Should you outsource your DPO? In-house vs external DPO compared
Table of Contents
Should you outsource your DPO? Pros, cons and costs explained
If you’ve been tasked with understanding whether you need to hire an in-house DPO or outsource to a DPO as a service provider – you will have read the DPO checklist and have arrived at the conclusion that you know you’re required by law to designate a Data Protection Officer. So now the question is “Should you outsource your DPO? Or hire a DPO in-house?”. It can be a difficult decision, and the truth is, there are advantages and disadvantages to both.
As an outsourced DPO services provider, we see it from both sides. Many organisations come to us with a lack of resources and time to dedicate to their data protection obligations and seek outsourced services, particularly when it comes to small businesses or startups (read our 9 Tips on data protection for Startups here). But we also support in-house DPOs who often need a second opinion, extra resources or help because they have another role as well.
First, it’s important to understand the key responsibilities of a DPO in order to determine whether someone in-house, has the capabilities and skillset, as well as the time to cover all aspects of the role.
We offer no-obligation consultations – so if you’re ready to discuss your requirements and understand how we can help you with external DPO services, get in touch, or view our data protection packages.
What does a DPO do?
A DPO is vital for organisations handling personal data to ensure compliance with laws like GDPR, as well as to safeguard individuals’ rights and mitigate data-related risks.
Acting as an independent expert, the DPO oversees data protection processes, manages risks, and fosters accountability by maintaining policies and records. Not only that, but appointing a DPO enhances trust with partners, stakeholders and most importantly, your clients.
As well as supporting innovation, ensuring readiness for audits and mitigating breaches, your DPO will act as the main point of contact for regulatory authorities. In a nutshell, by embedding data protection into operations, the DPO can reduce legal, financial, and reputational risks, which in turn, provides long-term cost savings and competitive advantages over potential competitors in the market.
Some of the key responsibilities of a DPO are to:
Monitor compliance – The DPO will ensure the organisation complies with GDPR and other relevant data protection laws as well as oversee internal audits and maintain records of processing activities. This will include gap analysis and remediation advice.
Advise on data protection obligations – The DPO will provide advice on GDPR obligations, including new projects or initiatives involving personal and sensitive data.
Facilitate accountability – A DPO will support your organisation in demonstrating GDPR accountability by maintaining policies, procedures, and documentation.
Conduct Data Protection Impact Assessments (DPIAs) – The DPO will advise on and monitor DPIAs for high-risk processing activities.
Act as point of contact with authorities – The DPO will act as the contact point for the Information Commissioner’s Office (ICO) or other supervisory authorities.
Raise awareness & training – The DPO should ensure that employees have awareness of data protection laws and strive to embed a data protection culture within the organisation cross all departments.
Handle Data Subject Access Requests (DSARs) – The DPO will oversee responses to Data Subject Access Requests (DSARs), including requests for rectification, deletion, or restriction of processing.
Ensuring data protection by design – The DPO should promote privacy principles and integrate them into the organisation’s products, services, and systems from the outset.
Monitor data breaches – A DPO should monitor incident response plans for personal data breaches and report them to the ICO within the 72-hour window if required.
Maintain independence – Whilst the DPO is a part of your organisation, it’s important they perform duties independently without influence from other organisational stakeholders or conflicts of interest.
Advise on data transfers – The DPO should provide guidance on international data transfers, including the use of Standard Contractual Clauses (SCCs).
Review third-party contracts – The DPO should ensure that data processing agreements with processors meet the legal requirements.
Monitor data protection risk – A DPO should always stay up to date about any evolving data protection laws, industry standards, and emerging risks – particularly around AI risks that have become existental over the last couple of years. You can learn more about AI risk and governance in our Guide to AI Act Compliance.
Provide guidance – A DPO will offer advice to data processors, ensuring that they adhere to GDPR regulations and requirements.
Support organisational governance – A DPO will report directly to senior management or the board of directors, providing updates on data protection risks and compliance status.
Want to learn more about what an outsourced DPO does? Read our detailed breakdown in ‘DPO as a Service.
In-house data protection officer
The first consideration when appointing someone from within your organisation is whether you have a suitable candidate. The regulation stipulates that the DPO:
- Must have expert knowledge of data protection law – read the latest on the new code of practice for data sharing here.
- Must have the ability (and capacity) to fulfill all of the tasks required by the role
- Must perform their tasks and duties in an independent manner
- Must only fulfill other tasks and duties if these don’t result in a conflict of interests (determining the purposes and means of processing, managing competing objectives where business interests may take precedence over data protection)
If you don’t already employ somebody suitably educated, available, independent, and able to prioritise data protection over your business interests (it really stipulates this), then your options are to hire a new employee or to hire an outsourced DPO. However, if you do have someone who meets the criteria then there are good reasons to keep the position in-house.
But who would have the skillset and resources to also act as your DPO in-house? Read on to understand the qualifications needed to act as a DPO for your organisation.
Who is qualified to act as a DPO?
The individual appointed as your DPO will have a more intricate understanding of your organisation than an external specialist, and will therefore be able to balance, but prioritise, data protection risks against business objectives with increased levels of scrutiny and analysis, consequently resulting in decisions borne out of deeper consideration.
They will also be able to monitor compliance more closely, identifying risks at an earlier stage and subsequently introducing processes for mitigating those risks. A good example would be employee GDPR awareness training, where an in-house DPO would be afforded a far more accurate picture of potential shortcomings emanating within the workforce than an external consultant would.
Could a CEO also be a DPO?
Well, that depends largely on time and resources and whether any conflict of interest arises as a result.
A DPO needs to report to the highest level of management within your organisation, so appointing an existing employee could potentially cement the structure more effectively into your organisational chart, ensuring that data protection remains an ongoing consideration at the board level.
However, given the above key responsibilities of a DPO, paired with the responsibilities and workload of a CEO, this would likely be unachievable for one person. In addition to this, it is likely that conflicts of interest would arise if a CEO was also the DPO.
This is because CEOs are required to make decisions that will drive the business forward and promote growth and progress. Such decisions may not always align with the decisions that DPOs are required to make, which need to focus on data protection compliance. Therefore, you may struggle to demonstrate that the CEO is adequately independent to be an effective DPO.
If you do find a suitable employee who can adopt the DPO responsibilities, we have plenty of resources to support in-house DPOs, so visit our resources page to download some free content.
The business case for outsourcing your DPO
The hyperbole around GDPR back in May 2018 led to many fly-by-night experts riding the fear and consumption wave into becoming trusted advisers at unsuspecting businesses, so it’s important to caveat this section by making clear that any reference to external consultants will only include reputable firms (of which there are many).
Expert knowledge & advice: When using one of these consultancy firms, you can be confident that you’ve got direct access to the ‘expert knowledge of data protection law’ required by the GDPR. In fact, the more credible firms will most likely have lawyers on their team as well operational specialists. This helps guarantee access to adequately knowledgeable subject matter experts that understand the complexities of not just the GDPR, but also the UK Data Protection Act 18, PECR, CCPA, and how Brexit impacted businesses in terms of data protection laws.
Technical cyber security expertise: The role also requires some relatively comprehensive technical understanding, particularly when considering compliance with the GDPR’s security principle, as well as the Article 32 requirements around implementing and testing appropriate technical and organisational measures to secure your data. A competent consultancy firm will be well-positioned to advise on both your data protection and broader information security obligations in the context of GDPR’s risk-based approach.
Flexible engagements: An external consultant will also offer the flexibility of an ongoing monthly retainer ensuring that you always have access to suitable expertise during times of ‘feast or famine’, which is often the way that data protection demands are required. This is in addition to being able to guarantee the mandated independence and negate any possible conflicts of interest.
On top of trends: Another significant advantage afforded by working with an external consultant is their exposure to trends, emanating threats, effective strategies, and other valuable industry GDPR insights generated from working with many different organisations and verticals. Our data protection officers write posts regularly on the latest data protection and GDPR news such as the current hot topic of AI compliance regulations and the reintroduction of the data protection and digital information bill.
How much does an external DPO cost?
The final and possibly most important consideration is pricing. The cost of an employee doesn’t stop at their salary, you may also need to factor in recruitment costs, NI, benefits, training, hardware/software, and coverage in times of absence (sickness and annual leave). None of this is a concern when appointing an external consultant, who you’d secure for a fraction of the cost.
Marco Fiori, Managing Director of Bamboo PR experienced the challenges of having this expertise and the resources in-house:
“It became apparent mid-way through the year that our efforts to comply with GDPR were becoming trickier to do in-house due to resources and time. GDPR is as overwhelming as it is complex to anyone who isn’t versed in that subject. I knew we needed assistance to ensure our team is supported in their efforts, and equally, to provide the best service for our clients.” You can read the full outsourced data protection officer case study for Bamboo PR here.
Bamboo PR benefited from outsourcing their data protection officer duties by using Evalian as an extended member of their team:
“Evalian® has supported us in implementing updated policies and procedures, which provide the structure to enable that mindset, which is extremely valuable. Not only do we have up-to-date documentation, but this has also improved how we run our business in different ways. We now have a solid awareness when it comes to compliance. We have a mindset from top to bottom which is far more “data protection-focused”. I think that data protection really does need to have buy-in from the top, and having my team see how invested I am has made the whole process much easier. ”
Our clients in the healthcare sector have also seen improved compliance rates after outsourcing their DPO function. Similarly our education, HR and recruitment, PR, property and charity clients have all reported an improved data protection awareness culture and more robust processes, giving confidence to other internal teams as well as stakeholders and clients.
“We have been able to educate our employees more in terms of data protection. There is definitely an improved awareness overall about what policies need to be in place and how to go about that.” – Generated Health
“By appointing Evalian as our DPO and making the right changes to our policies and data protection duties, we are now in a much stronger compliance position. The steps Coeliac UK has taken alongside Evalian only strengthen and prove our commitment to meeting our data protection compliance obligations.” – Coeliac UK
“As the Data Protection representative, I get asked a lot of questions like “Can I share this information?” – I personally feel like I can now answer these types of queries confidently and if I’m not sure, I have the expertise in Neil at the end of the phone who will be able to give me the advice and guidance I need to go back to someone with a definitive answer. It gives the Trust, the staff and everyone connected with the school, the assurance that we do everything correctly and their data are safe which is invaluable.” – Ridgeway Academy
View more Data Protection Officer case studies here.
Questions to ask when deciding to outsource your DPO
Hopefully, this article has given you plenty of food for thought over which option is best for your organisation. No two organisations are alike when it comes to data privacy, what works well for one organisation, may not suit your operational needs. If you’re still unsure, here are some key questions you can use to consider the best option for you:
In-house DPO questions:
- Do we have an employee with expert knowledge of data protection laws, such as GDPR?
- Is there someone in-house who understands the complexities of data processing across all areas of the organisation?
- Can our in-house team allocate sufficient time to handle data protection duties alongside other responsibilities?
- Do we have the resources to stay on top of evolving data protection laws and regulations?
- Is there an individual who can act independently without conflicts of interest when making data protection decisions?
- Can our internal team conduct DPIAs effectively?
- Do we have a programme for ongoing employee training and awareness around data protection?
- Can our in-house team handle large-scale data processing and monitor compliance continuously?
- Do we have the internal capacity to manage a data breach response and report to authorities within the required timeframe?
- Does our team have the expertise to manage cross-border data transfers in compliance with GDPR requirements?
Questions to ask before you outsource your DPO:
- Do we lack the internal expertise or capacity to manage data protection responsibilities effectively?
- Is data protection too complex or resource-intensive for our current team to handle?
- Are we struggling to keep up with the rapidly changing data protection landscape and regulatory requirements?
- Do we need legal or technical expertise that our current team cannot provide?
- Would outsourcing help us stay independent and avoid potential conflicts of interest, especially in smaller teams?
- Do we need more flexible access to data protection advice, particularly during busy periods or project launches?
- Is our organisation growing, making it difficult to manage data protection duties in-house?
- Are we unsure about the cost-effectiveness of hiring a full-time DPO vs outsourcing?
- Do we need a third-party perspective to identify risks or compliance gaps that may not be obvious internally?
- Would outsourcing provide us with access to up-to-date industry insights and best practices from experts working with multiple organisations?
- Do we have someone who is clued up on AI Act governance?
These questions will help you assess whether your in-house team has the capability to manage data protection responsibilities or if outsourcing DPO duties would be a better fit for your organisation.
Conclusion
There are clear advantages to both options and the decision, ultimately, requires taking a risk-based approach and balancing this against internal expertise, business objectives and budget, before committing either way.
There’s no doubt, that whether outsourced or in-sourced, hiring a DPO has many benefits within an organisation.
Ready to hire your external DPO?
If you do plan to outsource your DPO or you’d like to broaden internal discussions to include some independent and transparent advice, then feel free to contact us; we can guarantee a friendly and informal chat about the best option for your organisation with no ‘hard sell’.
