Role, tasks and responsibilities of the data protection officer
Role of the Data Protection Supervisor in assessing the impact on data protection and the preparation of a data processing record
Advice when performing an DPIA (Data Protection Impact Assessment)
Regarding the assessment of the impact on the protection of personal data, the controller and the processor shall seek advice from the data protection officer, including on the following aspects:
whether to carry out a DPIA,
the method to be used for the evaluation,
whether the evaluation should be carried out internally or whether the project should be outsourced;
the technical and organisational security measures needed to reduce the risk to the rights and freedoms of the data subjects;
whether the assessment was carried out properly and whether its conclusion (to initiate the processing in question and the security measures to be applied) is in accordance with the requirements for personal protection.
Advice regarding the processing file
As for the list of processing activities, it is the controller or the processor, but not the data protection officer, who is responsible for maintaining such a list.
They may however entrust the data protection officer with the responsibility of maintaining such a record. Such a record is considered as one of the tools that the data protection officer has to carry out his work in monitoring processing and to inform and advise the controller or the processor.
If the data protection officer's advice is not followed, the controller must record the reasons for that.
The Data Protection Officer is the contact point for the Data Protection Authority and as such can have prior consultation and seek advice, as appropriate, regarding other matters.
