From May 2018, the GDPR (EU data protection regulation), was introduced with general effect. Under the regulation, it is mandatory for some companies to appoint a Data Protection Officer (DPO) for others it is recommended.

The DPO has a key role to play in both establishing and maintaining compliance with the GDPR.

The duties of the Data Protection Officer based on the Article 39. of GDPR:

1. The Data Protection Officer shall perform at least the following tasks:

(a) provide information and professional advice to the controller or processor and to the staff performing the processing on their obligations under this Regulation and other Union or Member State data protection provisions;

(b) monitor compliance with this Regulation and other Union or Member State data protection provisions and internal rules of the controller or processor on the protection of personal data, including the assignment of tasks, awareness-raising and training of staff involved in data processing operations, and related audits;

(c) upon request, provide technical advice on data protection impact assessments and monitor the conduct of impact assessments in accordance with Article 35;

(d) cooperate with the supervisory authority; and

(e) to act as a contact point for the supervisory authority in matters relating to data processing, including the prior consultation referred to in Article 36, and to consult it on any other matter as appropriate.

2. The Data Protection Officer shall perform his or her duties with due regard to the risks associated with the data processing operations, taking into account the nature, scope, circumstances and purpose of the data processing.

The DPO, knowing the data controller’s data management activities, documentation and processes, serves as a contact person for the data subjects and the NAIH on behalf of the data controller, as well as investigates and consults in the management of possible data protection incidents.

KERUBIEL’s appropriately qualified and experienced data protection experts undertake, as part of a mandate, to hold the position of Data Protection Officer or to perform the DPO support function.