Joint or external data protection officer

A common data protection officer

The Data Protection Act allows the government and business groups to co-operate with the data protection officers, and thus, for example, several municipalities can group together to co-operate with the data protection officers.

It is however made a condition that each establishment has easy access to it.

In addition, one data protection officer can be appointed for more than one administration, taking into account their administrative structure and size.

The same applies to the companies – adequate human resources, resources and access to the data protection officer must be ensured.

In view of the variety of tasks of the PPS, it is necessary to ensure that the PPS, with the assistance of a team if necessary, can perform this role even if he is appointed for more than one administration.

Outside Representative

The data protection officer can be either an employee of the controller/processor or an external expert.

This means that the data protection officer may be an external contractor, but in such cases his/her tasks must be clearly specified in a service contract with the person or institution/entity concerned.

When an external contractor is engaged in the work of a data protection officer, a team under the contractor's auspices may be engaged in the work of the data protection officer, but under the responsibility of a more specific "manager" to the customer.

In these cases it is important that each member of the team meets all the requirements that the Regulation requires of data protection officers.

In order to promote legal certainty, good organisation and to avoid conflicts of interest within the team, it is desirable that service contracts contain a clear definition of the tasks of the contractor (or his team) and that a specific person is identified as the main contact person with the responsible party.

The person designated also manages the project in question.