By Jess Pembroke, Head of Data Protection
Collection curators and data protection officers (DPO’s) play pivotal roles in safeguarding valuable resources—whether cultural artefacts or personal data. Their work ensures these resources are protected, respected, and used responsibly. In this article, we discuss how both roles require attention to detail, a deep understanding of the resources they manage, and a commitment to ensuring these resources are protected and properly utilised.
- Curators seek out and acquire new pieces for the museum collection, while DPOs oversee the collection of personal data, ensuring it is gathered legally and ethically. When engaging in a new activity to collect or use personal data, a Museum’s DPO can advise on whether the data collection is necessary and what the value for the institution may be.
- Curators meticulously document each item, including its history and condition, whereas DPOs maintain a detailed inventory of data assets, documenting the source, purpose, and permissions associated with a Museums data; both these activities ensure everyone working for the Museum understands what is held, and how it can be used to maximise the aims and objectives of the organisation.
- Curators ensure artefacts are stored correctly to prevent damage. Similarly, DPOs implement and monitor data security measures to protect personal data from breaches and unauthorised access. They also develop comprehensive disaster recovery plans to protect data from various emergencies, such as server failures, cyber-attacks, or natural disasters.
- Curators conduct research to understand the significance of items in the collection. DPOs can facilitate access to personal data for research purposes under GDPR exemptions, ensuring that data used for research is handled in compliance with data protection regulations and safeguards are in place to protect individual privacy. The GDPR includes specific provisions for research to ensure that data protection requirements do not hinder scientific and historical research; something we cover in detail in our course Data Protection Law for Archives, Museums and Library Collections.
- Curators engage the public through talks, articles, and educational programmes to encourage care, appreciation and understanding of the collection, while DPOs conduct training and awareness programmes to educate employees about data protection practices and compliance to ensure care and attention to detail is paid to people’s personal details. Furthermore, a good DPO can support the Museum in maximising the contact details it holds to ensure that the museum can market and promote its often wide range and variety of events, something we cover in more detail in our Lawful Digital Marketing and Consent course.
- A good DPO plays a crucial role in supporting the overall business by ensuring while the organisation focuses on promoting their collections and driving growth through innovative exhibitions and commercial initiatives, the DPO ensures that all data handling practices adhere to legal requirements and best practices. By doing so, the DPO helps to build trust with visitors and stakeholders, safeguarding sensitive information and mitigating potential risks. This balance allows museums to thrive and expand their reach without compromising on data protection standards, ultimately contributing to a sustainable and reputable business model.
Naomi Korn Associates acts as the outsourced Data Protection Officer for a number of museums, cultural and public sector organisations. For more information on our services please contact info@naomikorn.com.
Our Advanced Certificates, either in Data Protection or Copyright, are designed for professionals like you. Over four sessions, you will gain in-depth knowledge and practical skills to implement and manage a successful data protection program. You’ll have the opportunity to network and share common issues with a group of like-minded professionals, learning in a supportive collaborative way.
The Advanced Certificate in Copyright offers a detailed guide to implementing and managing copyright compliance within an organisation. It builds on participants’ existing knowledge, focusing on the key requirements for establishing and managing a successful copyright/IP compliance program, ensuring optimal access and protection of copyright and IP assets. In 2025, this will run in January and in July.
The Advanced Certificate in Data Protection provides an in-depth guide to managing data protection compliance, designed for those who have completed our Intermediate Program or are Data Protection Officers, Information Governance Managers, or similar professionals. It builds on existing knowledge to ensure successful implementation and management of privacy and data protection programs. In 2025, this will run in July and in November.
Please follow the links above or contact our Training Manager at info@naomikorn.com for more information.