[et_pb_section fb_built=”1″ _builder_version=”4.16″ custom_padding=”0px|0px|0px|0px” global_colors_info=”{}”][et_pb_row _builder_version=”4.16″ custom_padding=”0px|||||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n
In the digital age, where personal data has become the new black gold, a new figure is emerging within companies: the Data Protection Officer (DPO<\/strong> ).<\/span><\/p>\n In this article, delve into the heart of the DPO’s job<\/strong>, a role as strategic as it is indispensable, and discover how it orchestrates the security of personal data<\/strong>.<\/span><\/p>\n The Data Protection Officer (D\u00e9l\u00e9gu\u00e9 \u00e0 la Protection des Donn\u00e9es<\/strong> ) is a recent profession which covers several activities and has a transversal role within a company. Its role is to have a complete overview of personal data processing <\/strong>within a company. The challenge, of course, is to control the risks associated with such processing, and to educate everyone involved (project managers, consultants, etc.) in good data protection and confidentiality practices.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n It all starts with an understanding of the company’s organization and the specifics of each business line. HR and finance departments do not handle the same data. As for IT services, they are essential to the smooth running of our teams, <\/span>manage a considerable amount of data.<\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n To obtain an exhaustive overview of processing operations, the DPO<\/strong> draws up a map of personal data processing operations<\/strong>.<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n This mapping is important for several reasons:<\/span><\/p>\n Firstly, it identifies the risk associated with each treatment<\/strong>. For example, the risk is rather low when processing is carried out directly on a customer’s computer, within its own secure systems, with no possibility of transferring data to a third-party system.<\/span><\/p>\n However, when sensitive data is processed<\/strong>, or when it<\/strong> is necessary to transfer data<\/strong> to a third-party system for processing, it is crucial to secure the processing of sensitive data<\/strong>. An action plan must then be put in place to secure all stages, both organizationally and technically. It’s at times like these that the interweaving of personal data processing<\/strong> and cybersecurity comes into sharp focus. The DPO<\/strong> is the CISO<\/strong> ‘s partner in securing information and data<\/strong>.<\/span><\/p>\n Secondly, this mapping is very important for crisis management<\/strong>, in the event of a cyber attack or data breach. As we can see, solid, certified companies are under attack. If, during an attack, we identify a vulnerability that has corrupted one of our personal data processing<\/strong> operations, we must contact the data controller as soon as possible.<\/span><\/p>\n In the mapping, we therefore also need to include the crisis contact for each processing operation, and keep in mind the contractual and regulatory deadlines for declaring the data breach to the CNIL<\/strong> and\/or filing a complaint.<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n As the company evolves and so do its tools, we process personal data<\/strong> in our internal projects. GDPR compliance<\/strong> is an integral part of benchmarking when choosing a new application or partner.<\/span><\/p>\n Upstream, it is important to carry out an impact analysis, <\/strong>or AIPD<\/strong>. During this analysis, we need to check the security of the software (authentication, data retention, etc.), the tool’s certifications, the purpose of each processing operation we wish to implement, etc. The depth of the analysis obviously depends on the complexity of the internal project.<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n Another role of the DPO<\/strong> is to ensure that all employees are trained in the issues surrounding the processing of personal data<\/strong>. This training is provided in a number of ways: through access to mandatory e-learning training, and through one-off training sessions on compliance news<\/strong>, to explain the latest CNIL<\/strong> sanctions and the impact of new regulations <\/strong>on day-to-day work.<\/span><\/p>\n On the contractual side, the role of the DPO<\/strong> is to support the company in rereading the GDPR<\/strong> aspects, but also to provide support so that each player completes the annexes dedicated to the subject. The Data Protection Officer<\/strong> has a good overview of the contractual, regulatory and operational aspects. It’s a key element in risk management in three ways<\/span>.<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n Finally, the role of the DPO<\/strong> is to emphasize the importance of good cybersecurity practices<\/strong>. Cybersecurity rests on three fundamental pillars: people, software and hardware. It’s crucial to adopt a cautious attitude, especially to thwart phishing and phishing attempts, which represent the most common threats. [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n According to the latest AFCDP barometer, 53% of DPOs come from a legal or IT background. The remaining 47% come from administrative and financial functions, quality or compliance-audit.<\/span> [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ custom_padding=”||5%||false|false” inline_fonts=”Roboto” global_colors_info=”{}”]<\/p>\n As you can see, the Data Protection Officer<\/strong> must have a good knowledge of the company’s various departments. The DPO<\/strong> ‘s versatility doesn’t stop there. Finally, the DPO<\/strong> must have project management skills. He or she must be able to plan and manage the company’s data protection<\/strong> initiatives, monitor their progress and ensure that they are carried out successfully. [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row custom_padding_last_edited=”on|desktop” _builder_version=”4.27.0″ background_color=”#2029a0″ background_image=”https:\/\/www.sqorus.com\/wp-content\/uploads\/2023\/12\/Bandeau-LB-Gouvernance-IT.png” background_size=”contain” background_position=”center_right” width=”100%” width_tablet=”90%” width_phone=”90%” width_last_edited=”on|phone” custom_margin=”||3%||false|true” custom_padding=”50px|400px|50px|55px|true|false” custom_padding_tablet=”50px|55px|50px|55px|true|true” custom_padding_phone=”40px|55px|40px|55px|true|true” background_last_edited=”on|phone” background_enable_image_tablet=”off” border_radii=”on|23px|23px|23px|23px” global_module=”25053″ global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text module_class=”Titre_40 Titre_blanc” _builder_version=”4.25.1″ _module_preset=”default” header_2_font_size=”30px” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text module_class=”FondBleu” _builder_version=”4.24.3″ _module_preset=”default” text_font=”||||||||” text_text_color=”#d6d8f4″ text_line_height=”30px” global_colors_info=”{}”]<\/p>\n Discover the roles and responsibilities of key profiles, as well as best practices in governance and technological development, to ensure the success of your digital transformation projects.<\/p>\n [\/et_pb_text][et_pb_button button_url=”https:\/\/www.sqorus.com\/en\/ebook-all-about-it-project-governance\/” button_text=”Download” button_alignment=”left” button_alignment_tablet=”center” button_alignment_phone=”center” button_alignment_last_edited=”on|tablet” admin_label=”Bouton de t\u00e9l\u00e9chargement” module_class=”Bouton Fond_blanc” _builder_version=”4.27.0″ _module_preset=”default” custom_button=”on” button_text_size=”15px” button_text_color=”#f36145″ button_bg_color=”#FFFFFF” button_border_width=”1px” button_border_color=”#f36145″ button_border_radius=”50px” button_font=”||||||||” button_use_icon=”off” custom_margin=”20px||||false|false” custom_padding=”13px|25px|13px|25px|false|false” custom_css_free_form=”selector:hover{|| background-color: #FFF6F5 !important;||}” global_colors_info=”{}”][\/et_pb_button][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.27.0″ _module_preset=”default” global_module=”38598″ global_colors_info=”{}”][et_pb_row _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n <\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”Section – Blog – Cta Actu” module_class=”Fond_bleu Fond_icone” _builder_version=”4.27.0″ custom_margin=”5rem||5rem||true|true” custom_margin_tablet=”4rem|40px|4rem|40px|true|true” custom_margin_phone=”|20px||20px|false|true” custom_margin_last_edited=”on|phone” custom_padding=”3rem||3rem||true|false” global_colors_info=”{}”][et_pb_row make_equal=”on” admin_label=”Text block” module_class=”LargeurBox” _builder_version=”4.27.0″ _module_preset=”default” animation_style=”fade” locked=”off” collapsed=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.25.0″ _module_preset=”default” custom_padding=”|9rem||9rem|false|true” custom_padding_tablet=”|0rem||0rem|false|true” custom_padding_phone=”|0rem||0rem|false|true” custom_padding_last_edited=”on|desktop” global_colors_info=”{}”][et_pb_text admin_label=”Sous-titre” module_class=”SousTitre” _builder_version=”4.25.0″ _module_preset=”default” text_font=”||||||||” text_orientation=”center” custom_margin=”||10px||false|false” text_orientation_tablet=”” text_orientation_phone=”center” text_orientation_last_edited=”on|tablet” global_colors_info=”{}”]<\/p>\n Contact<\/p>\n [\/et_pb_text][et_pb_text admin_label=”Titre – H2″ module_class=”Titre_40″ _builder_version=”4.26.1″ _module_preset=”default” text_orientation=”center” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text admin_label=”Texte” _builder_version=”4.27.0″ _module_preset=”default” text_text_color=”#d2d4ec” text_orientation=”center” global_colors_info=”{}”]<\/p>\n Contact us today and find out how we can work together to make your company’s digital future a reality.<\/p>\n [\/et_pb_text][et_pb_button button_url=”https:\/\/www.sqorus.com\/en\/contact\/” button_text=”Contact SQORUS” button_alignment=”center” module_class=”Bouton fond_orange” _builder_version=”4.27.0″ _module_preset=”default” custom_margin=”30px||||false|false” global_colors_info=”{}”][\/et_pb_button][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" The Data Protection Officer (DPO): an essential pivot in securing personal data in the digital age.<\/p>\n","protected":false},"author":53,"featured_media":41811,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","content-type":"","_ayudawp_aiss_exclude":false,"footnotes":""},"categories":[492],"tags":[],"metiers":[225],"sujet":[215],"class_list":["post-41800","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-governance","metiers-it-en","sujet-business-en"],"acf":[],"yoast_head":"\nBut what does the DPO actually do?<\/h2>\n
Mapping personal data processing<\/h2>\n
As I regularly remind you, all you need to process personal data<\/strong> is a first and last name, or just an e-mail address.<\/span><\/p>\n
For a company like SQORUS, personal data processing<\/strong> is identified for all cross-functional functions (HR, Marketing, Administrative…), but also within each consultant division. Personal data is processed<\/strong> as part of fixed-price projects and Application Management. But it is also essential to identify the personal data processing<\/strong> operations carried out by third-party consultants on behalf of their customers.<\/span><\/p>\n<\/ul>\n
Risk control and crisis management<\/h2>\n
Impact analysis and risk management<\/h2>\n
Training and support for GDPR compliance<\/h2>\n
Cyber security awareness<\/h2>\n
\nIndeed, effective protection of personal data cannot be dissociated from a global security policy. <\/span><\/p>\n
\nAt the heart of this triad, the human element is the first line of defense. <\/span><\/p>\n
\nIt is also imperative to install software protections<\/strong> such as virtual private networks (VPNs) and antivirus software, not forgetting to carry out the necessary updates on a regular basis.
Finally, vigilance regarding hardware is essential: it should be secured when not in use, and reliable, secure Wi-Fi connections should be preferred.
\nIt is important to stress that these measures, while essential, do not constitute an exhaustive list of actions to be taken to guarantee optimum IT security. <\/span><\/p>\nHow do you become a DPO?<\/h2>\n
Rigor is essential in this role. Nevertheless, it’s essential to recognize that every career path is unique and has its own strengths to build on.<\/span><\/p>\nConclusion on the role of a DPO<\/h2>\n
\nHe or she must understand the challenges and processes of each department, and be able to work closely with the company’s senior management. Its recommendations will have an impact on the organization’s overall strategy.<\/span><\/p>\n
\nHe or she must also have a thorough knowledge of data protection<\/strong> legislation, and be able to understand and interpret laws and regulations and apply them to the company. <\/span><\/p>\n
\nHe or she must also be able to manage data security<\/strong> incidents and coordinate the company’s response. <\/span>.<\/span><\/p>\n<\/div>\n<\/div>\nAll about IT project governance<\/h2>\n
Also in our “IT project governance” issue <\/span><\/h3>\n
\n
A project? A request?A question?<\/h2>\n