When you engage a DPO through Asiri, they act as your data protection officer inside your workspace. They can be an individual DPO, or a DPCO firm that supplies a named DPO. A DPO engagement is not an audit.
How a DPO gets in
A DPO reaches your workspace only through an engagement for Act as your data protection officer. You approve the access and choose which registers they may reach. They see only what you granted, never your whole workspace.
Engaging a practice is a separate step from appointing a person. To record the officer as your DPO, open Programmes on the rail, open your programme and choose DPO responsibilities. Then press Appointment. The page is headed DPO appointment. An engaged practice whose officer is not yet appointed is listed under Engaged, not yet appointed. Use Review candidate independence, then Record an appointment.
What an engaged DPO can do
Within the registers you granted, the DPO can:
- read your records and edit them
- export a record
- ask for evidence, and answer evidence requests from an auditor
- record a breach notice to the Commission
- keep internal working notes on your file
- read an audit on your workspace and answer what it asks of you
An individual DPO can also propose a change of scope, for example when a request goes beyond the retainer. You decide whether to accept it.
A DPO does not administer your workspace. They cannot change its settings or add people.
What a DPO cannot do
Under a DPO engagement, the DPO cannot:
- open an audit, plan or perform tests, or raise audit findings
- sign an audit opinion
- file your annual return
Those need a licensed DPCO firm engaged to audit, or to file. An individual DPO may never file.
A DPO and an auditor
The roles stay separate. An auditor who edits the records they audit has destroyed what they were engaged to attest, so an audit engagement cannot edit your registers. A DPO can, because that is the work.
The firm that audits you also cannot audit work it did for you. Its independence register blocks a practice from assuring its own remediation.
Common questions
"Can our DPO file the annual return?" No. Filing needs a licensed DPCO firm engaged to file.
"Can our DPO help us prepare for an audit?" Yes. They can keep your registers current and answer the auditor's evidence requests. They cannot perform the audit.
"Can we take a register away from the DPO?" Yes. Their access is the authority you granted. Adding a register needs a fresh authorisation, and you can withdraw the authority at any time.