1. GDPR – The Role of the Data Protection Officer (DPO)
Dai Durbridge

2. This session Run through the role of the DPO
Time to answer some questions

3. Why all the fuss about GDPR?
Update to 1998 Data Protection Act
Creates DPO role
Refocus on stronger data security and privacy rules
Up to €20,000,000 fine
25 May 2018

4. Do we need a DPO?
Yes
GDPR requires a DPO to be appointed by public authorities and (currently) this includes state schools and academies

5. Was there a rumour schools won’t need a DPO?
There was indeed…

6. Do MATS need a DPO for each academyNo
MAT is a single legal entity so the requirement will be for one DPO per MAT
However, consider the team the DPO needs around them

7. What does the DPO role entail?
Articles 37 to 39
Monitor GDPR compliance and implementation and application of data protection policies
Inform/advise school and staff about GDPR obligations
Advise whether and how to carry out DPIA

8. What does the DPO role entail?
Cont…
Be the point of contact for the ICO
Train staff
Carry out internal data audits

9. What qualifications does a DPO need?
No precise credentials specified by the GDPR, but….
DPO must have expert knowledge of data protection law and practice
Training will be needed
Recognised accreditations likely in due course

10. What support should the school provide?
Active support of the DPO function by senior management
Sufficient time and resources for DPO to fulfil their duties
Communicate designation of DPO to all staff
Continuous training

11. What support should the school provide?
Cont…
Ensure DPO is involved in all data protection
DPO reports to SLT/governors/MAT Board
DPO operates independently
DPO can be contacted by data subjects

12. Who should be your DPO?
No need to employ new person or make it a sole role
Consider experience and knowledge of data protection law and practices
Can be a DPO for more than one school – but consider:
Organisation structure and size
Accessibility of the DPO from each establishment

13. What about potential conflict?
GDPR Working Party:
“As a rule of thumb, conflicting positions may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing.”  

14. How does this apply to my school?
Not about the title held but the role undertaken
First focus on the abilities of the candidate then address whether that person – because of the role they undertake – is conflicted
IT lead is best example

15. Can I outsource the DPO role?
Yes
Consider due diligence, cost, SLAs

16. Should I take the role if offered?
The million dollar question!

17. Talk to us
Please note
The information contained in these notes is based on the position at January It does, of course, only represent a summary of the subject matter covered and is not intended to be a substitute for detailed advice. If you would like to discuss any of the matters covered in further detail, our team would be happy to do so.
© Browne Jacobson LLP Browne Jacobson LLP is a limited liability partnership.
Dai Durbridge | |

18. GDPR – The Role of the Data Protection Officer (DPO)
Dai Durbridge 27 November 2017