Question 1

Does every company need a DPO?

Accepted Answer

No. Appointment is mandatory in the situations set out in the GDPR, including certain large-scale regular and systematic monitoring or large-scale processing of sensitive data. The assessment follows the organisation's actual activities, not merely its headcount. Even without a mandatory DPO, the company needs a clear owner for data protection matters.

Question 2

Is the DPO liable instead of the company when something goes wrong?

Accepted Answer

No. The DPO advises and monitors and must be involved independently and in good time. The company remains responsible for its decisions and measures. To perform the role properly, the DPO needs access to relevant information and to the company's management.

Question 3

When is a DPIA required?

Accepted Answer

When processing is likely to create high risk for people's rights and freedoms. Examples may include extensive monitoring, large-scale use of sensitive data or new technology in a context with significant impact. The assessment takes place before launch and should be updated if the project changes.

Question 4

Must every incident be reported within 72 hours?

Accepted Answer

No. Every breach must be documented, but notification to the authority is required unless the breach is unlikely to result in a risk to people. The 72-hour period is the limit for notification, where notification is required and feasible, and the assessment should begin immediately.

Question 5

Do we need consent for every use of personal data?

Accepted Answer

No. Consent is one of the available legal bases. A contract, legal obligation or legitimate interests may fit other situations. Consent obtained where the person has no real choice may be invalid and difficult to withdraw in practice.

Question 6

Can we appoint an external DPO?

Accepted Answer

Yes. The GDPR allows the role to be performed under a service contract. The DPO must have the right expertise, independence, time and access and must not face a conflict of interest.

Question 7

Can we use a supplier that hosts data outside the EEA?

Accepted Answer

Sometimes, but the transfer must be identified and supported by the right legal mechanism. A contract is not always enough by itself. The country, the provider, possible access to the data and any additional safeguards must be checked.

Question 8

What should we send before the first discussion?

Accepted Answer

A short description of the situation, any known deadline and the documents already available. For an incident, useful facts include when it was discovered, the type of data, the people possibly affected and the steps already taken. Do not delay contact because the information is still incomplete.