Role of the Privacy Officer

After Amendment 13 to the Privacy Protection Law, many organizations understand that they need a privacy protection officer, or at least someone who understands the subject. But what does the officer actually do? Is it just a "stamp" on documents, or someone who works inside the organization all year? This article details and explains the main duties of the officer in a practical way.

The article is general and does not replace an assessment of your organization's needs. The text of the law and the guidelines of the Privacy Protection Authority are the binding source. Whether an organization must appoint an officer is covered in Who Must Appoint a DPO.

The core idea: someone who looks at data from the privacy angle

An organization handles personal data in every department: marketing, HR, customer service, IT. The officer looks at all of this from the point of view of privacy protection, makes sure someone is responsible, and advances the subject within the organization. You can read about our support in this area on the privacy protection officer page.

The detailed wording of the officer's duties and powers is set in the law and the Authority's guidelines; this article presents a general picture.

The main duties

1. Mapping the data

The first step is understanding what data the organization holds: where it comes from, what it contains, where it is stored, who accesses it and where it goes. Without mapping, no policy can be set, so the officer usually starts there and updates the map when something changes.

2. Policies and procedures

The officer helps draft and update the core documents: a privacy policy, an information security procedure, a procedure for handling requests from people who want to review or correct data held about them, and a procedure for handling a security incident. The documents should describe what the organization actually does, not a generic text copied from another organization.

3. Advice and training

The officer is the address for questions from management and staff: whether a certain data item may be collected, how to word a consent form, what to check before adopting a new tool or sending data to a supplier. The officer also trains employees, especially those who are exposed to personal data in their work.

4. Review before changes

When the organization plans a new system, a marketing campaign or a new use of data, the officer should review it in advance. It is easier to adjust a process at the planning stage than to fix it after launch.

5. Suppliers and third parties

Many organizations pass data to cloud providers, mailing systems, payroll companies and others. The officer checks what is transferred, what the supplier agreement says and which security measures the supplier applies.

6. Handling requests and security incidents

When a person asks the organization to review or correct their data, the officer helps make sure the request is handled properly. When a security incident occurs, the officer takes part in assessing its scope and deciding whether there is a reporting duty and to whom. The duties on this subject will be covered in a separate article.

7. Contact with the Authority and management

The officer is the organization's contact with the Privacy Protection Authority when needed, and reports to management on the state of compliance, gaps found and actions required.

What the officer does not do

• Does not replace management. Responsibility for compliance rests with the organization. The officer advises, checks and assists, but business decisions remain with the organization.
• Is not only an information security person. Information security matters, but privacy protection is wider and also asks which data is collected at all and why.
• Compliance is an ongoing process characterized by supervision and updating, not a document prepared once and left in a drawer.

What is needed for the role to be carried out effectively and optimally

• Professional knowledge. Familiarity with privacy law, including the GDPR, and with how the organization works.
• Authority and access to management. An officer with no access to decision makers cannot have influence.
• Time and resources. A role given "on top of everything else" usually stays 'on paper'.
• No conflict of interest. Whoever sets the purposes of data use in the organization, such as the marketing manager or the head of IT, is in effect auditing themselves. A comparison of internal and external officers will be covered in a separate article.

What a typical year looks like

An example for illustration only (the structure varies between organizations). At the start, mapping and a gap assessment are carried out. Then policies and procedures are updated and training is held. During the year, new tools and suppliers are reviewed and requests and incidents are handled, and at the end of the period the officer reports to management and updates the map.

Common mistakes

• Appointing an officer in name only, with no time or authority.
• Assuming that writing a privacy policy for the website is enough.
• Not involving the officer when planning new systems.
• Not documenting decisions and actions.

In summary

A privacy protection officer is a party that operates on an ongoing basis in the organization: mapping data, helping draft policy, advising and training, checking suppliers and changes, accompanying requests and incidents, and reporting to management. If you want to examine how the role is carried out in your organization, you can contact us. The information in this article is general and is not legal advice.