Who Owns These When Nobody Is a Specialist
Most employers have no data protection officer and do not need one. They do need somebody whose job this is, and usually nobody's is.
THE ROLE, WRITTEN DOWN
Half a page in somebody's objectives
- HoldsThe record, the notice, the schedule, the assessmentsOne person, all four
- Updates themWhen anything changes, not annuallyThe trigger is a change, not a date
- ReceivesSubject access requests, breach reportsA named route people can find
- DecidesWhether an assessment is needed before a new activityWith escalation where the answer is unclear
- ReportsTwice a year, to whoever governsFour numbers: requests, breaches, overdue items, changes
- TimeRoughly a day a month in a small organisationLess once the documents exist
- Not required to beA lawyer or a specialistThe work is organisation and attention
- Escalates toNamed external adviser for anything contestedHaving the name before you need it
The formal officer role is required in specific circumstances that most employers do not meet. The work still has to be done by somebody, and in most organisations it is done by nobody.
The practical lesson in “Who Owns These When Nobody Is a Specialist” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching how to measure employee productivity, the official product page can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
When the formal role is actually required
Public authorities. Organisations whose core activity is large-scale systematic monitoring. Organisations processing special category data on a large scale as a core activity.
For a separate benchmark relevant to “Who Owns These When Nobody Is a Specialist”, consult the WHO mental-health-at-work guidance. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Employment processing, even including health data, is generally not a core activity in that sense. Most employers are outside the requirement and many believe they are inside it, which produces an appointment nobody needed.
What is needed instead
Somebody whose objectives include it. Not a title, not a qualification, not a certificate — a named person with the time.
The work is maintaining four documents, receiving two kinds of request, and deciding when an assessment is needed. It is organisational rather than legal, which is why it does not require a specialist and does require attention.
Why it ends up unowned
It sits between functions. HR has the employment relationship, IT has the systems, finance has the suppliers, and the compliance work spans all three.
Each assumes somebody else has it. In a small organisation each assumes the owner has it, and the owner assumes it was handled when the policies were bought.
The result is documents that were produced once and have aged, which the consistency note describes from the other direction.
The realistic shape
A day a month while the documents are being built, considerably less afterwards.
A named external adviser for anything contested — found before a request arrives rather than during one, because the first difficult question is a bad time to be choosing a lawyer.
And a short report twice a year, which is what converts the role from a title into something anybody can see is happening.
The test
Ask who would receive a subject access request if it arrived this afternoon, and who would notice a breach at six on a Friday.
Where the answer is a function rather than a person, nobody has it.
The time it actually takes
A day a month while the documents are being built, considerably less afterwards. The work is organisation and attention rather than law, which is why it does not require a specialist and does require somebody named.
Finding the adviser before you need one
A named external contact for anything contested, identified in advance. The first difficult question is a bad time to be choosing a lawyer, and it is the moment most organisations do it.
The test for whether anybody owns it
Who would receive a request arriving this afternoon, and who would notice a breach at six on a Friday. Where the answer is a function rather than a person, nobody has it.
A day a month, then less
The work is maintaining four documents, receiving two kinds of request, and deciding when an assessment is needed. Organisational rather than legal, which is why it needs attention rather than a specialist.
What a short report contains
Requests received and answered on time, breaches reported and notified, overdue items, changes since last time. Four numbers, twenty minutes, twice a year.