Public sector 'risking GDPR violations' by overworking DPOs

Surging workloads for government data protection teams haven’t been matched with greater staffing

Public sector data protection officers (DPO) have been put under much greater strain since the rollout of GDPR, with swelling workloads not being matched with additional resources.

The lack of extra staffing for data protection teams, including central government and public sector agencies, is stretching workers too thinly and may result in GPDR violations if left unaddressed, research by eCase claims.

Although 70% of data protection officers (DPO) working across central government and public sector agencies reported a significant increase in their workloads, 40% reported their team sizes staying roughly the same.

With 93% of data protection staff also reporting a rise in the volume of internal requests, half of respondents reported their teams only growing by "a little".

"The non-alignment between government organisations’ resource and workload growth may be due to the expectation that the introduction of GDPR would only lead to a temporary spike in SARs, internal requests and other activities related to their new statutory duties," the report said.

"Central government bodies are therefore advised to address this divergence by either increasing their team resources or investing in fit for purpose tools to help them operate more efficiently," the report added. "Otherwise, their data protection teams risk becoming overstretched, which may result in non-compliance."

The report examined how the public sector has adapted to the rollout of GDPR in May 2018, with eCase inviting 213 DPOs across 231 central government departments, agencies and public bodies to complete a survey. The firm then conducted follow-up interviews with four respondents to gain more context.

Beyond handling a much greater workload without additional resources, DPOs suggested that gathering information in a timely manner, and finding that information in the first place, were also major challenges in fulfilling requests.

The report also examined how data protection staff managed data protection requests and subject access requests (SARs), and how confident they were in using each method. Just 13% of DPOs use specialist purpose-built commercial tools, while 33% process such requests manually using spreadsheets. 

Related Resource

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

While 54% of DPOs used in-house custom-build platforms to handle requests, this method inspired the least amount of confidence, with a third of DPOs lacking confidence in such tools. By contrast, no-one surveyed who uses either spreadsheets or purpose-built commercial tools expressed being wholly "unconfident" in such methods.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Apple patches zero-day flaw abused by infamous NSO exploit

Apple patches zero-day flaw abused by infamous NSO exploit

14 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021