Document management platforms used for contractor approval process a great deal of personal data: worker identification, medical fitness certificates, training certificates and access records. Therefore, data protection cannot be a secondary issue. In this context, the data protection officer plays an essential role.
However, the terminology needs clarifying. In the Portuguese version of the GDPR, this role is called encarregado da proteção de dados (EPD), better known by the English acronym DPO. It should not be confused with the controller, which is the organisation itself. In this article, we explain when appointing a DPO is mandatory, what the role involves and how it works when document management platforms are used.
When appointing a DPO is mandatory
Article 37 of the GDPR makes the appointment mandatory in three situations:
- where processing is carried out by a public authority or body;
- where the core activities consist of operations that require regular and systematic monitoring of data subjects on a large scale;
- where the core activities consist of large-scale processing of special categories of data, such as health data.
Consequently, not every company using an approval platform is required to appoint a DPO. Nevertheless, many choose to do so voluntarily or appoint an internal point of contact, especially when they process large volumes of data on external workers. In Portugal, Law no. 58/2019 supplements these rules.
Duties of the data protection officer
Article 39 of the GDPR sets out the DPO’s tasks. In short, the DPO should:
- inform and advise the organisation and its employees about their obligations;
- monitor compliance with the GDPR and with internal policies;
- provide advice on data protection impact assessments and monitor their performance;
- cooperate with the CNPD and act as its contact point;
- act as the contact point for data subjects on issues relating to their data.
It is important to stress that the DPO advises and monitors, but is not personally responsible for compliance. Responsibility lies with the organisation, as the controller. Furthermore, the DPO must act independently, cannot receive instructions on how to perform the role and must have the necessary resources.
The role of the data protection officer in contractor approval platforms
When choosing the platform
The DPO should be involved from the outset. For example, they can assess data location, the supplier’s sub-processors, security measures and the contract required by Article 28. In this way, the organisation avoids choosing a solution that later requires difficult changes.
When defining the documents requested
One of the most valuable contributions is applying the data minimisation principle. The DPO helps to define which documents are truly necessary and on what basis. For example, fitness certificates should only state whether the worker is fit, without diagnoses. Likewise, copies of identity documents should only be requested when strictly essential.
When defining the lawful bases
In contractor approval, processing is usually based on compliance with legal obligations, such as occupational health and safety duties, or on the company’s legitimate interest in keeping its premises safe. Consent is rarely the appropriate basis, because the worker has no genuine freedom of choice. Consequently, the DPO should help document the correct basis for each purpose.
Data subject rights and incidents
The DPO oversees requests for access, rectification or erasure, ensuring a response within one month. Similarly, they take part in assessing data breaches and in deciding whether to notify the CNPD within 72 hours.
The relationship with the platform supplier
When an external company supplies the platform, at least two organisations are involved in the processing. As a rule, the contracting company is the controller and the supplier acts as processor. Accordingly, the DPO should check that the contract clearly sets out processing instructions, security measures, confidentiality, the list of other processors and what happens to the data when the service ends.
In addition, the DPO should know the contact details of their counterpart at the supplier, where one exists. As a result, in the event of an incident or a data subject request, cooperation is fast and legal deadlines are met. Likewise, periodic supplier reviews, for example through questionnaires or audit reports, should form part of the DPO’s work plan.
Information for contractors’ workers
Workers employed by subcontracted companies are also data subjects and have the right to be informed. However, they often have no direct relationship with the contracting company. For this reason, the DPO should help define how the information reaches them. For example, a privacy notice can be made available on the platform and handed over by the contractor when documents are collected. This notice should state who processes the data, for what purposes, for how long and how to exercise rights. In this way, the company meets its transparency obligation and reduces doubts and complaints.
Practical example: Reviewing the documents requested
Consider a company that, when implementing an approval platform, asked contractors for a copy of each worker’s ID card, medical file and criminal record. The DPO analyses the process and concludes that most of these documents are not necessary for the purpose.
Following this analysis, the company now requests only essential identification, the fitness certificate and the training required for each task. It then sets retention periods and limits access to validators. As a result, it reduces risk, simplifies contractors’ work and complies with the data minimisation principle.
Data protection training and culture
The DPO cannot guarantee data protection alone. Indeed, anyone who validates documents, configures the platform or responds to contractors makes daily decisions that affect privacy. One of the DPO’s most important tasks is, therefore, raising awareness among teams. For example, this can be done through short training sessions on what may and may not be requested, how to respond to an access request and what to do when an incident is suspected. In addition, practical guides and FAQs help make the rules clear to everyone.
Data protection checklist for contractor approval
- Assessment of whether a DPO must be appointed.
- Up-to-date record of processing activities.
- Lawful basis defined for each purpose.
- Document list limited to what is necessary.
- Retention periods configured on the platform.
- Supplier contract compliant with Article 28.
- Information provided to contractors’ workers.
- Procedure for data subject requests and incidents.
Common mistakes to avoid
A frequent mistake is to make the DPO responsible for compliance, as if the organisation were exempt. Another is to appoint someone with conflicts of interest, such as the IT director who decides on the processing itself. Furthermore, many companies use consent as the default basis, which weakens the lawfulness of processing.
Frequently asked questions
Can the DPO be external?
Yes. The GDPR allows the DPO to be a member of staff or an external service provider, provided they have the necessary expertise and independence.
Does the appointment have to be notified to the CNPD?
Yes. The organisation must communicate the DPO’s contact details to the supervisory authority and publish them, for example in its privacy policy.
Can the organisation hold the DPO liable for its failures?
As a rule, no. The GDPR protects the DPO against penalties related to performing their tasks. Responsibility for compliance lies with the organisation, as the controller.
What training should the DPO have?
The GDPR requires expert knowledge of data protection law and practices. In general, it is advisable to combine legal knowledge, information security expertise and an understanding of the organisation’s own processes.
Conclusion
The data protection officer plays a decisive role when document management platforms are used for contractor approval. The DPO advises on choosing the platform, helps define documents and lawful bases, oversees data subject rights and takes part in incident response.
Even so, responsibility for compliance remains with the organisation. Therefore, companies should give the DPO independence, resources and involvement from the start of projects. In this way, contractor approval becomes safer, simpler and more respectful of workers’ rights.
Read also: Adapting document management platforms to GDPR guidelines and The importance of the GDPR in developing document management platforms.
For more information on the duties of the data protection officer, see the Portuguese Data Protection Authority (CNPD).