Zansa › Answers › Privacy, security and ownership
Do I need a data protection officer for a small business?
Not necessarily. GDPR requires a data protection officer only in particular cases, such as public authorities or organisations whose core activities involve large-scale monitoring or large-scale sensitive data. Under POPIA, an information officer role exists and is by default the head of the organisation. This is general information, not legal advice.
Even without a formal DPO, someone should own privacy in the business, handle requests and be the contact for regulators and providers.
In South Africa, the information officer needs to be registered with the Information Regulator. Check whether you meet the criteria that apply in your country, and ask a qualified adviser if you are unsure. Rules differ by country and sector, so check how this applies to you with a qualified adviser.
Want this applied to your business? Zansa builds dashboards and forecasts for small and mid-sized companies worldwide. Start with a free intro call.
Book a call