Data protection officer

Under the UK General Data Protection Regulation (UK GDPR), certain organisations are required to appoint an individual to act as their data protection officer (DPO). Others may choose to appoint a DPO on a voluntary basis. In either case, your firm will need to consider who should be the DPO, what the DPO’s duties will be and what the firm’s obligations are in relation to the DPO.

For information on the circumstances where UK GDPR requires you to appoint a DPO, see Practice Note: Data protection officer—law firms and DPO appointment decision tree.

Voluntary DPOs

You should consider whether to appoint a DPO even where you are not required to. Guidelines on DPOs published by the Article 29 Data Protection Working Party and subsequently endorsed by the European Data Protection Board (EDPB) (EDPB guidance) and Information Commissioner’s Office (ICO) guidance encourage voluntary appointment of a DPO, but with an important caveat—it doesn’t matter whether your DPO’s appointment is voluntary or mandatory, if your firm has a DPO, all the requirements of the UK GDPR relating to DPOs apply—see Practice Note: Data protection officer—law firms—Voluntary

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Practice Compliance News

Guidance on the information sharing measures in the Economic Crime and Corporate Transparency Act 2023 has been updated

An update to the guidance on information sharing measures outlined in the Economic Crime and Corporate Transparency Act 2023 has been updated on the government’s website. The measures, which are voluntary, allow regulated firms to share customer information for the purposes of preventing, investigating and detecting economic crime and have been put in place to provide greater clarity and comfort to regulated firms to share relevant customer information.

New Practice Compliance forecast as at 18 December 2024

Our new Practice Compliance forecast (as at 18 December 2024) is now live. This month we report on items including: (1) publication of Guidelines 02/2024 on Article 48 GDPR by the European Data Protection Board (EDPB) for consultation; (2) expectations for the Legal Ombudsman (LeO) to publish its final budget and business plan in Spring 2025; (3) expectations for the Data (Use and Access) Bill to be enacted in early spring 2025, and (4) a statement by the ICO that it would update its existing AI guidance in due course.

House of Lords conclude committee stage of Data (Use and Access) Bill

The House of Lords has completed the committee stage of the Data (Use and Access) Bill, the final day of scrutiny took place on 18 December 2024 and focused on amendments related to children and AI, national security and data privacy risks and AI compliance with UK copyright law. The bill, aimed at harnessing data for economic growth and improving digital governance, has undergone thorough examination over multiple sessions, addressing issues such as protection of children, misuse of AI rules, data mining and processing of personal data. The next stage, report stage, is scheduled for 21 January 2025.