DPO as a service: The smart solution for modern businesses
Table of Contents
Are you in charge of data protection in your organisation but struggling to keep up with evolving data protection regulations? What if you could have a Data Protection Officer (“DPO”) on demand without the overheads of a full-time hire? The concept of “DPO as a Service” could be just what you need.
“DPO as a Service” involves instructing an outsourced DPO services provider to take care of your data protection requirements and, although an external DPO, they will, nonetheless, fit seamlessly into your organisation, simply feeling like an extension of your existing team.
As a flexible service, you can use your outsourced DPO as much or as little as you need to, ensuring that you will always have on-hand support while avoiding the cost and commitment of adding another employee to the payroll.
As your organisation develops or undergoes changes, you can expand the engagement, if required, to ensure that you are properly supported in demanding times, bearing in mind the importance of data protection in today’s regulatory landscape.
Therefore, DPO as a service is a cost-effective and scalable solution that may be a good fit for your organisation. Read on to learn more and help you decide whether this DPO compliance solution is right for you.
Already know you would benefit from DPO as a Service? Learn more about our outsourced DPO services.
Read on for a more in-depth look into what you can expect from a good DPO service.
What is ‘DPO as a Service’ and how can it help your organisation?
DPO as a Service is a concept written into the UK and EU GDPR. Its function is to fulfil the same role as an in-house DPO, including all the legal requirements within the legislation.
You will find that by using an external DPO, all the usual tasks of an in-house DPO will be carried out, although, in many respects, as discussed in the aforementioned article, DPO as a Service could have advantages over an in-house DPO.
For example, there is a requirement under the data protection legislation that the DPO must be independent and their position must not give rise to any conflict of interest. When appointing an in-house DPO, organisations often add the DPO duties to the job description of an existing member of staff, but this can lead to conflicts of interest.
For instance, this could arise if the CEO is appointed as the in-house DPO. The CEO would typically be interested in making decisions that drive the company forward and encourage growth, whereas the priority for a DPO would be data protection compliance, and these objectives may not always align.
Similarly, we often find that senior IT managers/directors have the DPO role tagged on to their duties, which, again, can lead to clear conflicts of interest. However, when an external body acts as your DPO, it is much easier to demonstrate that the DPO is independent since they have a degree of distance compared to an in-house DPO.
If you are trying to decide whether to outsource your DPO or keep them in-house, you may find it useful to read our blog Should You Outsource Your DPO? However, see below for further benefits of instructing an external DPO.
“Our capacity for other work has also increased now that Evalian has stepped in to handle our data protection obligations. The DPO engagement has had an instant impact on our IT department which are very aware of potential cyber risks to our business. Our engagement with Evalian has helped guide our cyber security strategy, a vital aspect of having a rock-solid DPO capability. It has given us the confidence that what we are doing is right.” – Cundall, view full client success story here.
“Having gone on that journey from being a “scrappy start-up”, it’s really helped us with our business maturity. In a world today that relies so heavily on data, it really gives us, our partners and our clients, that extra vote of confidence.” – Jym Brown, Ningi
“Following Evalian’s health check, we are extremely confident that we have a strong data protection compliance framework in place and now with Evalian’s support, we can ensure that we maintain strong levels of compliance in the future.” – Jon Lawrence, Cappfinity
Why choose outsourced DPO as a service?
There are numerous benefits of using an external DPO as a Service, including:
- The cost of an outsourced DPO could be considerably less than appointing an in-house DPO because you will not need to worry about recruitment costs, National Insurance contributions, training, hardware/software, holiday cover and sickness cover;
- You will have direct access to expert knowledge. Your outsourced DPO will already be trained in the relevant rules and regulations at no cost to you;
- Your external DPO will already have a great deal of experience working in the industry and an excellent practical application of the law;
- There will always be someone who can assist, removing the worry of how to attend to urgent data protection matters if your in-house DPO is out of the office;
- You will be regularly updated on data protection developments, whereas an in-house DPO may find it difficult to find the time to do this; and
- The service will offer you flexibility, allowing you to save the DPO hours in quiet times and use them up in busier times, such as when subject access requests are received or personal data breaches occur.
Every organisation is different, but it is easy to see from the above list why many organisations consider that outsourcing their DPO is the right choice for them.
Benefits of DPO as a Service as a long-term annuity contract
If you’ve decided that an external DPO would be a good fit for you, the next question is, what type and what level of service would suit you best?
Organisations often consider that a Gap Analysis is a good starting point. This involves assessing the key departments of your company against all the different requirements of the data protection legislation. This includes things like records management, accountability, data protection training, your approach to direct marketing, risk management and data protection impact assessments, security of processing, privacy information and lawful bases for processing.
This approach will provide you with an overview of where you are in your compliance journey and should be accompanied by a remediation plan setting out the steps you need to take in order to improve your data protection posture.
However, whilst a Gap Analysis is an extremely valuable assessment, this is a “one-off” review that identifies the gaps in compliance at that point in time, whereas data protection is an ongoing requirement. In view of this, our clients often choose to couple a Gap Analysis instruction with a long-term annuity DPO Contract i.e a contract for an initial 12 months of DPO support, which is renewable every year.
When opting for this with us, you will have a named data protection expert to guide you through the remediation actions identified by the Gap Analysis and they will also carry out the usual DPO duties referred to above. You will, therefore, have access to data protection support whenever you need it throughout the year.
The great advantage of your annuity contract being provided by the same organisation as your Gap Analysis is that they will already have an excellent understanding of your business from an operational/commercial perspective. They’ll also be aware of any problem areas and, following this, if you continue with the annuity contract year on year, your appointed DPO will gain a deeper understanding of your organisation, enabling them to offer detailed bespoke advice to suit your requirements and strategic objectives.
At Evalian we offer three different options for DPO as a Service on renewable 12-month annuity contracts, namely DPO Essentials, DPO Support and DPO Complete.
These options give you the flexibility to choose what suits your organisation best, bearing in mind relevant considerations, such as the complexity of your processing activities, your existing in-house resources, available funding and risk appetite.
How much does DPO as a Service cost?
You may be wondering what you should expect to be included in the data protection service you pay for.
In truth, it really depends on whether you are a large-scale organisation, the complexity of your data processing operations and the level of support you need. However, most providers will charge a monthly subscription cost or a daily rate for an external DPO. Smaller start-ups looking for gap analysis will pay less naturally, whilst large global organisations will inevitably need to spend more.
In general, you can expect to pay from a few hundred up to several thousand pounds a month for your DPO engagement, depending on the above criteria.
To put this into context, our Evalian consultants are, in the main, ex-ICO staffers, data protection lawyers or well-established DPOs with backgrounds in large financial organisations, for example. This means that although we are not the cheapest option, you can rest assured that the advice and guidance you get is of the highest quality and is the reason we are said to have one of the best data protection service offerings on the UK market.
The benefits of an all-inclusive Data Protection package
Beware of hidden costs or additional services that may get added on top of a cheaper base package. Some GDPR service organisations offer cheap rates, however, costs rack up in the long term. It’s a good idea to look for a comprehensive package that is transparent and offers you everything you require where possible, in one fixed price rate.
Evalian offers comprehensive DPO rates that include all of the above, plus DPIA preparation, on-demand advice, and access to our online GDPR Training Awareness course, with refresher training each year.
How much does the data protection fee cost?
Albeit a small fee in the grand scheme of things, you must pay a data protection fee to the ICO if you are a business, organisation or sole trader processing personal data unless you are exempt. You can use this link to check the ICO data protection fee.
This yearly cost depends on your size and turnover. It is £40 or £60 for most organisations, including charities and small to medium-sized businesses.
However, the fee can be up to £2,900 for organisations that have a large workforce and turnover.
Use Cases: Who Needs DPO as a Service?
DPO as a Service is an arrangement that suits many organisations in various industries for numerous reasons. For example:
- SMEs without the resources for a full-time DPO find that DPO as a Service is a cost-effective way to ensure they have DPO support ‘on-tap’ without the expense of employing another member of staff.
- Large enterprises looking for expert guidance across multiple jurisdictions often prefer DPO as a Service, as it enables them to have one point of contact across all areas for all their data protection issues, ensuring they have support when they need it.
- Startups frequently use DPO as a Service, as it enables them to establish robust data protection practices from the outset without the costs that come with a full-time employee, which can be difficult to bear whilst a new company scales.
- Businesses preparing for growth or undergoing digital transformation like to use DPO as a Service as it gives them the additional assistance they need to support them through their changes.
- Companies that already have an in-house DPO but need extra support but are not ready to appoint another employee.
Therefore, no matter how large or small a company is, what stage they are at, or even what industry they’re in, DPO as a Service is a great solution.
Still unsure whether you need a DPO? Use our handy checklist to decide!
How to choose the right external DPO provider
The number of service providers has grown significantly since the inception of the UK GDPR and the EU GDPR, and it can be confusing trying to find the one that offers the best service to suit your needs amongst the many options.
There are numerous considerations to take into account when making the choice, including the number of hours of support you need, the level of expertise you require, the jurisdictions you need to have covered, the flexibility you want and the affordable cost.
You should evaluate an organisation’s credentials. Make sure that the organisation details DPOs and the level of expertise and qualifications they hold; if it’s not readily available, ask for it in your initial engagement. It’s also important to make sure you see that they have experience within your industry, as data protection can vary significantly between industries.
Look for case studies and testimonials – whether that’s Trust Pilot reviews, Google reviews or a similar platform. You should also assess their approach to compliance and risk management and make sure they are offering proactive support rather than reactive.
A good DPO as a service provider should offer complete transparency, think of clear service agreements and response times, and make sure they outline their responsibilities, what is expected from you and what ongoing support they offer. Do you need on-demand advice? If so, you’ll want to look for testimonials that mention their communication style.
Look at whether they offer on-site visits and GDPR training for your employees.
Finally, check for conflict of interest safeguards, and make sure they can offer completely unbiased guidance on your compliance.
A trusted DPO as a service organisation should act as an extension of your team, offering you the most effective level of support, tailored to your organisation’s unique needs. If they aren’t taking the time to really get to know your business, and their communication is lacking, then you need to question whether they are the right team for you!
Conclusion: Make compliance work for you with DPO as a service
At Evalian, our data protection clients include small start-ups, global organisations and everything in between. Our client base is diverse, with engagements across multiple industries. Members of our data protection team, which includes lawyers as well as operational specialists, hold globally recognised qualifications, including the Practitioner Certificate in Data Protection and the IAPP certifications CIPP/E, CIPP/US, CIPP/M and AIGP (artificial intelligence) and have a wealth of many years of experience.
As such, we are in a great position to provide you with expert data protection advice and assistance in whatever capacity you require. Please get in touch to arrange a chat and explore how we can help.
