What kind of companies need to have a DPO? Suppose we are looking for a new accounting firm. We have received a number of suggestions, we are discussing. In my opinion, such a company collects sensitive data, i. y. our operations, financial statements, cash balances and more. However, almost all companies say they have their own IT manager who is responsible for data security. Can you further explain how to know that a company will ensure the security of company data? And are companies really providing such services not necessarily required to have a DPO?

Answer:

We clarify that, in accordance with the General Data Protection Regulation, a Data Protection Officer is appointed in the following cases:

(a) the data are processed by a public authority or body, other than a court, in the exercise of their judicial functions;

(b) the main activity of the controller or processor is a processing operation which, by its nature, scope and / or purposes, requires regular and systematic large-scale monitoring of data subjects; or

(c) the main activity of the controller or processor is the processing of specific categories of data on a large scale.

To summarize the above, companies must appoint a Data Protection Officer whose main activity is the large-scale systematic monitoring of individuals or the large-scale processing of specific categories of personal data. Whether a particular company should appoint a Data Protection Officer is assessed on the basis of the above criteria, on a case-by-case basis. On the other hand, in all cases, when hiring an accounting firm, if it meets the definition of a controller, a personal data processing contract is concluded, which may specify what safeguards should be put in place to protect the processed data.

Please note that this is a general consultation, we suggest you consult a lawyer for more detailed information.

https://bznstart.lt/ziniu-baze/teise/dap-duomenu-apsaugos-pareigunas-paskyrimas/