The Data Protection Officer function delivered under a service agreement, for a fixed monthly fee. Independent, senior and continuous, without adding to your internal organisation.
Appointing a Data Protection Officer is mandatory if you process personal data on a large scale, regularly monitor user behaviour, or are a public authority.
The DPO does not have to be an employee: the law allows the function to be performed externally under a service agreement, which brings senior expertise, independence and continuity.
As a managed service, the DPO function runs on our platform. Your records of processing, data subject requests, incidents and DPIAs are kept in one place, and management receives a quarterly report generated from that work. The service covers GDPR and the Serbian Data Protection Act.
Six workstreams that make up the monthly service.
What an outsourced DPO gives you compared with appointing someone internally.
An external DPO avoids the conflicts that disqualify management, IT, HR or marketing leads from the role.
No recruitment, training or backup for a specialist role that is hard to fill.
Records, requests, incidents and DPIAs are documented on the platform as the work happens.
One appointment covering both the GDPR and the Serbian Data Protection Act.
The function does not stop when someone leaves, goes on leave or changes roles.
The cost of the DPO function is known in advance and set by the agreed scope.
Five steps, from appointment to quarterly reporting.
Service agreement and formal appointment decision, with channels defined, the DPO contact published and the authority notified.
A quick gap analysis across policies, RoPA, cookies and marketing, vendors, transfers and incidents, with a remediation plan.
DSAR flows, DPIA methodology, incident playbook, vendor and DPA standards, and initial role-based training.
Advice on initiatives, review of new features and participation in risk management and oversight.
Quarterly reports to management, KPIs and preparation for inspections and audits.
The work of the DPO is recorded as it happens, so you always know what is open and what has been done.
Every new processing activity is recorded, screened for risk and flagged for a DPIA where one is required.
The appointment is mandatory in these cases, and advisable in many others.
Health, financial or other sensitive data, or personal data of a large number of users.
Tracking, profiling or behavioural advertising as part of your core activity.
Public bodies and institutions, regardless of the volume of processing.
One DPO serving several related entities, accessible to each of them.
One agreement per function, or several functions combined under one.
Priced on the scope and volume agreed at onboarding, so the cost is known in advance.
The agreement lists what is included each month and how much of it.
Turnaround for each type of request is set in the agreement and tracked on the platform.
A monthly report on volumes and open items, and a quarterly review with management.
Work outside the agreed scope is quoted separately before it starts.
What clients ask before appointing an external DPO.
No. The law allows an external DPO acting under a service agreement.
Management. The DPO advises and monitors, must not receive instructions on how to perform the tasks, and must have sufficient resources and access.
Yes, provided the DPO is easily accessible to each unit or branch.
In the privacy policy or contact page, and it is communicated to the supervisory authority.
The DPO can assist and oversee, but the organisation remains responsible for compliance. The DPO is an adviser and supervisor, not the operational controller.
The representative and the DPO are different roles, and both are often required — for example a non-EU entity targeting these markets that also processes data on a large scale.
Through the contract and the process: a reporting line directly to management, separation from sales and projects, and documented access and escalation in line with the independence rules.
Anyone who determines the purposes and means of processing or would end up auditing their own decisions: CEO, COO and CFO, heads of IT, marketing, sales, HR or production, CISO and data platform leads.
A quick test: does this person define the why and how of processing, control the budget and tools, or need to audit their own decisions? If so, the role is incompatible.
Combine the DPO with other functions under one agreement.
Send us a short description of your processing activities, industry and target markets and we will propose a model and a 90-day calendar.
Contact usRecent writing on data protection and the DPO role.
Legal developments in Serbia and the EU, each with the step it asks of your business.
Two emails a month. Unsubscribe any time.