3 ms·
> I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR. Is there any actual requirement within the GDPR
by avar 8y ago
> I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR.
Is there any actual requirement within the GDPR that this needs to be a dedicated person, or does being a DPO just need to be someone's responsibility, e.g. in the case of a one-man open source project the guy who runs the project?
- jimnotgym 8y agoNo there is no requirement for most bodies at all. Please see my other comments on this discussion. A person at my company is called the DPO, but that is far from their main role in the business
- ucaetano 8y agohttps://gdpr-info.eu/art-38-gdpr/ https://gdpr-info.eu/art-38-gdpr/ > The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. I guess you could say that it is literally impossible for the DPO to not have conflicts of interest if the DPO is also the owner and manager of the company. More: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... > The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level.
- unilynx 8y agoWell, if you're owner and manager, I think you've got the independence, adequately resourced and reporting about right. If you're a sole proprietor and managing data at volume and sensitivity levels that a DPO is required, I hope you're an expert at protecting that data..