Getting Management To Care About GDPR

Summary

Management should care about GDPR because the controller must demonstrate compliance, and in practice that means the board sets the resources, policies, and risk appetite behind it. Article 24 requires appropriate measures, Article 38(3) gives the data protection officer a direct line to the highest management level, and in the UK directors can face personal liability for certain offences.

This guide explains where the GDPR places responsibility, what the law says about management and the DPO, how personal liability works in the UK, and seven actions a board can take. It applies to the GDPR, and the UK GDPR follows the same core rules.

Key Takeaways

•  The GDPR makes the controller responsible for compliance and for being able to prove it. Only management can fund the people, tools and training that proof depends on.

•  The DPO must report directly to the highest management level, must not be told how to do the job, and must not be dismissed or penalised for doing it (Article 38(3)).

•  In the UK, section 198 of the Data Protection Act 2018 can make a director personally guilty of an offence under that Act when a company commits it with the director’s consent or connivance, or through the director’s neglect.

The Organisation Is Accountable, so Management Is Answerable

Article 5(2) says the controller is responsible for compliance with the data protection principles and must be able to demonstrate it. That is the accountability principle. It applies to the organisation, and an organisation acts through its management.

A policy that exists on paper does not meet the test. The controller must show it applies the policy, and that depends on budget, staff time, and clear ownership. Those are management decisions.

Our guide to GDPR implementation covers the practical steps.

Article 24 Expects Measures That Management Funds and Reviews

Article 24(1) requires the controller to implement appropriate technical and organisational measures to ensure, and demonstrate, that processing follows the GDPR. The measures must take into account the nature, scope, context and purposes of processing and the risks to individuals. They must be reviewed and updated where necessary.

Article 24(2) adds that, where proportionate, the measures include data protection policies. Article 25 requires data protection by design and by default, and Article 32 requires security appropriate to the risk.

Each of these needs someone with authority to approve spending, set priorities and accept residual risk. If that person is not in the room when decisions are made, the measures tend to lag behind the business.

The DPO Has a Direct Line to the Highest Management Level

Article 37 requires a DPO in three cases: a public authority; an organisation whose core activities involve regular and systematic monitoring of individuals on a large scale; and an organisation whose core activities involve large-scale processing of special category or criminal offence data. Our page on the DPO role explains whether you need one.

Article 38 sets the DPO’s position. The controller must:

•  involve the DPO properly and in good time in all issues that relate to data protection;

•  provide the resources needed to carry out the tasks and to keep expert knowledge up to date;

•  make sure the DPO receives no instructions on how to carry out those tasks;

•  not dismiss or penalise the DPO for performing them; and

•  let the DPO report directly to the highest management level.

Under Article 39, the DPO monitors compliance, including assigning responsibilities, raising awareness, staff training, and related audits. A board that never hears from its DPO is not using the role as the law intends.

Regulators Weigh the Measures an Organisation Took

Article 83(2) lists the factors a supervisory authority considers when deciding whether to impose an administrative fine and how large it should be. They include whether the infringement was intentional or negligent, any action taken to mitigate the damage, and the degree of responsibility of the controller or processor, taking into account the technical and organisational measures implemented under Articles 25 and 32.

Article 82 separately gives individuals a right to compensation for damage caused by an infringement. These provisions show why a documented, funded programme matters. It shows how seriously the organisation took its duties.

This guide does not quote fine amounts. Check Articles 83 and 84 and your national law for the current position.

Directors Can Face Personal Liability in the UK

Section 198 of the Data Protection Act 2018 applies where a body corporate commits an offence under that Act. If it is proved that the offence was committed with the consent or connivance of, or is attributable to neglect on the part of, a director, manager, secretary or similar officer, that person is also guilty of the offence and can be punished accordingly.

Two limits are worth knowing. The section covers offences under the Act, such as unlawfully obtaining personal data, and it does not turn every GDPR infringement into a personal offence. It also requires proof of consent, connivance or neglect.

The GDPR’s compensation and fining provisions (Articles 82 and 83) target controllers and processors. Any personal liability of directors under the GDPR regime depends on national law, so take local advice for each country you operate in.

Other Laws Put Duties on Management Bodies

Data protection is not the only area where the law now addresses the board. Article 20 of the NIS2 Directive (Directive (EU) 2022/2555) requires Member States to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements of Article 21. Members of those bodies must also follow training.

The Directive leaves national liability rules for public institutions and officials untouched. Check the Directive text and your national transposing law to see whether your organisation is in scope and what sanctions apply.

For in-scope organisations, GDPR and NIS2 duties overlap on security and breach handling. Management attention to one helps with the other. See our guide to data breach reporting for the GDPR notification rules.

Seven Actions Put Management Oversight Into Practice

A board does not need to run the programme day to day. It needs to set direction and check that it works. Seven actions help:

•  Compliance programme: approve a programme with a named owner, a budget and a reporting line to the board.

•  Workplace policies: adopt policies on acceptable use, remote working, retention and incident reporting, and apply them to management as well as staff.

•  Security and data handling: require security measures suited to the risk, and ask for evidence that they are tested.

•  Individual rights: make sure requests for access, erasure and objection reach the right person and are answered within the legal time limit.

•  Audits: commission regular reviews, such as a GDPR audit, and track the findings to closure.

•  Training: give all staff training suited to their role, and give directors a briefing on their own duties.

•  Third parties: review processor contracts and ask which suppliers handle personal data. Our guide to controllers and processors explains the roles.

For high-risk projects, ask whether a data protection impact assessment was done before launch.

Data Governance Gives Management Something to Review

Management cannot oversee what it cannot see. A basic data governance structure gives it a view of what personal data the organisation holds, where it sits, who can access it and how long it is kept.

Useful outputs include a record of processing activities, a risk register, a breach log and a short quarterly report to the board. Article 30 requires records of processing for many organisations, so much of this exists already or is required anyway.

A short, regular report is easier to act on than an annual document. Ask for numbers: open data subject requests, incidents, overdue actions and training completion.

A Compliant Programme Supports the Business

The management case is practical. A tested breach plan can shorten response time when an incident occurs. A clear record of processing makes procurement, due diligence, and customer questionnaires easier to answer. Documented decisions help show what the organisation did if a regulator asks questions.

None of these benefits is automatic. They follow from a funded, owned, and reviewed programme.

Conclusion

Management cares about GDPR when it sees the link to its own duties: the controller must demonstrate compliance, the DPO reports to the highest management level, regulators look at what the organisation did, and in the UK some offences can reach directors personally. The board does not need to become a privacy team. It needs to fund the programme, receive regular reports and act on them.

We are updating this guide because the original made an unsubstantiated general claim about national laws on director liability, and because it did not reference the legal provisions that impose duties on management. Review your reporting line to the board against these points, and speak to our GDPR consultants if you want a second opinion.

Frequently Asked Questions

Is Management Personally Liable Under the GDPR?

The GDPR places its duties on controllers and processors, which are usually organisations. Personal liability depends on national law. In the UK, section 198 of the Data Protection Act 2018 can make a director guilty of an offence under that Act where the company committed it with the director’s consent or connivance, or through their neglect.

Who in the Organisation Is Responsible for GDPR Compliance?

Under Article 5(2) and Article 24, the controller is responsible, and in practice that is the organisation acting through its management. The DPO monitors and advises, and does not carry the controller’s responsibility. Management decides on resources and accepts the risk.

Does a Company Need a DPO to Involve Management?

No. Only some organisations must appoint a DPO under Article 37. Every controller still has the Article 24 duty to implement and review appropriate measures, so management needs a data protection reporting line whether or not a DPO is required.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.