3 ms·

I'm very sure that you do not need to appoint a DPO unless you're over a certain size.

by IanCal 8y ago

seszett 8y ago
It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds personal profiles of people.
repolfx 8y ago
Can you back that up? This site claims otherwise: https://www.itgovernance.co.uk/data-protection-officer-dpo-under-the-gdpr https://www.itgovernance.co.uk/data-protection-officer-dpo-u... There is no exemption for small and medium-sized enterprises (SMEs), which has been reaffirmed by the Information Commissioner’s Office (ICO): "I've heard plenty of people talking about there being a DPO exemption for SMEs - this is absolutely not the case." Peter Brown, Senior Technology Officer, Information Commissioner's Office (ICO)
- pimterry 8y ago
  https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... is a good summary from the UK gov authority. It's not based on size, but it isn't applicable to most businesses anyway. You need a DPO if: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. Imo, those are all pretty reasonable cases where you should have somebody responsible managing your data privacy. DPOs are for people managing very private data, or profiling people at very large scales. For most businesses, DPOs aren't relevant.
chrismeller 8y ago
I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement that there be some EU-resident "responsible person" if your organization is not based in the EU that I'm fuzzy on the details of. Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.

I'm very sure that you do not need to appoint a DPO unless you're over a certain size.

by IanCal 8y ago

I'm very sure that you do not need to appoint a DPO unless you're over a certain size.

It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds personal profiles of people.

repolfx 8y ago

Can you back that up? This site claims otherwise: https://www.itgovernance.co.uk/data-protection-officer-dpo-under-the-gdpr https://www.itgovernance.co.uk/data-protection-officer-dpo-u... There is no exemption for small and medium-sized enterprises (SMEs), which has been reaffirmed by the Information Commissioner’s Office (ICO): "I've heard plenty of people talking about there being a DPO exemption for SMEs - this is absolutely not the case." Peter Brown, Senior Technology Officer, Information Commissioner's Office (ICO)

pimterry 8y ago
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... is a good summary from the UK gov authority. It's not based on size, but it isn't applicable to most businesses anyway. You need a DPO if: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. Imo, those are all pretty reasonable cases where you should have somebody responsible managing your data privacy. DPOs are for people managing very private data, or profiling people at very large scales. For most businesses, DPOs aren't relevant.

chrismeller 8y ago

I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement that there be some EU-resident "responsible person" if your organization is not based in the EU that I'm fuzzy on the details of. Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.