Two years ago, our CEO, Vitorino Gouveia, attended “Conversas (In)Seguras”, an event organised by APDPO Portugal, where the moderators pose questions on current affairs and a wide range of subject areas. The moderators addressed the topic “The Organisation’s Responsibilities towards the DPO”. The following topics were discussed:
Appointment, Registration and Disclosure of the DPO
The organisation must appoint a DPO – whether internally or externally, and whether on a voluntary or mandatory basis – register them with the National Data Protection Commission (CNPD), and disclose the DPO’s contact details to its staff, customers and other stakeholders.
Ensuring the DPO’s Autonomy
The organisation must ensure the DPO’s independence from the organisational hierarchy, provide the DPO with the resources necessary to carry out their duties, allow the DPO to communicate directly with senior management, and ensure that the DPO is able to issue dissenting opinions.
Risk Management
The organisation must involve the DPO in risk management. This includes the data protection impact assessment (DPIA). It must also implement information security measures appropriate to the identified risks and report data breaches to the CNPD and the relevant data subjects.
Incident Management
The organisation must also involve the DPO in the management of information security and data protection incidents and notify the CNPD and the relevant data subjects in the event of a data breach.
What resources should be made available to the DPO
The organisation must provide organisational support, material resources such as email, a telephone and access to information systems, and ongoing training in data protection.
Data Protection Impact Assessment (DPIA)
Where the processing of personal data poses a high risk to data subjects’ rights, the organisation must carry out a DPIA and seek the DPO’s opinion on it.
By fulfilling its obligations towards the DPO, the organisation demonstrates its commitment to data protection and builds trust amongst its staff, customers and partners.