Data Privacy – What is a DPO And Do You Need One?
Most people struggle to tell what the jargon around data privacy really means. If you know your data privacy policy from your data processing agreement or your data processing impact assessment you are surely ahead of the game.
But one of the most misunderstood terms of all is a Data Protection Officer (DPO). When it comes to understanding who needs one, what they do and whether you need one it is easy to get lost in the jargon. Not every organisation needs one, but do you?
Let’s break it down.
What Is a DPO and Who Has to Have One?Some organisations are legally required to appoint a DPO. But the rules aren’t written with small businesses in mind—they were designed for big companies and public authorities. Before you go – great I’m not a big company or a public authority you need to read through the categories because one of them may apply to you if you are a franchisor or a national brand. And there are things you may want to do voluntarily even if you aren’t at that stage in order to get ready for that day you expand or franchise.
You’re legally required to appoint a DPO if :
- You’re a public authority or body
(e.g. you’re part of a local council or funded by one) - You carry out large-scale, regular monitoring of individuals
(e.g. tracking children via apps, behaviour analysis tools, or online profiling) - You process special category or criminal offence data on a large scale
(like health data, safeguarding notes, or behavioural reports—at scale)
It is unlikely you are going to find yourself in category 1 or 2, though if you do track children via apps or your website you may well do, but it is easier than you think to find yourself in category 3.
What is special category data?Special category data is a type of data that requires special consideration, minimisation, security and care. When dealing with children you are highly likely to be collecting health data even if you don’t usually collect safeguarding notes or behaviour reports.
What does large scale mean?Rather unhelpfully neither the original EU legislation of the UK legislation gives a definition of ‘large scale’. We know from case law that 5 million records is definitely large scale – thanks to a German company that found itself on the wrong end of a court case about this. But we don’t know for sure what ‘not large scale’ or ‘medium or small scale’ is.
But given the industry we can certainly predict that large scale would include:
- Thousands of children or many regional locations
- Regular, centralised reporting on medical, safeguarding, or behavioural data
- Sharing data with third parties (e.g. insurers, AI tools, external assessors)
If you’re operating a franchise, have a national presence, or collect a lot of sensitive data via automated systems, (which would include online booking forms that collect health related information) you may need to take a closer look.
If you’ve already done your Data Processing Impact Assessment (DPIA) and kept it up to date it should include the scale of processing. If not that can be a great place to start.
Not large enough for a DPO?If none of the above applies, you’re not legally required to have a DPO. We do see people who make a Director or a Senior Manager a DPO anyway. This is a title you are going to want to avoid using as it comes with some very specific legally obligations and liabilities. Many KoffeeKlatch clients use the term Data Champion or something similar for managers fulfilling this role.
But—and it’s a big but—you still need to get your data protection house in order.
That means:
- Having proper contracts in place (especially when dealing with parents, schools, or franchises)
- Making sure you review your privacy policies regularly
- Knowing what AI tools (if any) are processing customer or child data
- Being able to demonstrate accountability, training for all your roles and compliance
Annabel Kaye of KoffeeKlatch says…
“We meet so many brilliant business owners who think GDPR doesn’t apply to them, or who panic and appoint someone as ‘data processing officer’ without knowing if they need one. You don’t have to go it alone—and you don’t need to be scared of getting it wrong. But you do need to be informed.”
👣 What Next?
Still figuring out what documents or processes you need? Pop over here and let’s talk about getting your business data-ready, not data-worried.