DPO as a service for SMBs: a qualified data protection officer, without the full-time hire.
Need a data protection officer, or not sure? We tell you, and can take on the role.
Does it apply to you?
Do you need a DPO?
Yes to any of the first three: GDPR requires one. The exact tests are in the section for your DPO or IT manager, below. The service is for organisations established in France, including the overseas regions.
- Are you a public authority or public body?Then a data protection officer (DPO) is mandatory.
- Is monitoring people at large scale core to your business?Behavioural advertising, location tracking, large-scale monitoring of staff. Then it is mandatory too.
- Is handling sensitive data at large scale core to your business?Health, genetic, biometric or criminal data. Mandatory as well.
- Do customers ask you to have one?Appointing a DPO voluntarily is often the simplest answer, and the CNIL encourages it.
Not in scope?
No DPO required? You still have GDPR duties.
Without a DPO, someone in your company still keeps the record of processing, answers people’s requests about their data and handles breaches. Our GDPR compliance work sets that up.
see GDPR complianceWhat changes for you
An ongoing role with legal protections, not a one-off project.
A data protection officer advises your company on GDPR, checks that it is applied, and is the contact for the CNIL and for people asking about their data. The DPO reports to your top management and takes no instructions on how to carry out these tasks.
We provide that role as a service, for organisations established in France, metropolitan and overseas. Your consultant holds the EU GDPR Data Protection Officer certification. To stay independent, the DPO never decides why or how your data is processed, and we check for conflicts of interest before we start and every year.
Missing a DPO when one is required is a breach of GDPR in its own right. The fix is a quick answer on whether you need one, then a DPO in place in about three weeks.
What to do first
Confirm whether you need one, then appoint and register.
What we deliver
- A clear answer: required, recommended or not needed
- A named DPO, registered with the CNIL, with contact details published
- Regular reports to your management, at least every quarter
- Advice on impact assessments, breaches and people’s requests
- Independence guarantees written into the engagement
Who does what
The DPO advises and checks. Your company keeps the decisions.
What your DPO does
- Advise on GDPR and on impact assessments
- Check compliance and report to management
- Act as contact for the CNIL and for individuals
- Train staff, or oversee their training
What stays with your company
- Decide why and how data is processed
- Apply the measures and answer requests on time
- Notify breaches to the CNIL, with the DPO’s advice
Your company stays responsible for compliance; the DPO advises and monitors.
How it starts
Your first step: a free call to check whether you need one.
If you do, the service is a fixed monthly fee, set by your size and the data you handle, with no separate set-up fee.
- Price
- Fixed fee
- Your time
- A short call
Fixed quote after the free call.
book a free 25-minute consultationFor your IT manager, DPO or CFO
The DPO's tasks under GDPR — and what our service adds.
- 01
Advise the controller, processor, and employees
On obligations under GDPR and other data protection laws.
- 02
Monitor compliance with GDPR
Including responsibilities, awareness-raising, and training of staff involved in processing operations.
- 03
DPIA advisory and oversight
Provide advice on Data Protection Impact Assessments and monitor their performance.
- 04
Be the supervisory authority contact
Primary point of contact for the supervisory authority — the CNIL, for organisations established in France, including the DROM.
- 05
Be the data-subject contact
Designated contact for individuals exercising their data subject rights.
- 06
Support the ROPA
Develop and maintain Article 30 Records of Processing Activities.
- 07
International transfers oversight
Guide the organisation on lawful mechanisms for transferring personal data outside the EU/EEA.
- 08
Advise on breach response
Advice on breach assessment and on the controller's 72-hour notification to the authority and to individuals; oversight of the breach register.
- 09
Deliver privacy training
Or commission and oversee training for all staff handling personal data.
- 10
Review privacy documentation
Privacy notices, data processing agreements, consent mechanisms.
- 11
Report to highest management
Direct reporting line. Cannot receive instructions on the exercise of DPO tasks (Article 38).
Failure to designate is itself a violation.
Failure to designate a DPO when required under Article 37 is a GDPR violation in its own right — independent of any data breach or privacy incident. Article 83(4) sets the maximum at €10 million or 2% of total worldwide annual turnover, whichever is higher.
Beyond penalties, missing the DPO function compounds risk: data subject requests go unmanaged (further violations), breaches are reported late or not at all (higher-tier penalties), DPIAs for high-risk processing are not conducted.
Non-designation fine
€10M / 2%
whichever higher, of total worldwide annual turnover (Article 83(4)).
Time to appoint (us)
About 3 weeks
from engagement to registration with the CNIL.
Full-time alternative
A senior hire
salary, social charges and recruitment — for a role many SMBs need only part-time.
Onboarding
Designed to start fast. Most engagements are fully active within about three weeks.
Weeks 1–2
Scoping & contract
Confirm DPO mandate trigger, scope of processing, applicable supervisory authority. Engagement letter and Article 37(7) contact details.
Week 3
Registration & handover
Register DPO contact with supervisory authority. Take over from any prior internal or external DPO. Initial briefing with management.
Ongoing
Statutory function delivery
Monthly cadence of compliance monitoring, advisory, training oversight, supervisory authority contact, breach response readiness.
FAQ