Public sector 'risking GDPR violations' by overworking DPOs

Surging workloads for government data protection teams haven’t been matched with greater staffing

Public sector data protection officers (DPO) have been put under much greater strain since the rollout of GDPR, with swelling workloads not being matched with additional resources.

The lack of extra staffing for data protection teams, including central government and public sector agencies, is stretching workers too thinly and may result in GPDR violations if left unaddressed, research by eCase claims.

Although 70% of data protection officers (DPO) working across central government and public sector agencies reported a significant increase in their workloads, 40% reported their team sizes staying roughly the same.

With 93% of data protection staff also reporting a rise in the volume of internal requests, half of respondents reported their teams only growing by "a little".

"The non-alignment between government organisations’ resource and workload growth may be due to the expectation that the introduction of GDPR would only lead to a temporary spike in SARs, internal requests and other activities related to their new statutory duties," the report said.

"Central government bodies are therefore advised to address this divergence by either increasing their team resources or investing in fit for purpose tools to help them operate more efficiently," the report added. "Otherwise, their data protection teams risk becoming overstretched, which may result in non-compliance."

The report examined how the public sector has adapted to the rollout of GDPR in May 2018, with eCase inviting 213 DPOs across 231 central government departments, agencies and public bodies to complete a survey. The firm then conducted follow-up interviews with four respondents to gain more context.

Beyond handling a much greater workload without additional resources, DPOs suggested that gathering information in a timely manner, and finding that information in the first place, were also major challenges in fulfilling requests.

The report also examined how data protection staff managed data protection requests and subject access requests (SARs), and how confident they were in using each method. Just 13% of DPOs use specialist purpose-built commercial tools, while 33% process such requests manually using spreadsheets. 

Related Resource

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

While 54% of DPOs used in-house custom-build platforms to handle requests, this method inspired the least amount of confidence, with a third of DPOs lacking confidence in such tools. By contrast, no-one surveyed who uses either spreadsheets or purpose-built commercial tools expressed being wholly "unconfident" in such methods.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022