The Data Protection (Jersey) Law 2018 (DPJL) and the Data Protection (Bailiwick of Guernsey) Law 2017 (DPGL) define the role of a Data Protection Officer (DPO) and specify when an organisation is legally required to appoint one.
The key difference between a DPO and a Data Protection Manager (DPM) lies in the mandatory regulatory requirements attached to the DPO role. In contrast, the DPM role, though similar, is not subject to the same statutory obligations.
Under the Jersey and Guernsey data protection laws, organisations must appoint a DPO in specific circumstances:
- If processing is conducted by a public authority or body (except for courts acting in their judicial capacity).
- If the core activities of the organisation involve regular, systematic monitoring of individuals on a large scale.
- If the core activities involve large-scale processing of special category data or data concerning criminal convictions and offences.
If your organisation does not meet these criteria, you are not required to appoint a DPO. In these cases, it is also recommended not to title the head of data protection as a “Data Protection Officer,” as this may imply unnecessary legal obligations.
Get in touch with Propelfwd to discuss your data protection officer and manager needs.
The value of effective data protection management
In today’s data-driven world, compliance with data protection laws such as the Data Protection (Jersey) Law 2018 and the Data Protection (Bailiwick of Guernsey) Law 2017 is crucial for any organisation handling personal data. An effective data protection strategy not only meets legal obligations but also builds trust with customers and stakeholders. By distinguishing the roles of a DPO and a DPM, organisations can tailor their data protection approach to fit their specific needs, whether legally required or chosen for enhanced operational flexibility.
Propelfwd’s experienced team is equipped to support these compliance goals, providing insights, tools, and hands-on expertise to manage your data protection responsibilities effectively. Contact Propelfwd to explore the best data protection management solutions for your organisation.
Data protection officer vs manager
The responsibilities of a DPO are defined by law.
Under the data protection laws, a DPO’s primary tasks are advisory:
- Informing and advising the organisation and its employees on compliance with data protection regulations.
- Monitoring compliance with data protection laws and organisational policies, including training and auditing.
- Advising on data protection impact assessments and overseeing their execution.
- Acting as the contact point for the relevant supervisory authority.
- Engaging with the supervisory authority on matters related to processing and compliance.
A DPO’s role is advisory because they must remain independent and avoid involvement in the direct execution of data processing activities. For example, a DPO may guide the direction of a Data Protection Impact Assessment (DPIA) but should not be involved in conducting the DPIA itself.
Article 25 of DPJL or 51 of DPGL similarly outlines the legal responsibilities of controllers and processors toward the DPO. These requirements include involving the DPO in all issues related to data protection, supporting the DPO with resources and access, and ensuring the DPO’s independence and confidentiality in their role. Organisations with a voluntary DPO (that is, one that is not legally required) are still bound by these restrictions, which can place additional limitations on operational flexibility.
By contrast, a DPM can offer a similar range of services without the formal independence requirements mandated for a DPO. This flexibility allows the DPM to actively support data protection compliance work, directly engage in compliance projects, and work closely with controllers and processors on governance matters.
Can you outsource a DPO?
Outsourcing your DPO function can be cost-effective, eliminate conflicts of interest within your organisation, and give you access to a team of experienced professionals. According to Article 29(6) DPJL or 49(2) DPGL, a DPO must have expert knowledge of data protection law and practice and be able to fulfil the designated tasks effectively.
Appointing a DPO entails an ongoing commitment to provide professional development and resources to maintain compliance, manage workload during absences, and keep abreast of legal updates. Outsourcing these responsibilities ensures continuous team coverage, eliminating concerns about holidays, illness, or training gaps as the service provider handles these.
What can a DPM do for your company?
A DPM can undertake a similar scope of responsibilities as a DPO, with a more hands-on role in data protection compliance.
Services provided by a DPM may include:
- Offering data protection guidance and support.
- Developing, maintaining, and updating relevant policies and registers.
- Regularly liaising with the internal Data Governance Team.
- Assisting with Data Subject Access Requests and redactions.
- Monitoring compliance with data protection laws and internal policies.
- Overseeing data breaches and processing activity records.
- Advising on and assessing data breaches and signing off on necessary actions.
- Designing employee training on data protection.
- Communicating with supervisory authorities.
- Conducting DPIAs and implementing risk mitigation strategies.
- Completing due diligence on third-party processors and managing contractual agreements.
- Creating a comprehensive data transfer map.
- Assisting with the development of new processes or databases, ensuring privacy by design and by default.
What are the dangers of inadequate data protection management
Simply assigning data protection responsibilities to an employee as an “add-on” to their main role can lead to compliance failures.
Propelfwd has encountered numerous cases where this approach has resulted in complaints, supervisory authority investigations, or reputational damage due to inadequate data protection practices. Compliance is an essential obligation for all organisations, and delaying its implementation can lead to severe consequences.
Outsource your Data Protection Officer or Manager to PropelFwd
Propelfwd brings over seven years of experience across diverse sectors and jurisdictions, helping organisations meet their data protection needs efficiently. Propelfwd’s team specialises in conducting gap analyses, identifying compliance weaknesses, and implementing tailored solutions. Propelfwd also works with YourDataSafe, a web-based tool that centralises data governance processes and offers a controlled-access framework for compliance management.
Propelfwd offers a customised approach to data protection, recognising that each organisation has unique needs, challenges, and legal obligations. Whether your business operates locally in the Channel Islands or across multiple jurisdictions, Propelfwd can provide targeted support, drawing on extensive experience in Jersey, Guernsey, the UK, the Isle of Man, and Ireland.
By partnering with Propelfwd, you ensure that your data protection obligations are not only met but are also continuously managed with the highest standards of compliance and industry best practices. Whether you need a fully outsourced DPO, additional support for your data protection team, or guidance on specific projects, Propelfwd can create a solution that aligns with your business’s size, sector, and regulatory environment. Get in touch with Propelfwd.
Frequently asked questions about data protection roles
Does a DPO conduct data protection impact assessments?
No, a DPO typically does not carry out data protection impact assessments (DPIAs) themselves. Their role is to advise on the necessity, approach, and scope of DPIAs and to review and monitor their execution. This separation ensures the DPO’s independence and objectivity, as required by data protection law, and helps prevent conflicts of interest within the organisation.
What happens if you fail to appoint a DPO when required?
If an organisation is legally obligated to appoint a DPO but fails to do so, it risks significant penalties from the supervisory authority. In the Channel Islands, as in other jurisdictions governed by similar data protection laws, failing to appoint a DPO can be viewed as a breach of compliance, potentially resulting in fines, corrective action orders, and reputational damage.
What needs to be reported to a DPO?
A DPO should be informed of any data protection issues within the organisation, including data breaches, the need for DPIAs, significant processing changes, and third-party data-sharing arrangements. Additionally, data subjects may contact the DPO with questions or concerns about the processing of their personal data or the exercise of their data protection rights. The DPO acts as the main point of contact for both internal matters and supervisory authority inquiries.
Further reading:
