BDO launches outsourced data protection service

Monday 19 March 2018

Professional services group BDO has launched a service to help businesses in Jersey adopt and comply with new data protection rules, ahead of the introduction of General Data Protection Regulation in May.

BDO’s service is designed for organisations which might be too small to warrant an internal Data Protection Officer (DPO) or struggle to find someone suitably independent internally.

GDPR calls for the mandatory appointment of a DPO in some instances for any organisation which processes or stores large amounts of personal data, whether for employees, individuals outside of the organisation, or both. A DPO’s responsibilities include training staff in data processing, conducting data audits, monitoring performance, maintaining records and serving as a point of contact between the organisation and the Office of the Information Commissioner.

Recognising the complexity of a DPO’s duties, but also the fact that it may not be a full-time responsibility, GDPR allows the role to be outsourced.

Pictured: GDPR will come into force on 25 May this year.

Damon Greber (pictured right), BDO’s Director of Risk Advisory Services, said: “We regularly carry out Data Protection Impact Assessments for clients so have identified common issues that organisations have with their GDPR preparations, which we can help them with... From charities and sole traders to large companies, every size and type of organisation could come under the scope of GDPR, depending on the amount of data they hold.”

Paul Vane, Acting Information Commissioner, added: “The law supports the outsourced DPO role so this new service from BDO is welcome. Other services are available, so it is important that organisations do their own due diligence to make sure whatever they opt for is appropriate. But certainly, outsourcing the DPO role could save an organisation a lot of time and money by handing over responsibility to specialists who will provide 24/7 cover and relevant training.”