Public sector 'risking GDPR violations' by overworking DPOs

Surging workloads for government data protection teams haven’t been matched with greater staffing

Public sector data protection officers (DPO) have been put under much greater strain since the rollout of GDPR, with swelling workloads not being matched with additional resources.

The lack of extra staffing for data protection teams, including central government and public sector agencies, is stretching workers too thinly and may result in GPDR violations if left unaddressed, research by eCase claims.

Although 70% of data protection officers (DPO) working across central government and public sector agencies reported a significant increase in their workloads, 40% reported their team sizes staying roughly the same.

With 93% of data protection staff also reporting a rise in the volume of internal requests, half of respondents reported their teams only growing by "a little".

"The non-alignment between government organisations’ resource and workload growth may be due to the expectation that the introduction of GDPR would only lead to a temporary spike in SARs, internal requests and other activities related to their new statutory duties," the report said.

"Central government bodies are therefore advised to address this divergence by either increasing their team resources or investing in fit for purpose tools to help them operate more efficiently," the report added. "Otherwise, their data protection teams risk becoming overstretched, which may result in non-compliance."

The report examined how the public sector has adapted to the rollout of GDPR in May 2018, with eCase inviting 213 DPOs across 231 central government departments, agencies and public bodies to complete a survey. The firm then conducted follow-up interviews with four respondents to gain more context.

Beyond handling a much greater workload without additional resources, DPOs suggested that gathering information in a timely manner, and finding that information in the first place, were also major challenges in fulfilling requests.

The report also examined how data protection staff managed data protection requests and subject access requests (SARs), and how confident they were in using each method. Just 13% of DPOs use specialist purpose-built commercial tools, while 33% process such requests manually using spreadsheets. 

Related Resource

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

While 54% of DPOs used in-house custom-build platforms to handle requests, this method inspired the least amount of confidence, with a third of DPOs lacking confidence in such tools. By contrast, no-one surveyed who uses either spreadsheets or purpose-built commercial tools expressed being wholly "unconfident" in such methods.

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Recommended

Data: A resource much too valuable to leave unprotected
Whitepaper

Data: A resource much too valuable to leave unprotected

2 Dec 2020
Webhose and Signal Corp boost data breach detection
Security

Webhose and Signal Corp boost data breach detection

7 Oct 2020
ICO to relax GDPR enforcement during coronavirus economic downturn
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
The NHS teams up with Apple and Google on coronavirus tracking app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020

Most Popular

350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020
46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
Samsung Galaxy Note might be discontinued in 2021
Mobile Phones

Samsung Galaxy Note might be discontinued in 2021

1 Dec 2020