Expert DPO support specialised for healthcare

The ICO says you must appoint one if you are a public authority, or if your core activities involve large-scale processing of special category data, such as health data, or large-scale, regular and systematic monitoring of individuals. That catches a good number of health technology companies, and NHS and enterprise buyers often expect one either way.

Yes, provided they have the expertise and can act without a conflict of interest. That’s hard in a small team, because the people who know the data best usually decide how it is used. If you’re not required to appoint a formal DPO, a smaller team may only need a data protection lead, who can be someone internal, ideally without a conflict of interest and with expert support available when they need it.

It can be either. UK GDPR allows you to appoint a member of staff, or an external DPO under a service contract, and an external DPO can be an individual or an organisation. Where an organisation provides the service, a named lead is assigned as your main contact, so you always know who to speak to.

Reviews your DPIAs, RoPA and privacy notices, advises on lawful basis and new processing, supports subject access requests, assesses breaches and reporting obligations, and answers your buyers’ data protection questions.

Time is set aside for your organisation each month, but that isn’t the only time your DPO is available. You can reach them whenever you need support, not just during set hours, and hours can be increased or decreased at any time, depending on your agreement.

Health data is special category data under UK GDPR, so you need an Article 9 condition as well as a lawful basis. Most processing of it is high risk, so DPIAs are usually required. Healthcare organisations also face NHS-specific requirements such as the Data Security and Protection Toolkit (DSPT), DTAC, the National Data Opt-out and the Caldicott principles. A DPO who knows the sector understands these requirements, and what NHS buyers expect to see.

A representative is your local point of contact for regulators and individuals when you’re not based where the people whose data you process are. If you’re based outside the UK but offer services to, or monitor, people in the UK, UK GDPR requires a UK representative. Likewise, a UK organisation serving people in the EU needs an EU representative. There is a narrow exemption for occasional, low-risk processing, but it doesn’t cover large-scale processing of health data. It’s a different role from a DPO, and we can provide both.

Contact your DPO straight away. They’ll help you contain it, assess the risk to the people affected, and decide whether it must be reported to the ICO, which has to happen within 72 hours of becoming aware of a reportable breach, and whether individuals need to be told. The decision and reasoning are recorded either way, so you can show how it was handled.

Yes. You can add the DPO service at any time, whether you’re just getting started with Assuric or have been using the platform for a while. Your DPO is set up in your existing workspace, so they can work from your records straight away.