Data protection officer should assist organization to conduct an internal audit to monitor and evaluate the overall implementation of their data protection policies and processes.

Data protection officer should assist the organization to establish an enterprise risk management framework with reporting mechanisms (i.e. regular risk reporting and internal audit) as part of their data protection measures.

Data protection officer should review their data protection policies and practices to enable them to identify data protection gaps and the appropriate remedies.

Data protection officer should keep stakeholders apprised of the changes to their policies or practices as part of their training and communication plan. An organization’s data protection policies and practices should be accessible.

DPO should develop processes for handling queries or complaints from the public. Under the access and correction obligations of the GDPR, a member of the public may request access to his/her personal data under the organization’s possession or make enquires about the way his/her personal data has been used over the past years.

The data protection officer is tasked with a very onerous and wide-ranging responsibility to deal with and monitor compliance across the ranging to deal with and monitor compliance across the data controller or processor organization.

Conduct a briefing to inform your employees of the obligations under the GDPR. Ensure that they are aware of any new developments, as well as any existing laws and contracts that may affect the personal data under your organization’s care.

Review data protection risks within your organization and come up with mitigating measures to address these issues. For example, your organization may wish to consider carrying out regular internal audits to ensure that its processes adhere to the data protection laws. In the case of a breach, your organization should also have processes and measures in place to respond to such situations.

Review your organization’s data management framework and processes to align them with the data protection laws, for example, determining how, when and where your organization collects personal data, the purposes for the data collection, and ensuring that consent has been obtained for the collection, use and disclosure of the data.