What exactly is a DPO?
Externalized DPO services
The Data Protection Officer, or DPO, is responsible for making sure that companies handle personal data properly and in compliance with the law.
What the GDPR requires
A DPO is mandatory if your core activities require regular and systematic monitoring of EU data subjects on a large scale, or if you process sensitive data on a large scale.
Appointing one is a good idea even when you are not legally required to.
Read our article on the requirements for a DPOA DPO is not a CPO.
What is a DPO
A DPO is not a Chief Privacy Officer or a Privacy Officer. Appointing a CPO is not, in most cases, required by law; appointing a DPO is a legal requirement in certain situations, and the role is set out with some precision in the law.
An industry norm
Although the function originates in Europe, the DPO has become an industry norm internationally.
Roles and responsibilities of a DPONot necessarily in the EU
The DPO does not have to be based in the EU, but must know EU data protection laws and practices, and communicate effectively with EU data subjects and the EU data protection authorities.
Why an EU-qualified privacy lawyerPrivacy laws are becoming more and more complex.
Why it matters
They are a mix of federal, state, provincial, national, sectoral and sometimes even regional laws. Take the EU as an example.
1 + 27
EU data protection law is the GDPR alongside the national legislation of the 27 EU Member States, some of it only available in foreign languages.
50+
areas of the law, the “national derogations”, that are not covered by the GDPR.
Read our article on the national derogations+ Directives
EU Directives set the baseline for their area of law and are read alongside in-country laws. If you collect data from residents of several Member States, you comply with the law of each and every one of them.
Why hire EU counsel
In the U.S. or Canada, externalized DPO services are typically provided by either …
Who provides DPO services
A
U.S. or Canadian law firms
With knowledge of U.S. or Canadian privacy laws, but no foreign legal qualification or practical experience as international privacy lawyers.
Why you need an EU- and UK-qualified privacy lawyerB
Software solutions providers
They help companies automate their privacy compliance, but they are rarely lawyers and would not give you a seal of legal compliance with privacy and data protection laws and regulations.
For organizations on both sides of the Atlantic.
Our enhanced DPO services
At The Transatlantic Lawyer, we provide externalized “enhanced” DPO services for organizations with activities and data processing operations in Europe and North America. Our legal qualifications in European and U.S./Canadian privacy and data protection law, and our many years acting as in-house and external DPO for companies with multinational operations, let us take a holistic approach to personal data protection.
We work closely with our clients so that their data processing complies with the applicable laws and regulations in both Europe and North America.
Our GDPR pageA comprehensive approach.
Our methodology
As lawyers admitted in both Europe and North America, we can serve as your externalized DPO in support of your international operations, with practical solutions tailored to your organization’s needs.
01
Data mapping
Identify and categorize all of the personal data your organization holds.
02
Risk analysis
Assess the risks in how that data is processed.
03
Compliance roadmap
Developed with you, tailored to the privacy laws that apply.
If needed
Audit
To fully evaluate your organization’s privacy posture.
We perform these tasks, as they apply to you.
As your DPO
- 01Inform and advise you about your obligations under the GDPR and other applicable data protection laws
- 02Inform you of any failures to comply, and of the remedial measures to take
- 03Recommend measures that let you demonstrate your processing is lawful, and reassess and update them
- 04Apply privacy by default and privacy by design in every project involving data processing
- 05Examine and monitor compliance with the GDPR and other applicable laws
- 06Monitor your data protection strategies, including responsibilities, awareness-raising and staff training
- 07On request, advise on data protection impact assessments (DPIAs) and transfer impact assessments (TIAs)
- 08Cooperate with EU supervisory authorities and other national data protection authorities
- 09Act as contact point for regulators, including prior consultation on DPIAs under Article 35 GDPR
- 10Maintain, or help maintain, your registers of processing activities
- 11Act as contact point for data subjects exercising their rights, and for their questions
- 12Report on our DPO activities every year
Some of our DPO service deliverables.
Deliverables
Data mapping
01 / 06
A detailed inventory of all the personal data your organization processes, including its sources, purposes and any third-party recipients.
By conducting a data mapping exercise, we can assess your compliance with the GDPR and other relevant data protection laws, and identify potential risks to individuals’ privacy and other fundamental rights. With this information, we can recommend measures to mitigate those risks, so that you process personal data in a manner that is lawful, fair and transparent.
Data mapping is a critical first step in developing a robust data protection strategy that meets all applicable legal standards.
Data processing activities
02 / 06
The register of data processing activities is a comprehensive record of all your data processing activities, including the purposes for which personal data is processed, the categories of data subjects and any third-party recipients of personal data.
The register lets us check your compliance with GDPR requirements, and gives individuals transparency about how their personal data is used. It also helps identify potential risks to individuals’ privacy and other fundamental rights, so we can recommend measures to mitigate them.
Keeping a register of personal data processing activities is an essential part of any data protection strategy, and is required by the GDPR.
Privacy notices
03 / 06
A GDPR-compliant external privacy policy identifies:
- What type of personal data you are collecting
- How it will be used and who it will be shared with
- The legal basis for processing the personal data, such as consent or legitimate interests
- Data subject rights, such as the right to access, rectify and erase their personal data
- How you will keep the personal data secure, and how long you will retain it
- Who to contact with any questions about personal information
GDPR-compliant internal policies cover a range of areas, including data protection, data retention, data subject rights, data breaches and privacy notices. With these policies in place, we help you consistently implement best practices for protecting personal data and comply with the GDPR’s high standards.
GDPR-compliant internal and external policies also demonstrate your organization’s commitment to data protection, and build trust with your customers, employees and partners.
Transfer Impact Assessments
04 / 06
A Transfer Impact Assessment (TIA) evaluates the potential risks of transferring EU or UK personal data to a country outside the European Economic Area.
A TIA is required before any EU or UK personal data is transferred to a country or organization that the European Commission does not consider to have an adequate level of data protection. It assesses the impact of the transfer on the rights and freedoms of data subjects, and identifies measures to mitigate any potential risks.
Privacy Impact Assessments
05 / 06
A DPIA must be conducted for processing activities that may result in a high risk to the rights and freedoms of individuals.
The DPIA is a tool to identify, assess and mitigate the data protection risks of processing activities.
The DPIA is a key part of your accountability obligations under the GDPR. Done properly, DPIAs help you assess and demonstrate how you comply with all your data protection obligations.
Read our article on DPIAsVendor management
06 / 06
Vendor management is a key element of compliance with the GDPR and other data protection laws: due diligence on potential suppliers, data protection requirements in contracts, and monitoring supplier compliance.
A robust vendor management program can help identify risks or gaps in suppliers’ data protection practices, and make sure you meet the requirements of the GDPR and other relevant data protection laws. It also helps protect the privacy and other fundamental rights of individuals throughout the supply chain.
Vendor management helps organizations build trust with their stakeholders, and demonstrates their commitment to protecting personal data.
Why sign Data Processing Agreements with your vendorsA proposal fitted to your business.
Our pricing structure
Our pricing keeps our DPO services affordable while letting us carry out the DPO mission thoroughly. When we draft a proposal for a DPO mission plan, we take into account:
- 01The complexity of your data processing activities
- 02The number of relevant jurisdictions
- 03The size of your company
“Our Enhanced DPO Services use the GDPR as a foundation. By using the strictest standard for privacy compliance, we can create a best-fit compliance roadmap.”
So our clients get deliverables that let them check the box of compliance in both Europe and North America.