Skip to main content

What is the role of the Data Protection Authority?

Answer

One of the roles of the DPA is to publish expert advice on data protection issues. It informs the general public on the rights and obligations related to data protection and in particular the General Data Protection Regulation (GDPR). One relevant example is the obligation imposed on the DPAs to establish and make public a list of processing operations that require a data protection impact assessment. Some DPAs have already established handbooks and other tools to help businesses understand their obligations under the GDPR and individuals understand their rights. In addition,  Article 29 Working Party, which is the group of national European DPAs (which will be replaced by the European Data Protection Board), has produced a number of documents interpreting the provisions of data protection law. The DPA can’t, however, give advice in individual cases or replace a competent lawyer.

Your company/organisation does not need to notify the DPA that it process data. However, prior consultation with the DPA is required when a DPIA indicates that the processing of the data would pose a high risk and residual risks remain despite the implementation of several safeguards. Your company/organisation would also need to contact the DPA in the case of a data breach. For some specific types of data processing, national laws might still require your company/organisation to obtain an authorisation from your DPA.

Example

You own a shop selling household goods. You process client data such as delivery addresses and billing details required in the nature of your business. In this case you don’t need to notify the DPA.