Fractional privacy officer

It requires the role to exist and to be held by someone. Under section 3.1 the person exercising the highest authority in the organization carries it, which means it lands on your CEO unless it is delegated in writing. Where it is delegated, the officer's title and contact details have to be published on your website, so the designation is a public fact. PIPEDA asks for an accountable individual as well. Truvo is not a law firm and this is not legal advice. Where an obligation turns on a contested reading, we name it for your counsel instead of guessing.

This is the question to settle with your counsel before anything is signed, and it is worth settling early. Section 3.1 places the responsibility on the person exercising the highest authority and allows it to be delegated to a member of the organization's personnel, which is not obviously the same thing as handing it to an outside supplier. The structure that avoids the argument is the one we use: your company keeps the designation with a named person inside it, and Truvo does the work of the role beside them, from the assessments through to the regulator contact. Your board still has a named owner and that owner is no longer carrying it alone.

A named senior practitioner, the same person month to month, and you meet them before you commit. Truvo's privacy line is led by co-founder Oksana Zbyranyk, whose background is third-party risk and security architecture. This is not a helpdesk queue and it is not a template pack with a mailbox behind it.

The assessment is a project with an end. It establishes which laws reach you, what you hold, where the gaps are, and what to do about them. This is the standing role afterwards. Most companies want the assessment first, because it is what tells you how much of an officer's week the role will take. Companies already carrying an obligation, or already asked by a customer or a regulator who their privacy officer is, tend to start here and fold the assessment into the first quarter.

Not as the statutory appointment. The GDPR's data protection officer is a defined role with its own independence and reporting conditions, and a company established outside the EU may also need an EU representative, which Truvo based in Ottawa cannot be. What we do cover is the work underneath: mapping what you hold about people in Europe, the assessments, the vendor and transfer reviews, and the answers your customers ask for. If your GDPR exposure is the reason you are reading this page, say so on the call and we will tell you plainly which parts we can hold and which you need somebody in Europe for.