Outsourcing the Data Protection Officer (DPO)

For this reason, it is even harder trying to find the correct person to take on the role, and there are huge risks if the right person does not fill the position. We are seeing Boards and senior executives becoming more concerned with their data protection compliance, in some cases, because they have not heard anything about it other than a standing item on the risk register since 2018! In many cases, this is due to the DPO not having the required skills or expertise to fulfil the role, or they may be under-resourced and simply not have the capacity to carry out their duties. 

Compounding this is the shortage of skills in the labour market. Qualified DPOs are hard to come by, and when one does appear on the market, there is a lot of competition. One straightforward way of overcoming the risk of having an underqualified DPO and the challenge in recruiting the right person is to outsource the role.

Why you should outsource the DPO

There are several benefits to outsourcing your DPO or any role. When outsourcing to Mazars, you will benefit from having access to a leading team of experts in Ireland and across the globe who have provided DPO services for 20 years to a wide range of clients across the SME, Enterprise, and Public Sectors.

Resourcing

One of the most challenging aspects of finding a DPO is that there are many more jobs than qualified people at the moment, meaning salaries are high, and the risk of finding the wrong DPO as unsuitable candidates move into the space is growing. This also leads to a high turnover. However, with outsourcing, there is no risk of resourcing. There will always be some there to provide the DPO service to you.

Access to experts

The tasks of the DPO requires an individual in the post to have a broad level of expertise or at least access to the expertise. This expertise can include:

• Data protection law
• Information and Cyber security
• Technology
• Risk management
• Change management
• Business analysis

One person with all the required skills is very hard to come by, and a full-time team of people with those skills is expensive. However, when you outsource, you will have access to all the required skills when required for the same monthly cost.

Capacity

Data protection events always tend to happen on a Friday, especially bank holiday Friday's and can take up a significant amount of time and resources. Whether it is a data breach or a complex data subject access request, an inhouse DPO or even a team can quickly find themselves snowed under and unable to respond to those events within the required timeline, let alone manage their day-to-day tasks. You will have access to additional resources that outsourcing can leverage as needed.

Experience

Experience is a compounding benefit as the more clients a service provider has, the more in-house knowledge and experience you will have access to. By outsourcing to Mazars, you will be able to reap the benefit of lessons learned from all our clients and innovative solutions that have been put in place. In contrast, an in-house DPO might have the experience of working with a handful of companies.  

Cost-effective

There are two actual costs to having an in-house DPO that outsourcing can reduce. The first is in recruitment and hiring. The jobs market at the moment is so plentiful that good DPOs are in high demand, meaning if you do find one, the likelihood is they will not be around for long, and you have the cost of replacement. The second cost is not recruiting an adequately qualified and experienced DPO and the follow-on cost of remediation. Both of these financial burdens are significantly reduced by outsourcing the role to an organisation like Mazars, where you will receive a monthly bill for high-quality services.

Independence

Independence is a requirement for the DPO role. It is also beneficial to have a trusted third party giving independent advice when required. Many organisations have split the role of the DPO for one individual, who spends 50% of their time in one role and the other 50% acting as the DPO. There is independence and conflict of interest risk that can easily be mitigated through outsourcing.  

What it involves

The main action with outsourcing involves trusting the person and the organisation that will be your DPO. The experts providing the service will be trusted with ensuring that your data protection framework is functional, compliant, and sustainable to allow you to continue to be compliant into the future. The DPO will be tasked with providing advice and guidance appropriate for your organisation and the data subjects involved, requiring trust in the judgement of the DPO.  

There are several options with outsourcing, but the most effective is a hybrid approach. This requires an internal employee to act as the key contact and assist the team in embedding the data protection framework. See here for more on the framework.

An initial assessment is required before the DPO is appointed. Please get in contact to discuss further.

Conclusion

Outsourcing the role of the DPO will reduce the risks associated with keeping the role in-house and provide you with peace of mind that trusted custodians are managing your data protection framework with the required experience, expertise and judgement required to support your organisation.

One thing that we believe is that the DPO is an enabler in business, allowing your organisation to grow and expand in a compliant and sustainable manner through expert advice and guidance.

For more information, go to our Outsourcing your DPO service page and please get in touch.

Got a question? Just get in touch