GDPR Data Protection Officer Appointment Letter

Appointing a Data Protection Officer (DPO) is one of the more vague and confusing conundrums presented by the European Union's General Data Protection Regulation (GDPR).

If you've been putting off the chore of hiring a DPO, or if you're still not sure whether or not your company needs one, now is the time to take action. Supervisory authorities in the EU have recently begun doling out fines for GDPR infringement, and some of the monetary amounts are staggering.

Don't be caught on the wrong side of an infringement suit. If your business needs a DPO, you'll want to appoint one as soon as possible and record the appointment in writing. By keeping a GDPR Appointment of Data Protection Officer Letter on record, you'll be ready if the supervisory authorities come knocking. Continue reading for more on GDPR requirements for Data Protection Officers and the appointment letter that you'll need to have on file.

What Exactly is a Data Protection Officer?

As defined by the GDPR, a Data Protection Officer is a leadership role whose main responsibility is to ensure that consumer data is protected and processed in a way that is considered lawful under the GDPR and other applicable legislation.

In fact, the GDPR even lists the minimum responsibilities of a DPO in Article 39:

To summarize, the DPO shall have the following responsibilities:

• To inform and advise the data controller and data processors, as well as their employees, of their responsibilities in complying with the GDPR and other applicable regulations.
• To monitor compliance with privacy regulations and company data protection policies; to assign responsibilities to others regarding data protection; to perform data protection awareness training of staff; and to carry out data protection audits
• To provide advice in regard to Data Protection Impact Assessments (DPIAs) and monitor their execution.
• To cooperate with EU supervisory authorities when necessary.
• To act as the point-of-contact between the company and EU supervisory authorities, especially when it comes to the required consultations regarding high-risk data processing activities.

When is a GDPR Data Protection Officer Required?

This is where the GDPR gets a bit vague. In Article 37, the GDPR lays out the requirements to appoint a DPO as follows.

The appointment of a Data Protection Officer will be obligatory if:

• The data processing is being carried out by a public authority, such as a public school or government department.
• The main business activities of the company involve regular and systematic monitoring of data subjects on a large scale, such as tracking the website activities of thousands of online users in order to better serve them marketing campaigns.
• The main business activities of the company involve processing special categories of data (as defined by the GDPR) or the criminal history of data subjects, such as a job board that collects information about race or criminal background from applicants.

Do any of these requirements apply to your business? If so, it's time to appoint a Data Protection Officer.

If you're not quite sure, however, you're not alone. The ambiguity of these requirements has been the subject of many discussions and debates. For example, there is no ready definition for "a large scale" of systematic monitoring.

If you're not sure, confer with a data protection consultant or privacy law expert. In general, when it comes to the GDPR, it's always better to choose too many data protection measures rather than too few. If you decide not to appoint a DPO, be sure to document how and why you came to that decision.

More GDPR Suggestions on Data Protection Officers

The GDPR lays out a bit more guidance on the appointment of DPOs, including the following:

• The contact details of the DPO must be listed in your public Privacy Policy and communicated to your lead supervisory authority in the EU.
• If the DPO performs a DPIA and determines that a proposed data processing project will present a high risk to data protection or consumer privacy, the DPO must consult with an EU supervisory authority before the project may be executed.
• If feasible for all parties, several different companies may share the same DPO.
• The DPO position may be fulfilled by an internal or existing employee, or it can be filled as an external contract position.
• The DPO should be involved in all aspects of data protection and privacy.
• The data controller or processor must provide the DPO with the resources and access needed to fulfill all of the required responsibilities.
• The DPO must be allowed to fulfill the required tasks of the position without instruction or interference from management. He/she cannot be penalized for performing those tasks and must report directly to the highest level of management.
• Data subjects will be allowed to contact the DPO directly with any questions or concerns regarding the processing of their data or to exercise their consumer rights as EU residents.
• The DPO will be bound by the secrecy and confidentiality necessary to the position.
• The DPO may perform other duties as long as they do not interfere with data protection responsibilities.

GDPR Appointment of Data Protection Officer Letter

Once you have made the decision to appoint a Data Protection Officer and found the best candidate, you will need to draft a GDPR Appointment of Data Protection Officer Letter to use as a record of the appointment.

The letter should include the following:

• Name and contact details of the new DPO
• Name of the hiring company
• A general description of responsibilities as described in the GDPR
• Any other responsibilities assigned by the company
• Confirmation that the DPO functions independently without instruction or interference from management
• Name of the direct supervisor
• Signatures of both the supervisor and the DPO

Here are a few examples of how sections of the appointment letter might look:

The letter should begin as any other business letter, with the name and contact details of the recipient (in this case, the DPO). In an appointment letter, it is ideal to include a title or heading that announces the purpose of the letter, as shown above.

The opening paragraph should further detail the purpose of the letter - to appoint a new DPO - and specifically mention the name of the company as well.

In this example, the opening paragraph also names the direct supervisor that the DPO reports to:

Next, describe the basic responsibilities of the DPO. It may also be beneficial to name the corresponding article of the GDPR (Article 39):

Finally, confirm that the DPO will function independently without supervision from management. It may also be appropriate to mention some of the other GDPR requirements for DPOs, such as management's provision of the necessary resources and access, as well as the DPO's responsibility to communicate and consult with supervisory authorities:

The letter should conclude with the necessary date and signatures required to make the appointment official:

Once it is signed and dated, the Appointment of DPO Letter should be filed away as an official record of your company's appointment of the DPO. This may come in handy if EU supervisory authorities ever require proof of the company's compliance to GDPR stipulations.