IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Public sector 'risking GDPR violations' by overworking DPOs

Surging workloads for government data protection teams haven’t been matched with greater staffing

Public sector data protection officers (DPO) have been put under much greater strain since the rollout of GDPR, with swelling workloads not being matched with additional resources.

The lack of extra staffing for data protection teams, including central government and public sector agencies, is stretching workers too thinly and may result in GPDR violations if left unaddressed, research by eCase claims.

Although 70% of data protection officers (DPO) working across central government and public sector agencies reported a significant increase in their workloads, 40% reported their team sizes staying roughly the same.

With 93% of data protection staff also reporting a rise in the volume of internal requests, half of respondents reported their teams only growing by "a little".

"The non-alignment between government organisations’ resource and workload growth may be due to the expectation that the introduction of GDPR would only lead to a temporary spike in SARs, internal requests and other activities related to their new statutory duties," the report said.

"Central government bodies are therefore advised to address this divergence by either increasing their team resources or investing in fit for purpose tools to help them operate more efficiently," the report added. "Otherwise, their data protection teams risk becoming overstretched, which may result in non-compliance."

The report examined how the public sector has adapted to the rollout of GDPR in May 2018, with eCase inviting 213 DPOs across 231 central government departments, agencies and public bodies to complete a survey. The firm then conducted follow-up interviews with four respondents to gain more context.

Beyond handling a much greater workload without additional resources, DPOs suggested that gathering information in a timely manner, and finding that information in the first place, were also major challenges in fulfilling requests.

The report also examined how data protection staff managed data protection requests and subject access requests (SARs), and how confident they were in using each method. Just 13% of DPOs use specialist purpose-built commercial tools, while 33% process such requests manually using spreadsheets. 

Related Resource

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

While 54% of DPOs used in-house custom-build platforms to handle requests, this method inspired the least amount of confidence, with a third of DPOs lacking confidence in such tools. By contrast, no-one surveyed who uses either spreadsheets or purpose-built commercial tools expressed being wholly "unconfident" in such methods.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022