Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow him during audits.
Add a comment
|
1 Answer
GDPR Art 38(2) says:
The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
So yes, the company is required to provide “access to personal data and processing operations”.
But it doesn't follow that the DPO must have uncontrolled access to anything. If the DPO were given read-access to all IT systems and keys to all cabinets, that could be a violation of the controller's obligation to implement appropriate technical and organisational measures (cf Art 24 & 32). If a DPO were to receive such uncontrolled access, that's probably one of the first things that the DPO should advise against.
Instead, it is probably sufficient if the DPO can get access to any data on demand.
The EDPB-endorsed WP29 guidelines on DPOs (document WP243) expand on that GDPR article and mention that the DPO shall receive:
Necessary access to other services, such as Human Resources, legal, IT, security, etc., so that DPOs can receive essential support, input and information from those other services.
While far from explicit, this also seems to support the idea that the DPO can request information from other parts of the company, and need not have direct access.
It may be worth remarking that a DPO's activities are not limited to “audits”. Art 39 provides a range of responsibilities, and the DPO can fulfill them however they see fit. While this will likely include formal audits, the DPO shall have access at any time as long as this access is necessary for the DPO's duties.
