SHOULD I OUTSOURCE OUR DATA PROTECTION OFFICER ROLE?

Every business that processes personal data as part of its core business operations should assess their requirement to appoint a DPO. Many will find that they fall into the net, while others will not but may still find that their customers are increasingly requiring them to provide this level of assurance. Whether it’s a business decision or a compliance requirement, DPO's are in increasing demand.

Think of the DPO as an accountant for your data processing activities. No business would operate without an accountant looking after their financial compliance and their financial health. So too, no business should operate without a DPO if the business depends on the ability to process personal data for its continued existence and profitability.

For many businesses, an in-house DPO is simply not the most effective or financially viable solution. Outsourcing the DPO role could be the easiest and most efficient way to ensure that your business is operating in compliance with the GDPR.

WHO CAN BE A DPO?

At Fort Privacy we think the DPO is a new generation of superhero!

The DPO is required to have the correct qualifications including expertise in national and European data protection laws, in depth understanding of  business practices and knowledge of both data security and data protection needs of the organisation. This is a big ask of any individual and in our experience these superheroes are few and far between.

It is rare to find a DPO who can meet all of these requirements, and this makes it even more difficult to appoint an expert who can manage this role. A DPO must be able to draw on the expertise of others to facilitate their role.  An experienced team that can work together on privacy and data protection is the ideal scenario.

CAN I OUTSOURCE THE ROLE?

It is possible to appoint a DPO to work from within your existing team and to provide extra training and remuneration for this role. This could also involve taking on a new member of staff or appointing internally and could work for your business if you want a permanent member of staff on hand with substantial knowledge of your business.

There are some drawbacks:

• The role of a DPO does require a certain level of independence, and this can be complicated by close working proximity with others in the company.
• You must watch out for conflicts of interest in particular where the DPO is holding down a second “day-job”. For example, where an IT manager, HR manager or even your compliance manager is made responsible for the DPO role alongside their existing workload, this may compromise the independence of the role.
• The DPO role will require ongoing training and investment, and this may be problematic when staff turnover is high, or job roles are combined.

The biggest risk of all? We often see DPO's appointed in-house without being given the authority and autonomy to carry out the role effectively. A DPO in name only is a very risky proposition for a company.

Outsourcing your DPO role is an innovative way to solve the problems above and offers an opportunity to benefit from all of the expertise of a team of professional DPO's without compromising your existing workforce.

WHEN IS OUTSOURCING A GOOD IDEA?

Outsourcing the DPO role is generally not an option for large enterprises who have to deal with complex, multinational data protection legislation mixed with other regulatory demands. These enterprises need a team of DPO's and prescient companies build a multidisciplinary team to meet the varied demands of the role.

There are many organisations where outsourcing the role will work very well. Imagine the DPO as an accountant for your data processing activities. Outsourcing some or all of your financial accounting activities is commonplace – because it makes economic sense AND you get to sleep at night. 

Similarly, outsourcing will work if you need a DPO in any of the following circumstances:

• You may only need a part-time DPO
• You can’t appoint in-house without a conflict of interest with existing duties
• You can’t afford to invest in the right level of expertise
• You could invest in someone for the role who could leave and take your investment with them
• You need experts to take the role for a year or two to create a solid compliance foundation for the organisation going forward

WHAT SHOULD I CONSIDER?

Just like outsourcing your financial activities, outsourcing your DPO role only works when you outsource to the right team.

You need to ensure that the service can meet all your compliance requirements. Does the team have the right level of expertise? Can they understand your business? Have they got the skills to deliver all the requirements of the role? Can they deliver on an SLA?

At Fort Privacy we believe that the key to a good ODPO service is a multidisciplinary approach to data protection. Not all clients are the same, so we work to a 5-stage Fort Privacy-developed maturity model. This is to ensure we deliver appropriate solutions tailored both to the client’s needs and their current level of maturity.

WHAT ARE THE BENEFITS?

Multidisciplinary team — The team you choose is key, and the importance of multi-disciplinary experts cannot be overestimated.

Fort Privacy has a team of fully-qualified DPO's with backgrounds in Law, Risk & Compliance, ICT, Security and Operations - all of which are necessary to deliver a successful privacy programme. 

Save money — When you hire in-house you will often need to supplement DPO skills anyway.

By outsourcing the role to us, you can take advantage of a dedicated team that can meet all your privacy and data protection needs – and usually for less than the cost of appointing a dedicated DPO in-house.

DPO independence — Independence is key and difficult to achieve in-house.

When you outsource your DPO function, it becomes demonstrably easier to be accountable for the independence of your DPO. As an external partner, we can assure you the balance and independent input that is needed to monitor and facilitate compliance within your business.

Capacity — For when you need to scale your privacy resources to respond to incidents. Outsourcing means that you can immediately increase your privacy resources as required to respond to events as they unfold. This means that your teams and resources will not be disrupted or compromised and can continue to be focused on their roles.

Experience multiplier — Your in-house DPO only has experience of your business.

As an ODPO service provider, Fort Privacy has been involved in delivering data privacy programmes on the ground for many organisations over the years. We have built up a body of knowledge that will be invaluable to your business and enable you to hit the ground running with your compliance programmes.

Continuity — Avoiding turnover issues and delivering consistency.

You can rely on Fort Privacy to consistently oversee and maintain your compliance and privacy needs, regardless of changes within your organisation. We will work with you to respond to your changing needs, both on and off site, and our specialists will build a positive and beneficial relationship with your business as a critical part of your team.

And the Bonus benefit?

Many of our clients find that the discipline of a structured privacy programme delivers unanticipated improvements across their business. Some of our clients use their privacy programme as a catalyst for positive change within the business. Hiring from outside brings fresh ideas and a fresh approach as well as years of outside experience into your team. That’s an unexpected bonus for many of our clients!

HOW CAN WE HELP YOU?

At Fort Privacy, we can help run or augment your privacy compliance programmes with our Outsourced Data Protection Officer service.

We use our experience to ensure that you receive the most up to date information, documents and advice to enable compliant data processing.

Our DPO's are ACOI certified CDPO's and have significant experience on the ground, driving data protection compliance programmes within businesses.