External Privacy Officer

An organization required to appoint a privacy protection officer, or chooses to appoint one voluntarily, faces a practical question: appoint an employee from within? Or receive the service from an outside party? There is no single right answer for every organization. It depends on size, the type of data, existing knowledge and budget. This article presents the considerations worth weighing.

The article is general and does not replace an assessment of your organization's needs. The text of the law and the guidelines of the Privacy Protection Authority are the binding source, and that is also where the requirements for the officer's qualifications and manner of appointment are checked. Whether an organization must appoint an officer is covered in Who Must Appoint a DPO, and the duties themselves are explained in Role of the Privacy Officer.

Two ways to appoint an officer

• Internal officer. An employee of the organization, usually an existing one, who fills the role in addition to and alongside other duties or as a full-time role.
• External officer. A consultant, firm or company that provides the organization with officer services under an agreement, for a number of hours or on a fixed basis.

Even an organization that chooses an external officer remains responsible under the law. Appointing an outside party does not transfer responsibility from the organization to the service provider.

Considerations in choosing

1. Professional knowledge

Privacy law is complex and keeps changing. An existing employee may know the organization well but have less familiarity with the legal and technological side, while an external provider usually specializes in the field but needs time to get to know the organization. If you choose an internal officer, plan proper training. If you choose an external one, make sure the provider understands your type of activity.

2. Conflict of interest

This is one of the most important questions. Someone who decides in the organization why and how data is used, for example the marketing manager, the IT manager or the HR manager, may end up reviewing their own decisions. It is therefore important to check in advance whether the intended employee holds another role that may create a conflict of interest. An external officer should also be checked for conflicts, for example if they also supply the organization with technology or security services which they are supposed to review.

3. Independence and access to management

An officer without access to decision makers cannot have influence. In both routes it is important to set in advance whom they report to, how often, and what happens in a disagreement. Professional independence matters for an internal officer too, who may feel pressure when reviewing the decisions of their superiors.

4. Availability and familiarity with the organization

An internal employee is more available day to day, knows the people and processes, and can be an early partner in projects. An external officer is usually available for agreed hours, so it is worth defining response times in advance, especially during a security incident.

5. Cost

An internal employee involves additional salary cost and time taken from other duties. An external service is usually measured by hours or a fixed fee. There is no single correct figure, and the comparison should include the internal time spent supporting the external officer. Ask for a written proposal that sets out what is and is not included.

6. Continuity

When an employee leaves, the knowledge may leave with them. An external officer usually offers professional continuity, but here too make sure the documentation stays with the organization.

A short comparison

Consideration	Internal officer	External officer
Familiarity with the organization	High familiarity	Familiarity built over time
Knowledge of the field	Depends on training	Usually specialized
Conflict of interest	Needs careful checking	Needs checking, especially with additional services
Availability	Daily	By agreement
Cost	Salary and time	By scope or fixed fee

The table is general and does not replace an examination of the specific organization.

What to set in the agreement with an external officer

If you choose an outside provider, it is worth arranging this in writing:

• Scope of service. Which duties are included: data mapping, policies, training, supplier support, handling requests and incidents.
• Hours and response times. Especially during a security incident.
• Access to data and people in the organization. Who the contact person is, and which systems and documents the officer needs access to.
• Confidentiality. The officer will be exposed to sensitive information, so a commitment to confidentiality and security is required from them too.
• Conflict of interest. A written statement of other services provided to the organization.
• Responsibility and reporting to management. How often and in what format reports are received.
• Term and ending of the agreement. Including handing the documentation over to the organization at the end.

When an external officer usually fits

Examples for illustration only, not a rule:

• A small or medium organization with no employee who has the right knowledge, and no need for full-time daily work.
• An organization that wants an independent party that is not subordinate to the departments it reviews.
• An organization starting its preparation that wants to learn from someone who has supported other organizations.

When an internal officer usually fits

• A large organization with many databases and daily activity that touches privacy.
• An organization with an employee who has suitable knowledge, authority and time, and no role that creates a conflict of interest.
• An organization that wants the officer involved early in developing systems and products.

A combination is also possible: an internal officer supported by an external consultant for complex legal or technical issues. Here too it is important to define who is responsible for what.

Common mistakes

• Appointing whoever is free and available at the time, without checking knowledge and conflict of interest.
• Appointing an officer in name only, without time, authority and management support.
• Assuming that appointing an outside party relieves the organization of responsibility.
• Signing an agreement without defining what the service includes and the response times.
• Not documenting the decision and its reasoning.

In summary

Internal and external officers are both legitimate routes, each with advantages and disadvantages. The decision should rest on knowledge, conflict of interest, availability, cost and the scope of the organization's activity, and should be documented. If you are considering which route suits you, you can contact us for an initial review. The information in this article is general and is not legal advice.