How should you name your DPO or Privacy Partner?
1. Where should you disclose your DPO?
2. Why should you disclose your DPO?
3. What should you disclose about your DPO?
4. Does this change in the case of other types of privacy professionals?
1. Where should you disclose your DPO?
Once you appoint a DPO, it is important to disclose their name and contact details. The process is relatively simple but important to get right to avoid confusion and regulatory penalties.
You should disclose your DPO:
In internal company records
This is a requirement under Article 30(1) of the GDPR
In a letter to your national supervisory body
Someone - oftentimes the DPO themselves - must inform the relevant supervisory authority (e.g. the UK Commission in the UK) of the DPO’s appointment and details.
There isn’t an official public register of companies and DPOs. Therefore, it is essential that the company/ company DPO gets in touch with the supervisory board via email.
Some member states have specific forms you must submit.
In your privacy policy and terms and conditions.
2. Why should you disclose your DPO?
Beyond it being mandatory under GDPR, disclosing information about your DPO demonstrates ready compliance with data protection practices to your consumers and potential investors. The UK Information Commissioner’s Office (ICO) notes, appointing a DPO is ‘a vehicle for you to build compliance as a long-term sustainable activity across your business’. Therefore, disclosing information about your DPO helps showcase your business’ commitment to consistent, trustworthy data compliance measures, or ‘long-term sustainable activity’.
Moreover, Article 24(1) of the UK GDPR states that ‘the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation’. Appointing a DPO is a useful example of one such ‘technical and organisational measure’.
3. What should you disclose about your DPO?
In internal company records and your letter to your supervisory authority, your business should disclose the following information about your DPO:
DPO’s name
(if applicable) Company name
Contact details (normally company address and email)
(If applicable) Address of the DPO’s company
Your public disclosure (e.g. in privacy policy) can be a little less specific:
Can be role based. e.g. simply ‘Data Protection Office rather than their full legal name
Can be anonymised contact details - dpo@x.com
Address of the DPO’s company
4. Does this change in the case of other types of privacy professionals?
While the regulatory guidance around DPOs is relatively established, the same clarity does not exist for other types of compliance leads such as privacy partners and AI compliance leads.
Nevertheless, the DPO regulatory guidance might be taken as a model for privacy partners and AI compliance leads whilst regulation and guidance on AI compliance leads continues to find its feet. Communicating the existence of your AI compliance lead and/ or privacy partner clearly on your website and in company records signals a commitment to transparency and thoughtful innovation to your customer base and potential investors. Communication of the effort and thought your business has invested in data compliance invites trust and trust invites growth.
Last updated