resources at their disposal. This convenience can save your organisation both time and money – which leads us into our next point.
It’s more cost effective to outsource your DPO
Another area where an external DPO may be the winner is the financial side.
To appoint an effective DPO internally, the organisation or business will need to implement a team around them and provide them with the full resources needed to fulfil the role, which can be a more costly route to go down than simply outsourcing the duties. Furthermore, when in-house DPOs report to the highest level of management, this often results in these roles demanding higher salaries. This could be difficult to manage for smaller organisations, making outsourcing a more appealing option.
Finding the right fit for your organisation
Taking into consideration the points covered above, and the requirements as set out by the ICO, it’s up to your organisation to decide whether an internal or external DPO is the best move. Once you’re aware of the benefits and drawbacks of either option, your organisation can make a more informed decision on which way to go.
How can DPAS help?
If your organisation requires the services of an external Data Protection Officer, at DPAS, we have an outsourced DPO service, which will provide you with a data protection expert with years of experience, a wealth of knowledge, and all the resources required to fulfil the role as needed.
Give us a call on 0203 3013384 or send us an email at info@dataprivacyadvisory.com – or fill in a contact form and we’ll get in touch with you.
