"Interview questions" for an external DPO service

[enjay]

We're outsourcing our DPO role and have prospective suppliers coming in soon. What sort of questions should I be asking them? (I have got the start of a list, but don't want to steer things by sharing that) Edited April 16, 2018 by enjay

[CC359]

I came across this PDF a while ago, I hope it might be helpful.

http://2040training.co.uk/wp-content/uploads/2017/12/DPO-Guide.pdf

[DODICT]

I'd be asking them how long they have been working in the world of data protection - if it doesn't precede the proposal of GDPR then its a no from me ! A lot of start ups with little experience popping up all over the shop.

 

The chap behind 2040 has a blog which makes great reading - its an interesting and amusing read which is not something I say often about data protection blogs ! And he has some very clear thoughts on the new wave of 'GDPR compliant' data protection experts . . .

 

https://2040infolawblog.com/

Edited April 16, 2018 by DODICT

[enjay]

I'd be asking them how long they have been working in the world of data protection - if it doesn't precede the proposal of GDPR then its a no from me ! A lot of start ups with little experience popping up all over the shop.

 

Good idea, that one hadn't occurred to me!

[pete]

• What's the SLA? How quickly can they respond? Do they have an on-call rota for out-of-hours?
  
• How much time are you getting for what you're paying (say in a breach situation)?
  
• Does initial cost (getting all the ducks in a row) cost more or less than ongoing costs (keeping things ticking over nicely)?
  
• Are they spending time on-site, or is it going to be done via email / phone?
  
• Do we have a specific person assigned to our account?
  
• What are the DPO <> client ratios (for same reasons as above)?
  
• Is this a new service they're offering? If so, how many people at $supplier can provide this service? Is there adequate holiday cover, so you don't run into "er.....Bob's off skiing" problems.
  
• Does it include (at least) annual audits?
  
• I'd also check out the suppliers to see if they (as a company) walk the walk.