Data protection officers

The data protection officer's overarching and most important task is to monitor the organisation's compliance with the General Data Protection Regulation. This means among other things

• collecting information about how the organisation processes personal data
• checking that the organisation complies with regulations and internal policy documents
• providing information and advice within the organisation.

The data protection officer must also

• give advice on impact assessments
• be Swedish Authority for Privacy Protection's contact person
• be the contact person for the data subjects and the organisation's personnel
• cooperate with Swedish Authority for Privacy Protection, for example during inspections.

Impact assessments

The data protection officer must always be involved if an organisation makes, or is considering making, an impact assessment concerning processing of personal data. An impact assessment is necessary if you intend to collect personal data and people's rights and freedoms are put at great risk.

The data protection officer is not responsible

The data protection officer has no personal responsibility for the organisation's compliance with the General Data Protection Regulation. This responsibility always lies with the data controller or the data processor. Nor may the data controller punish the data protection officer for having carried out his or her duties.

Who can be a data protection officer?

The data protection officer must among other things

• have knowledge of the General Data Protection Regulation
• know the organisation's core activities and how the organisation processes personal data and know how the organisation's information technology and IT security function
• have the ability to disseminate information and establish a data protection culture within the organisation. For this reason the data protection officer's personal qualities are also important.

The more complex the processing of personal data and the greater the amount of sensitive data that is processed the greater the expertise the data protection officer requires.