Data protection officer
The data protection officer (DPO) supervises the application of and compliance with the Dutch Personal Data Protection Act (Wbp) within an organisation. From 25 May 2018, when the General Data Protection Regulation (GDPR) applies, organisations are required to appoint a DPO in a number of cases.
What does a DPO need to know and be able to do?
A DPO is expected to have above-average professional knowledge of privacy legislation and of data protection in practice. The required expertise and skills include at least:
- knowledge of national and European privacy legislation and regulations on data protection;
- an understanding of the data processing the organisation carries out;
- an understanding of IT and information security;
- knowledge of the organisation and the sector it operates in;
- the skills to develop a culture of data protection within the organisation.
Concrete level of knowledge
The concrete level of knowledge a DPO needs depends on the organisation in question. Which data processing does the organisation carry out? And what level of personal data protection does that require?
A DPO needs more expertise (and support) if the organisation processes large volumes of sensitive data, for example.
(Source: Autoriteit Persoonsgegevens)