Appointment of a Data Protection Officer in accordance with the GDPR

Why does a Data Protection Officer need to be appointed?

Corporate groups as well as many mid-sized companies are obligated to appoint a Data Protection Officer. This individual must possess technical and legal abilities, as well as economic, communicative, and educational competencies. They advise the management and train the employees in handling personal data. Moreover, they have to align the entire IT organization with a GDPR-compliant structure and control it.

In order for the Data Protection Officer to perform their duty carefully and competently, they need comprehensive and always up-to-date knowledge in most instances. They have to work out the legal basis for data protection. Even when an employee with IT skills is put in charge as a Data Protection Officer, expertise in Data Protection Management System, cyber security, cloud deployment, and secure data storage and encryption is often missing. To acquire the competence of an internal Data Protection Officer, your company must first invest money and time. Depending on the complexity, you might have to at least partly release the internal Data Protection Officer from their previous duties. In case of illness or vacation, you will need a deputy. And if the internal employee does a poor job fulfilling their duties, you will have to start again from the beginning.

When is a Data Protection Officer necessary?

The Federal Data Protection Act stipulates in §38 that every company must appoint a Data Protection Officer if more than 20 employees are regularly and permanently involved in the automated processing of personal data. Since almost all employees in administration work with a computer these days, most mid-sized companies have to appoint a Data Protection Officer (DPO). This person must be appointed in writing and communicated to the data protection authorities. If your company doesn’t have the expertise for an internal officer, you can mandate an external Data Protection Officer. As your service provider, this external Data Protection Officer takes care of all operational data protection requirements. Providers for external Data Protection Officers currently provide trained specialists who set up a legally compliant data protection organization in your company and monitor compliance. That’s why the appointment of an external Data Protection Officer as a service provider makes sense and, in many cases, is even necessary.

Here you can read more about the legal basis for data protection and how to organize it in compliance with the GDPR.

What tasks does an external Data Protection Officer cover?

The external Data Protection Officer needs an interdisciplinary and always up-to-date know-how, IT and legal competencies, as well as practical experience in creating a legal Data Protection Management System. Therefore, mid-sized companies often have a difficult time finding the required expertise in one of their employees. Furthermore, employees with leadership tasks may not be appointed to avoid a conflict of interests.

The external Data Protection Officer:

• Supports you and your company with the development, setup, implementation, and monitoring of a GDPR-compliant Data Protection Management System.
• Advises the management on how to establish audit-proof processes to minimize liability risks.
• Accompanies the IT department with the selection and implementation of their hardware and software, as well as the data protection-compliant data processing.
• Takes care of the timely information of authorities and other parties concerned in the case of data protection breaches.
• Regularly creates and reviews legally compliant data protection declarations.
• Designs guidelines for the handling of personal data.
• Fulfills reporting obligations.
• Supports with the processing of data subject requests such as information, correction, transfer, deletion, and objection requests.

What benefits does an external Data Protection Officer offer?

From the day of their appointment, an external Data Protection Officer brings their current and professional know-how to your company. They start with a systematic data protection inventory in your company, recording all data protection aspects regarding the procedures, documenting weaknesses, and deriving risk potentials. Based on this, they develop measures to minimize the risks, create task lists for the specialist departments, and plan the necessary resources for future data protection compliance. The biggest advantage is that they are neutral and unbiased. With their expertise, they overcome operational blindness and “silo thinking” in your specialist departments.

The most important benefits of an external Data Protection Officer for the establishment of a GDPR-compliant Data Protection Management System are:

• Legal expertise and many years of practice in data protection law.
• The expertise to implement legal requirements technically effectively.
• Consulting experience in many industries and mid-sized companies.
• Knowledge in dealing with supervisory authorities.
• Educational competences for staff training.
• Independent, neutral, and unbiased.
• Takes care of their own further education.
• Representative also available in case of illness and holiday, can be terminated at any time.
• Works at a fixed price and provides planning security for the budget.

Read more about setting up a GDPR-compliant Data Protection Management System and how to keep it up to date.

What does an external Data Protection Officer cost?

As external Data Protection Officers in Bavaria, the employees of Memex Consulting GmbH from Munich offer your company in-depth legal and technical know-how, as well as many years of experience in specialized IT consulting. The costs for an external Data Protection Officer depend on the effort and scope of the desired and required services. We value the close contact to our clients and develop our customized data protection strategies together with them. We develop user-friendly solutions that we also take responsibility for in the implementation. To determine the individual needs of our clients, we consider the size of the company, the number of sites and employees, the type and scope of processing of personal data, as well as the previous processes in your company. Based on our many years of consulting experience, we offer three service packages at a fixed price. We will be happy to adapt these to your individual needs.