The function of the DPO can also be exercised on the basis of a service contract concluded with an individual or an organisation outside the controller’s/processor’s organisation. In this latter case, it is essential that each member of the organisation exercising the functions of a DPO fulfils all relevant requirements of Section 4 of the GDPR - Data Protection Officer, (e.g., it is essential that no one has a conflict of interests).
It is equally important that each such member be protected by the provisions of the GDPR (e.g. no unfair termination of service contract for activities as DPO but also no unfair dismissal of any individual member of the organisation carrying out the DPO tasks). At the same time, individual skills and strengths can be combined so that several individuals, working in a team, may more efficiently serve their clients.
For the sake of legal clarity and good organisation it is recommended to have a clear allocation of tasks within the DPO team and to assign a single individual as a lead contact and person ‘in charge’ for each client. It would generally also be useful to specify these points in the service contract.
The content herein is provided for your convenience and does not constitute legal advice.
Compliance Technology Solutions B.V. 2018