Should your DPO work full time? In this episode I discuss the pitfalls of full time roles, why fractional DPOs may be a better fit for you, and what distinct benefits a part-time DPO might bring.

Audio

Transcript

Hello and welcome to the GDPR Guy. I’m Carl Gottlieb, your host and resident privacy advisor.

In this episode I want to answer a simple question, should your DPO work full time? At first this seems pretty obvious, in that, if there is enough work and budget for a full time role then that’s what it should be right? Well, maybe not.

The first thing to say is that the DPO role is like any other role, in that the volume of work they need to do, will depend massively on how much they can delegate to other members of the organisation. Take data mapping for instance. That’s a classic activity that the DPO gets involved in, but with the right coordination and commitment you can get other teams to take on the heavy lifting. This often means that calculating the expected workload for a new DPO role, can be pretty tough.

Add to that, this idea that the DPO is meant to be independent. So does that mean we shouldn’t really be delegating too much of that work, or does it mean we need to delegate more? And let’s face it. A DPO still needs to perform and impress, and be paid by the organisation so there’s only so much independence they can really have. All that boils down to the fact it can be hard to create a sense of independence as a DPO.

Taking a step back, the biggest limitation of doing anything in life is having to sacrifice doing something else. The opportunity cost. And yes, focusing on one thing can make you an expert in that one thing, but the deeper you go, the less you get to learn from the outside world. And full time employment is a perfect example of this. So while it might seem logical to get a full time DPO, would you actually be better getting a part time DPO that also works elsewhere? A “fractional DPO” if you want to use that term.

Personally I’m a big fan of this setup. I do a lot of it, and my clients seem to love it. If you can get a DPO that works for multiple clients in the same sector as you, then their value can far exceed that of someone working full time due to their exposure to other environments, other problems and other solutions. Facing a compliance challenge? They might have dealt with that multiple times in recent weeks. They know what solutions work and how to get there fast. Some other client has paid for the DPO to learn those lessons and you can benefit from it instantly.

Now questions around conflicts of interest do come up, but this is usually a very rare occurrence if you work in a big sector, like tech. And where paths do cross, such as with one client buying another client’s product, then I’ve never seen it act as anything other than a net benefit, usually because it helps both sides understand situations much quicker.

Historically, this open relationship with an expert is a well trodden path, especially in Legal with outside law firms able to advise with current industry knowledge. The big difference, is that the DPO’s advice is usually instantly actionable and based on real-time experience, whereas outside law firms’ advice may present as a 2,000 word memo with ten alternative options and a cover-their-arse internally vetted view point. If you want to know best how to fight fires, work with someone that fights fires every single day.

The extra value a fractional DPO provides, means that in some areas they will actually be faster than a full time DPO too. And because they’re also limited on time while working to the same organisational deadlines, they are usually compelled to operate faster too. The result is that the total output of a fractional DPO is not as fractional as you might first think. And the gap between part time and full time? Well, arguably, the bit they don’t get to do, might be better delegated anyway, such as that data mapping we talked about.

Getting other teams to do some privacy work is ideal for empowering them to continue owning that work going forward. A great example I’ve seen of this, is rather than legal or privacy creating a playbook of how marketing should comply with email marketing rules, is to get marketing themselves to create that operational manual. Marketing will always follow the guidance of their marketing leaders much more than they will from the legal or privacy person.

The fractional approach fits well with other roles too, such as the Head of Security or General Counsel. Just be aware that if you have a role where you need people to work in a much wider fashion, basically, you’ll pay them for 8 hours a day but you really you expect them to work a hell of a lot more than that (and yes legal teams, I’m looking at you) then the fractional thing could break down. But if you’re a small B2B startup getting annoyed at paying outside law firms to redline MSAs, then a part time General Counsel would be ideal. There’s plenty of good ones out there. And please do message me if you want recommendations. I work with some fantastic fractional GCs.

Back to the DPO, is one day per week, per month, per year enough for you? It’s impossible for me to say here, but my general advice is to give the part-time model a serious thought before going anywhere near full-time. They say if you love them, set them free. And time and time again I see the open relationship with the DPO as a brilliant way to get the job done.

Thanks for listening.

More Episodes of The GDPR Guy