11 ms·
> No, but you are the de-facto DPO The GDPR requires that the DPO must be independent from the organisation, so you can't be 'your own DPO'. On the other hand
by fvdessen 8y ago
> No, but you are the de-facto DPO
The GDPR requires that the DPO must be independent from the organisation, so you can't be 'your own DPO'.
On the other hand the DPO is only required when sensitive or large quantities of data are concerned.
- jacquesm 8y agoYes, you can be if the business is small. Obviously there is a conflict of interest there but it is better to have a conflicted DPO than none at all. Even in a larger company the DPO would report to the CEO and then you'd be back where you started. The only way to really have a DPO independent of the organization is to have the DPO report to the board, and this is in fact done in places where that is warranted. Your literal reading of the law is right but your practical implementation will still have to fit the available maneuvering room and no DPA - one would hope - would insist on bankrupting half the SME's in their country.