Provision of Data Protection Officer Services

To retain on contract for 12 hours a month a suitably qualified and experienced person to act as the Data Protection Officer (DPO) for Skills Development Scotland (SDS), as required by UK GDPR.

In the absence of appropriate internal staff resource within SDS with the requisite skills and expertise, independence (i.e. is not conflicted) and capacity to undertake the role of Data protection Officer (DPO) SDS is seeking to retain a company to provide DPO-as-a-service, which must adequately fulfil the requirements for the role set out in guidance by the Information Commissioner’s Office (ICO).

Specific Objectives of this Commission.

• Up to 12 hours of data protection services to be provided per calendar month. Additional hours may be requested as required and may include emergency situations, out with office hours and at weekends.
• Work with the information provided by the SDS DP Team in a way that maintains its confidentiality.
• Services to include weekly engagement and close liaison with the SDS DP team and Legal team and ad-hoc engagement, as required, in order to:

1. Monitor compliance with applicable data protection laws and with SDS priorities in relation to the protection of personal data;

2. Support reporting and provide expert DP advice to SDS senior management and governance groups where required on an ad-hoc basis for our internal governance requirements, and would also include participation / advising in managing cyber incidents / data breaches, data protection compliance;

3. Support investigations as required into personal data breaches, breaches of legislation and/or SDS’s DP Policy, including remedial action where needed. This could include advice on direction and completeness of action taken by DP team and participation in lesson learned reviews to identify any potential improvements to policy & process;

4. Provide expert advisory input on DPIAs, Privacy Notices, Data Sharing Agreements/Data Processing Agreements, to ensure that SDS’s personal data processing and data sharing with partners is lawful and appropriately documented;

5. Support timely responses to any complaints relating to the Data 6. Protection and Data Subject Requests (DSRs) within 2 working days, in particular advising as needed on complex DSRs;

6. Support timely and informed engagement with the ICO in line with our requirements to report breaches to ICO within 72hrs;

7. Contribute to the review of DP guidance and training material and support any improvement action arising;

8. Support ongoing maintenance of SDS’s Record of Processing Activity (ROPA), identifying and supporting implementation of improvement activity as appropriate;

9. Ensure SDS are kept up to date with any developing requirements or changes in relevant legislation

10. Delivery of any other data protection tasks as may be required of the role of the DPO.

11. Monitor the DP team mailbox on the rare occasion when the substantive team is absent

12. Provide training to the organisation annually to raise awareness of data protection issues and responsibilities

13. Quarterly reviews of ICO rulings and guidance

14. Ensure cover/contingency for external resource and expertise to fulfil the formal role of DPO.. N/A