Who is responsible?

Who is responsible for handling personal data? This is a recurring question in day-to-day consultancy. No one likes to take responsibility, especially for things that are difficult to understand, especially if they don't see the need for it. But it is an easy question to answer. It is always and in all cases the CEO, the board or a similar body that is responsible for ensuring compliance with data protection laws. This is true even if they have appointed an internal or external Data Protection Officer (DPO). The DPO will advise, review and monitor the necessary measures.

The DPO is the point of contact for employees, customers and authorities in the event of a data breach. The DPO is not responsible for implementing the measures within the company, as he or she does not have the authority or resources to do so. Ultimate responsibility always lies with senior management. Management is subject to sanctions and liability and must be able to assess the effectiveness of all measures. Therefore, anyone who believes that simply appointing a DPO will protect them from sanctions is sadly mistaken.