Re:GDPR: Removing Monal from the EU
by jacquesm on Thursday May 17, 2018 @06:18PM
(#17096571)
A designated DPO is a ROLE not a person, that's a huge difference. Just like a security officer in a small company is a role assigned to someone who most likely has other duties too in a large company it will be a dedicated person (and in a really large company there might even be more people working in a team under a CISO or something to that effect). So 'designated' means that the role has to be assigned to a person, it does not say 'dedicated' where you'd have to have a person whose exclusive job is DPO.
So, DPO is not necessarily a person with no other duties. In most smaller organizations that deal with sensitive data the DPO role will be shared with the CCO (Chief Compliance Officer), only at a certain scale of processing and with certain data would you need to budget for a dedicated DPO from day one, but presumably your business plan will also foresee in other things such as office space, computers and so on. Certain businesses come with implied costs.
So, DPO is not necessarily a person with no other duties. In most smaller organizations that deal with sensitive data the DPO role will be shared with the CCO (Chief Compliance Officer), only at a certain scale of processing and with certain data would you need to budget for a dedicated DPO from day one, but presumably your business plan will also foresee in other things such as office space, computers and so on. Certain businesses come with implied costs.