DPOs are great but should really hire one? In this episode I discuss why now is probably not the right time to go all in with a DPO and what you might want instead. And for when you are ready for a DPO, I provide some tips on how to start out on the right track.

Audio

Transcript

Hello and welcome to the GDPR Guy. I’m Carl Gottlieb, your host and resident privacy advisor.

In this episode I have a simple message for all of you C level people, founders and General Counsels out there, looking to embark into the world of privacy and thinking about hiring or engaging a Data Protection Officer like me.

Don’t.

Don’t do it.

You’re not ready.

So this might sound a bit odd considering that’s what I do. I’ve been a DPO for incredible tech companies, from seed round pre-revenue ventures to global, publicly traded enterprises. And while it was the right time for these companies, for many of you out there thinking you need a DPO, in most cases you’re just not ready yet. And like many things in the startup world, being too early is worse than being too late.

Every company is different but they all follow the same pattern of needing different privacy involvement at different times depending on scale and maturity. And the danger is spending money on privacy advice at the time you really should be spending it on growth.

Or to put it another way, don’t give your money to me, give it to a sales person and win some more customers.

People in my world really don’t like to hear this message because they want you to be mature and compliant and a thoroughly good citizen from day one. And while that’s nice and ideally true, it’s not how the world works. That’s not how business works. And more importantly, it’s not what investors want.

During the early stages there are some key privacy things a company will need. In B2C it’s more about building a low risk product – so your privacy needs will be more product engineering focused. In B2B, your priority will be more around customer deals, like having a good DPA, and being able to redline and accept the contracts and demands of your customers.

As a result, in terms of privacy work, what you see in B2C is the product or the engineering people as the ones trying to meet the low risk product requirement. And in B2B, people will be turning to their existing outside legal counsel to help them with contract redlining. In both cases you’re making do with what you’ve got.

The more diligent of you listening will be the ones thinking, “well I know I need more than that, or I want it done better, or I know I need a DPO”. And you’re probably right, but I want you to be damn sure you’re getting the right level of privacy maturity at the right time for you and for the company.

When you do start talking to consultants like me, challenge them to show you how they’re not a waste of money and how scalable their engagement should be. A good consultant will push back on your requirements and not take you on until you really are ready.

Ideally, a consultant will give you a roadmap of how they can make themselves redundant.

Focusing on the DPO role specifically for a moment, whether you’re in Europe, Canada, Singapore or other locations that have a need for such a mandated role, there’s usually some woolliness about when the inflection point is for you to legally need a DPO. Often, if you’re asking yourself, or me, what “large scale of monitoring” means, in an attempt to know if you fall into the DPO need bucket, I know you’re already thinking that you’d quite like a privacy person by your side, and the DPO legal requirement is almost secondary.

I see this scenario a lot. You will need a DPO at some point, but it probably isn’t today. Maybe it is, but it probably isn’t and let’s face it, you’re not going to get fined for not having one today. But I know you need some help. Or more importantly, you WANT some help, that a DPO would provide.

So my advice in this instance is to engage someone in a scalable fashion. Start out small, get some ad-hoc consultancy, with an eye to scaling it up in the future if the engagement goes well.

Do not. I repeat, DO NOT sign up to some year long deal with service line items, fixed quantities of assessments and things included per month. That’s commodity rubbish and you will not like it. You won’t get anything out of it.

The DPO is your secret weapon. I’ll talk more about this in another episode, but they are your shield and your sword. They are super helpful to you personally and you want to get the right one. Unless you’re on a game show, you don’t get married at first sight, even if someone else tells you how good looking your future spouse might be.

Yes, get referrals, referrals are extremely important. But talk to potential privacy advisors, chat with them, get to know what kind of person they are and if they’ll be on your side, working how YOU want to work and if they’ll help YOU be a better version of you.

Yes, I said that right. The DPO is there to help you, not the company. That’s definitely one for another episode.

And don’t over commit. I said this earlier, but try them out. You don’t need to marry them on day one. Have a few dates with them and see how you like being with them. Some people are great in an interview and then utter crap when you subsequently can’t get hold of them. And if you do think, yes, this is the one, then make sure there’s a cancellation clause in the contract. If things don’t go well in the first few months then you should be able to walk away with minimal notice.

But should this DPO be full-time, part-time, a day per week, a day per month, a consultant, a law firm, or should you just get someone else in the business to apportion some of their time to do the role?

As a consultant, I’m hard wired to respond with, it depends.

But maybe more helpfully, my next podcast episode is dedicated to just that topic.

Thanks for listening.

More Episodes of The GDPR Guy