Appointment, tasks and position of a Data Protection Officer (DPO)

Critical
High
Normal
Low

Our organization has determined whether a data protection officer should be appointed and, if so, made an appointment.

The Data Protection Officer shall be appointed if:

  • the organization handles sensitive information on a large scale
  • the organization monitors people on an extensive, regular, and systematic basis
  • the organization is a public administration actor

In addition to the appointment, it is essential to regularly assess whether the Data Protection Officer is acting in the role and performing the tasks required by the Data Protection Regulation.

Connected other frameworks and requirements:
37. Designation of the data protection officer
GDPR
38. Position of the data protection officer
GDPR
39. Tasks of the data protection officer
GDPR
18.1.4: Privacy and protection of personally identifiable information
5.34: Privacy and protection of PII
ISO 27001

Notification of the Data Protection Officer

Critical
High
Normal
Low

The organization shall publish the contact details of the data protection officer (e.g. on the organisation's website) and inform the supervisory authority.

Connected other frameworks and requirements:
37. Designation of the data protection officer
GDPR
6.1.1: Information security roles and responsibilities
ISO 27001
18.1.4: Privacy and protection of personally identifiable information
18.2.2: Compliance with security policies and standards
ISO 27001

Amount, competence and adequacy of key cyber security personnel

Critical
High
Normal
Low

The organization shall have a sufficient number of trained, supervised and, where necessary, properly security cleared personnel who play key roles in information security, performing management tasks related to the information security management system.

The organization has defined:

  • what qualifications this staff should have
  • how qualifications are acquired and ensured (e.g. through appropriate training and training monitoring)
  • how qualifications can be demonstrated through documentation

The owner of the task regularly reviews the number and level of competence of the security personnel.

Connected other frameworks and requirements:
T03: Turvallisuustyön resurssit
32. Security of processing
GDPR
37. Designation of the data protection officer
GDPR
6.1.1: Information security roles and responsibilities
ISO 27001
ID.GV-2: Cybersecurity role coordination
NIST CSF
No items found.