Outsourced DPO services

An outsourced DPO is a data protection officer engaged by service contract rather than employed, permitted under GDPR Article 37(6). The provider owns GDPR compliance: the record of processing, data protection impact assessments, breach response, training and the supervisory-authority contact point. The model is called DPO externe in France and externer Datenschutzbeauftragter in Germany.

Outsourced DPO retainers vary by country and data risk. UK packages run roughly £500 to £7,500 per month, France €150 to €4,500 per month, and Germany from €79 per month for micro firms to €1,500 or more for professional retainers (engagecompliance.co, dpo-partage.fr, dsev.online). Project day rates run £600 to £1,200 or €800 to €1,500.

GDPR Article 37 makes a DPO mandatory for public authorities, for core activities involving large-scale regular and systematic monitoring, and for large-scale special-category processing. Germany goes further: BDSG Section 38 requires a DPO once 20 or more employees are regularly engaged in automated processing of personal data.

Yes. GDPR Article 37(6) explicitly allows the DPO to be fulfilled by an external provider under a service contract. The ICO (UK) and CNIL (France) both confirm external appointment, and a single external DPO can serve several organisations, which is common for SMEs and groups.

An external DPO brings independence and avoids the conflict-of-interest and, in Germany, the dismissal-protection issues that attach to an internal appointment. An internal DPO suits large-scale or highly sensitive processing that needs daily presence. Most SMEs and mid-market companies use an external DPO on a retainer scaled to data risk.

Typical scope includes the record of processing activities, data protection impact assessments, the supervisory-authority contact point, vendor and data-processing-agreement review, breach procedures, staff training and an annual compliance plan with periodic reporting to management.

Germany has the lowest appointment threshold in the EU under BDSG Section 38 (20 employees in automated processing), so it has the largest mandatory market by company count. France and the UK apply the GDPR Article 37 tests, with the CNIL and ICO both encouraging voluntary appointment as a governance safeguard.

Scope the processing risk and required time commitment, shortlist specialist boutiques or platforms with sector experience, check independence and reporting lines, then contract a monthly retainer with a defined annual plan. Register the designated DPO with the supervisory authority (CNIL in France, ICO in the UK).