The Data Protection Officer function delivered under a service agreement — independent, senior and continuous, without adding to your internal organisation.
Contact usAppointing a Data Protection Officer is mandatory if you process personal data on a large scale, regularly monitor user behaviour, or are a public authority.
The DPO does not have to be an employee: the law allows the function to be performed externally under a service agreement, which brings senior expertise, independence and continuity.
Our external DPO service combines legal knowledge, administrative discipline and technical understanding, covering GDPR and the Serbian Data Protection Act.
Delivery is operational: DPIAs, training, data subject requests, incident oversight and cooperation with the Commissioner and other supervisory authorities, with independence and direct access to management.
Six workstreams that make up the monthly service.
Five steps, from appointment to quarterly reporting.
Service agreement and formal appointment decision, with channels defined, the DPO contact published and the authority notified.
A quick gap analysis across policies, RoPA, cookies and marketing, vendors, transfers and incidents, with a remediation plan.
DSAR flows, DPIA methodology, incident playbook, vendor and DPA standards, and initial role-based training.
Advice on initiatives, review of new features and participation in risk management and oversight.
Quarterly reports to management, KPIs and preparation for inspections and audits.
A sample of recent work in the sector.
Contractual separation from sales and projects, with documented access and escalation in line with the independence rules.
One DPO serving a group of related companies, accessible to each unit.
We monitor, advise and report; implementation stays with your teams or specialist providers.
Coordination with EU and UK representatives and local counsel as the business scales.
No. The law allows an external DPO acting under a service agreement.
Management. The DPO advises and monitors, must not receive instructions on how to perform the tasks, and must have sufficient resources and access.
Yes, provided the DPO is easily accessible to each unit or branch.
In the privacy policy or contact page, and it is communicated to the supervisory authority.
The DPO can assist and oversee, but the organisation remains responsible for compliance. The DPO is an adviser and supervisor, not the operational controller.
The representative and the DPO are different roles, and both are often required — for example a non-EU entity targeting these markets that also processes data on a large scale.
Through the contract and the process: a reporting line directly to management, separation from sales and projects, and documented access and escalation in line with the independence rules.
Anyone who determines the purposes and means of processing or would end up auditing their own decisions: CEO, COO and CFO, heads of IT, marketing, sales, HR or production, CISO and data platform leads.
A quick test: does this person define the why and how of processing, control the budget and tools, or need to audit their own decisions? If so, the role is incompatible.
Send us a short description of your processing activities, industry and target markets and we will propose a model and a 90-day calendar.
Contact usRecent writing on data protection and the DPO role.
Legal developments in Serbia and the EU, each with the step it asks of your business.
Two emails a month. Unsubscribe any time.