--- title: "DPO as a Service | Pitch" description: "An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice." url: https://www.pitch.law/solutions/dpo-as-a-service --- [pitch](https://www.pitch.law/) [Solutions](https://www.pitch.law/solutions) [Privacy & Data Protection](https://www.pitch.law/solution-categories/privacy) # DPO as a Service An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice. - By By Bart Lieben, Attorney-at-Law - Published 8 September 2022 - 360 stage: Protect ## The question Do you need a Data Protection Officer, and if you do, who should it be? Article 37 GDPR makes a DPO mandatory for public authorities, for organisations whose core activities consist of regular and systematic monitoring of individuals on a large scale, and for organisations whose core activities involve large-scale processing of special categories of data or criminal data. Member states may add cases, so check national law as well. Many companies fall outside these categories and are not obliged to appoint one, but still want someone accountable for privacy. Others are obliged and find that an internal appointment is difficult: the DPO must be independent, may not receive instructions on the performance of the tasks, and may not hold a role that makes them decide on the purposes and means of processing. An IT manager or a head of HR rarely meets that test. The GDPR expressly allows the DPO to be external, on a service contract (Article 37(6)). That is the model we offer. ## Our approach We start with a short assessment: are you required to appoint a DPO, and if not, is a voluntary appointment useful? We document the answer. If a DPO is needed, we agree the scope in a service agreement, and we notify the supervisory authority of the contact details as Article 37(7) requires. The work then follows the tasks in Article 39: advising you and your staff, monitoring compliance, advising on impact assessments, and acting as the contact point for the authority and for data subjects. In practice that means a running dialogue rather than an annual report. Much of this runs on our own platform. Your [records of processing and compliance registers](https://www.pitch.law/technologies/privacy-register) are kept in the client portal, where your team edits entries and the DPO reviews and approves them. [Impact assessments](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) are completed together, as working records. Requests from individuals are logged and followed through [our data subject request function](https://www.pitch.law/technologies/dsar-handling), and incidents run through [our breach workflow](https://www.pitch.law/technologies/breach-response-workflow), with a lawyer deciding on every notification. The [client portal](https://www.pitch.law/technologies/client-portal) also gives the DPO a dashboard, a register of vendors and processors, a compliance calendar and an overview of processing agreements. We pay attention to the topics that most often cause problems: the register itself ([what a RoPA must contain](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)), how you answer [access requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide), how long you keep data ([retention](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)), and what your website does behind the banner ([cookies and consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) and [website technology audits](https://www.pitch.law/academy/website-technology-audits-and-gdpr)). Clients usually come to us in one of four situations: a regulator or customer has asked who your DPO is, a growth step (a new product, a larger workforce, a move into health or monitoring) has pushed you over the Article 37 threshold, the person who used to look after privacy has left, or a supplier questionnaire has shown that nobody can produce a current register. ## What you get - A written assessment of whether a DPO is required, and the appointment documented and notified to the authority. - A named external DPO and a defined scope, with advice available between formal reviews. - Your record of processing, vendor and processor register and compliance calendar, kept current and approved by the DPO. - DPIAs completed when the GDPR or the authority's list requires them, and on request where a project is sensitive. - A tested procedure for requests from individuals and for personal data breaches. - A short periodic report to management, so that the board can see what has been done and what is open. The DPO advises and monitors. Decisions on purposes and means stay with you, and the GDPR leaves responsibility for compliance with the controller. We say so in the service agreement, as it protects the independence of the role for both sides. A logistics company with 120 staff uses a camera system in its warehouses and a driver-tracking app. It had an HR manager acting as privacy contact. After our assessment, it concluded that monitoring on this scale called for a DPO and that the HR role created a conflict of interest. We were appointed as external DPO, notified to the authority, and began with the register and a DPIA on the tracking app. The DPIA led to shorter retention of location data and a clearer notice to drivers. Six months later a driver's access request was answered within the month, from a file that was already prepared. ## Next step Tell us what you process, for whom and with which suppliers, and we will give you a clear view on whether a DPO is required and what an external appointment would involve. [Schedule a meeting](https://www.pitch.law/schedule) or [contact us](https://www.pitch.law/contact-us). ## In short - External DPO under Articles 37 to 39 GDPR - Independent advice without a full-time hire - Registers, DPIAs and requests kept in one portal - Contact point for the data protection authority - Scaled to your size and risk ## Technology we use - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/dsar-handling) ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - [Technology](https://www.pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - [Technology](https://www.pitch.law/technologies/client-portal) ### [Client Portal](https://www.pitch.law/technologies/client-portal) [A secure place where you follow your matters, instruct us on deadlines, work on registers with us and see your IP portfolio, in the same environment as our work.](https://www.pitch.law/technologies/client-portal) ## Background reading - [Academy](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - [Academy](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - [Academy](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - [Academy](https://www.pitch.law/academy/cookie-compliance-and-consent-management) ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - [Academy](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## More in Privacy & Data Protection - ### [Data Processing Agreements](https://www.pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://www.pitch.law/solutions/data-processing-agreements) - ### [Data Breach Response](https://www.pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://www.pitch.law/solutions/data-breach-response-enforcement) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)