The Privacy Officer
The Privacy Officer is mandatory for every business. Without an explicit designation, the person with the highest authority is automatically responsible.
Who must be the Privacy Officer?
Every business must have a Privacy Officer. Absent an explicit designation, the function automatically falls to the person with the highest authority (president, CEO), even if that person is unaware of it.
The function can be delegated in writing, in whole or in part, to another person — including an external resource (consultant, firm). This is often the most realistic solution for an SMB.
The Privacy Officer's 5 responsibilities
- Ensure compliance with the law and the implementation of internal policies
- Approve or oversee Privacy Impact Assessments (chapter 6) for any new project involving personal data
- Be the point of contact for individuals exercising their rights and for the CAI
- Take part in confidentiality incident management (chapter 7)
- Raise awareness and train staff on best practices
Publishing the Privacy Officer's contact information on the website
The title and contact information of the Privacy Officer must be published on the business's website (or made accessible by another appropriate means if the business has no website).
In-house or external Privacy Officer?
| Criterion | In-house Privacy Officer | External Privacy Officer |
|---|---|---|
| Cost | Salary / existing time | Consultant fees |
| Knowledge of the business | High | Needs to be built |
| Legal and technical expertise | Variable | Generally high |
| Independence | Possible role conflict | Strong |
| Best suited for | Mid-sized businesses | Micro/small businesses without in-house expertise |
Recommended hybrid model for SMBs: an officially designated in-house Privacy Officer, supported occasionally by an external advisor for PIAs and complex cases.
✓ Privacy Officer checklist
- ☐ Is a Privacy Officer formally designated, with a written delegation if applicable?
- ☐ Is their contact information published on the website?
- ☐ Do they have the real authority, time and resources to fulfill the role?
- ☐ Are they trained on Law 25's obligations?