Data protection officer (DPO) – external DPO services and support
We act as an external data protection officer or support the DPO designated within the organisation.
When a DPO is required
A data protection officer must be designated where processing is carried out by a public authority or body, or where the core activities of the controller consist of regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special categories of data or data relating to criminal convictions (Article 37 GDPR).
Under Polish law, the controller notifies the President of UODO of the designation within 14 days.
Scope of services
- Informing and advising the controller and employees on their GDPR obligations.
- Monitoring compliance with the GDPR and data protection policies, including audits and reviews.
- Advising on data protection impact assessments.
- Acting as the contact point for data subjects and cooperating with the President of UODO.
- Support in personal data breaches.
Frequently asked questions
Can the DPO be an external person?
Yes. The GDPR allows the DPO tasks to be performed under a service contract (Article 37(6) GDPR). The DPO must have expert knowledge of data protection law and practice and must not receive instructions regarding the exercise of their tasks.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.