DPO as a Service

The question

Do you need a Data Protection Officer, and if you do, who should it be?

Article 37 GDPR makes a DPO mandatory for public authorities, for organisations whose core activities consist of regular and systematic monitoring of individuals on a large scale, and for organisations whose core activities involve large-scale processing of special categories of data or criminal data. Member states may add cases, so check national law as well. Many companies fall outside these categories and are not obliged to appoint one, but still want someone accountable for privacy. Others are obliged and find that an internal appointment is difficult: the DPO must be independent, may not receive instructions on the performance of the tasks, and may not hold a role that makes them decide on the purposes and means of processing. An IT manager or a head of HR rarely meets that test.

The GDPR expressly allows the DPO to be external, on a service contract (Article 37(6)). That is the model we offer.

Our approach

We start with a short assessment: are you required to appoint a DPO, and if not, is a voluntary appointment useful? We document the answer. If a DPO is needed, we agree the scope in a service agreement, and we notify the supervisory authority of the contact details as Article 37(7) requires.

The work then follows the tasks in Article 39: advising you and your staff, monitoring compliance, advising on impact assessments, and acting as the contact point for the authority and for data subjects. In practice that means a running dialogue rather than an annual report.

Much of this runs on our own platform. Your records of processing and compliance registers are kept in the client portal, where your team edits entries and the DPO reviews and approves them. Impact assessments are completed together, as working records. Requests from individuals are logged and followed through our data subject request function, and incidents run through our breach workflow, with a lawyer deciding on every notification. The client portal also gives the DPO a dashboard, a register of vendors and processors, a compliance calendar and an overview of processing agreements.

We pay attention to the topics that most often cause problems: the register itself (what a RoPA must contain), how you answer access requests, how long you keep data (retention), and what your website does behind the banner (cookies and consent and website technology audits).

Clients usually come to us in one of four situations: a regulator or customer has asked who your DPO is, a growth step (a new product, a larger workforce, a move into health or monitoring) has pushed you over the Article 37 threshold, the person who used to look after privacy has left, or a supplier questionnaire has shown that nobody can produce a current register.

What you get

• A written assessment of whether a DPO is required, and the appointment documented and notified to the authority.
• A named external DPO and a defined scope, with advice available between formal reviews.
• Your record of processing, vendor and processor register and compliance calendar, kept current and approved by the DPO.
• DPIAs completed when the GDPR or the authority's list requires them, and on request where a project is sensitive.
• A tested procedure for requests from individuals and for personal data breaches.
• A short periodic report to management, so that the board can see what has been done and what is open.

The DPO advises and monitors. Decisions on purposes and means stay with you, and the GDPR leaves responsibility for compliance with the controller. We say so in the service agreement, as it protects the independence of the role for both sides.

A logistics company with 120 staff uses a camera system in its warehouses and a driver-tracking app. It had an HR manager acting as privacy contact. After our assessment, it concluded that monitoring on this scale called for a DPO and that the HR role created a conflict of interest. We were appointed as external DPO, notified to the authority, and began with the register and a DPIA on the tracking app. The DPIA led to shorter retention of location data and a clearer notice to drivers. Six months later a driver's access request was answered within the month, from a file that was already prepared.

Next step

Tell us what you process, for whom and with which suppliers, and we will give you a clear view on whether a DPO is required and what an external appointment would involve.

Schedule a meeting or contact us.