Under the PDPL, a Data Protection Officer is required where an organisation is a public entity processing personal data at scale, a trigger that captures most giga-project developers and public sector bodies operating at national scope. The law allows that DPO to be an internal hire or an external provider, but the accountability expectations placed on public entities make an under-resourced or informal appointment a particularly visible gap.

Why public sector and giga projects need a dedicated DPO

  • Public entity status processing personal data at scale, meeting the PDPL's mandatory appointment trigger directly
  • Smart city and IoT infrastructure capturing personal data through sensors, access systems and monitoring platforms
  • Large, often multinational, contractor and workforce ecosystems generating HR, biometric and site access data
  • Public visibility that raises the reputational and regulatory stakes of any governance gap well beyond private sector peers

What this looks like in practice

An informal or under-resourced DPO appointment carries disproportionate reputational risk for a public-facing entity. RSM's DPO as a Service gives programme leadership one experienced, accountable owner from day one. We act as your registered point of contact with both SDAIA and NDMO, manage data subject access requests at public scale, maintain DPIAs for high-risk deployments such as smart city sensors and biometric access systems, run breach response tested against the 72-hour requirement, and embed privacy-by-design review into new infrastructure before it is deployed.