Built for Regulated Health Tech

Under GDPR, the data protection officer (DPO) can be thought of as the champion of data subject rights. That is, she is the person upholding the privacy rights of the end users of your application. The GDPR makes it very clear what a DPO must do: (1) Inform the company and their staff what their duties are under GDPR and related regulations. (2) Monitor their compliance with GDPR, including assigning responsibilities and ensuring staff are appropriately trained (3) Providing advice relating to the data protection impact assessment (DPIA) and ensuring the company complies with it. (4) Cooperate with the supervising data protection authority.

SARs (Subject Access Requests) allow individuals to access personal data an organization holds about them. DSRs (Data Subject Requests) cover broader rights, like data rectification or deletion.

A DPO can help identifying and solving a wide range of topics, such as: (1) Assessing whether your providers are compliant. Under GDPR, you need to make sure all your providers and contractors are themselves compliant with GDPR. (2) Responding to data subject rights requests. One of the most important things a DPO can do is help you respond to requests regarding the rights of data subjects. (3) Maintaining your GDPR documentation. There are a number of key documents relating to GDPR and some of these are mandatory (e.g. privacy policy or records of processing activities) and some are only needed in some cases (e.g. DPIA).

GDPR is a European regulation designed to protect personal data. For startups in digital health dealing with sensitive information, compliance is crucial to avoid fines and protect user trust.

There are various strict requirements about who can act as your DPO. For a start, they must be an expert in data privacy law. That means knowing GDPR inside-out. Then there’s the requirement to be independent. That means they can’t have an executive role in the company. Otherwise, they wouldn’t be acting on behalf of the data subjects. Thirdly, the DPO must be in a position to provide advice whenever needed. Importantly, the GDPR does allow you to outsource your DPO role. That’s particularly helpful for startups who typically struggle to find someone internally that matches the requirements above.

Currently the platform is in English, and we are working on our German and Italian versions - our experts speak multiple languages, if you are in need of any in particular feel free to ask!