„Our HR employee has taken on the responsibilities of the DPO, has attended training, and will manage it."
Are you sure about that?
Article 38 GDPR
Status of data protection officer
1. The controller and processor shall ensure that the data protection officer is properly and promptly involved in all data protection matters.
2. The controller and the processor shall support the data protection officer in the performance of the tasks referred to in Article 39 by providing the resources necessary for the performance of those tasks, as well as access to personal data and processing operations, and the resources necessary to maintain his or her expertise.
3. The controller and processor shall ensure that the data protection officer is not instructed to perform these tasks. He or she shall not be dismissed or penalized by the controller or processor for performing his or her tasks. The data protection officer shall report directly to the top management of the controller or processor.
4. Data subjects may contact the Data Protection Officer on all matters related to the processing of their personal data and the exercise of their rights under this Regulation.
5. The Data Protection Officer is obliged to maintain secrecy or confidentiality as to the performance of his tasks - in accordance with Union or member state law.
6. The Data Protection Officer may perform other tasks and duties. The controller or processor shall ensure that such tasks and duties do not create a conflict of interest.
