The question of appointing a DPO has historically been conducted with a careful analysis of EU or UK GDPR requirements. Today, however, it is considered as best practice and even a key factor of customer trust to designate a DPO (even for B2B businesses). Appointing a DPO also has the advantage of offering the supervisory authority a preferred contact point in the event there is a data breach or other data protection issue.

There are many similarities between data protection regulations and requirements of the AI Act. Companies are today adapting their existing data protection governance structure to meet these new requirements although many data protection specialists may not have the necessary skill set to address the specificities and technical nature of conducting conformity assessments for AI systems. The first step therefore is to assess the delta between the current structure and the required structure while identifying training requirements for existing staff, or perhaps the hiring of specialists depending on the business risk profile (i.e. high risk AI systems).

One of the fundamental shifts of the EU GDPR since 2018, which has also been confirmed via supervisory authority fines, is that processors can also be held fully liable for non-compliance with data protection regulations. Data controllers are increasingly imposing stricter contractual requirements on data processors – mandatory ISO certifications are not uncommon – and indemnity clauses are becoming increasingly onerous on data processors. To make matters worse, there is more scrutiny on subprocessors – the vendors that the data processor uses – to be fully compliant with data protection regulations and adhere to the same terms of the underlying contract between the data controller and data processor.

Our data protection lawyers based in Paris have significant experience with implementing Binding Corporate Rules (BCRs). It’s important to keep in mind that the regulatory review and approval process can take several years, and the estimated budget can be significant. This is why our firm often recommends adopting standard contractual clauses (SCC) or other mechanisms such as adhering to the EU-US Data Privacy Framework as interim measures while the BCR application is being reviewed and processed. Once approved, the BCR can be a genuine market differentiator since they are viewed as the gold-standard of compliance with data protection regulations and intragroup cross-border data transfers.