“DPO”, “GDPR”, “ISSP”: many school heads and town hall secretariats type these words into a search engine without really knowing what they cover — until an audit, a complaint, or a question from a parent forces them to look into it. Here’s what you need to know, and how GET Conseil supports schools and town halls across Hauts-de-France on this topic.
What a DPO is, and why your organisation must have one
The DPO (Data Protection Officer) is the person responsible for ensuring GDPR compliance within an organisation: informing and advising on legal obligations, checking that data processing is compliant, and acting as the point of contact with the CNIL (France’s data protection authority) and with the people concerned (pupils, families, residents).
This isn’t optional for schools and town halls. Article 37 of the GDPR requires every public authority or body to appoint a DPO. A public school or town hall that hasn’t yet appointed one is therefore in breach, whether it realises it or not.
Why this obligation is often discovered too late
In many organisations, no one has the time or training to keep a close eye on this topic. The DPO obligation has existed since the GDPR came into force in 2018, but it remains largely unknown in small public bodies: a town hall serving a few thousand residents, or a standalone school, doesn’t necessarily have a dedicated legal or IT department to handle it.
The result: the question often comes up at the worst possible moment — during a CNIL audit, a complaint, or a security incident (data theft, cyberattack) that reveals no one was actually responsible for the topic.
In-house, shared or outsourced DPO: which option to choose?
Three options exist, depending on the size and resources of the organisation:
- In-house DPO: a staff member, trained to carry out this role alongside their existing position.
- Shared DPO: several towns or organisations share the same DPO — a common solution between small town halls.
- Outsourced DPO: a specialist provider takes on the role on behalf of the organisation.
The right choice depends on the size of the organisation, the volume of data processed, and the internal resources available. GET Conseil helps you understand this obligation and points your organisation towards the most suitable option — without acting as the DPO itself.
The ISSP: the technical side many forget
Appointing a DPO isn’t enough if the information system behind it isn’t actually secure. That’s where the ISSP (Information System Security Policy) comes in: the framework document that sets out the concrete rules for protecting data and the IT system — who has access to what, how backups are managed, how to respond to an incident (outage, cyberattack, data loss), and how to train teams in the right habits.
The ISSP is the practical counterpart to Article 32 of the GDPR, which requires “appropriate technical and organisational measures” to secure personal data. Without an ISSP that’s actually applied, an appointed DPO can’t guarantee real compliance — they lack the technical foundation to build on.
This is precisely the part GET Conseil takes care of: auditing the existing setup, securing the information system, backup and incident-response procedures, access management, and staff training.
Our support, step by step
- Assessment: has a DPO already been appointed? What data processing exists (pupil records, resident records, video protection)? What’s the current state of information system security?
- Guidance towards the right DPO setup: in-house, shared between several towns, or outsourced, depending on your organisation.
- Setting up the ISSP: the concrete technical foundation of your compliance, handled end-to-end by GET Conseil.
You can find out more about our DPO & ISSP support for schools and town halls, or contact us directly to review your situation.
Frequently asked questions
Is a school or town hall really required to have a DPO?
Yes. Article 37 of the GDPR requires every public authority or body — which includes public schools and town halls — to appoint a Data Protection Officer.
What’s the difference between a DPO and the ISSP?
The DPO is a person (or role) responsible for ensuring GDPR compliance. The ISSP is a framework document that sets out the concrete technical and organisational rules for information system security. The two are complementary: the DPO needs a solid ISSP to be able to guarantee real compliance.
Can GET Conseil be our DPO?
No. GET Conseil helps you understand this obligation and appoint a DPO suited to your organisation (in-house, shared or outsourced). We take care of setting up your ISSP, the technical side of your IT security.
What’s the risk for an organisation with no appointed DPO?
A GDPR breach, which exposes the organisation to a risk of sanction from the CNIL in the event of an audit or complaint.