Specialist DPO expertise at a proportionate cost.
Some organisations are legally required to appoint a Data Protection Officer, and many others would benefit from one but cannot justify a full-time hire. An outsourced DPO gives you specialist expertise at a proportionate cost. Where a DPO is required, we act as your named officer, providing ongoing compliance advice and practical support, tailored to your sector and risk profile.
We act as your named Data Protection Officer, providing ongoing compliance advice, supporting you with data breaches and data subject access requests, and guiding you on policies and risk management. You get senior expertise without the cost of a full-time appointment.
The support is shaped around your sector and risk profile. A small organisation and a large, complex one need different things from a DPO, and we scale accordingly so you get what is genuinely useful to you.
The DPO role requires independence and expertise that can be hard to maintain in-house, particularly for smaller organisations. Outsourcing gives you both, at a cost that makes sense.
Under Article 37 of the UK GDPR, you must appoint a Data Protection Officer if you are a public authority or body, if your core activities involve regular and systematic monitoring of individuals on a large scale, or if your core activities involve large scale processing of special category data, such as health information, or data about criminal convictions and offences. Plenty of organisations fall outside those tests, and the ICO provides a short self assessment to help you check. If you decide a DPO is not required, it is sensible to record how you reached that view, and you still need someone who takes responsibility for data protection. Some organisations choose to appoint a DPO voluntarily, for example because clients expect it in contracts or tenders. The ICO's guidance indicates that a voluntarily appointed DPO is subject to the same requirements as a mandatory one, so the role should be set up properly either way.
Article 38 of the UK GDPR sets out how a DPO must be positioned. They should be involved properly and in good time in all data protection issues, be given the resources they need, and report to the highest level of management. They must not be instructed how to carry out their DPO tasks, and they cannot be dismissed or penalised for performing them. Any other duties they hold must not create a conflict of interest, which is why people who decide how personal data is used, such as heads of IT, HR or marketing, are usually a poor fit. The DPO also needs expert knowledge of data protection law and practice, proportionate to the processing you carry out. Our team brings CIPP/E certified privacy expertise and decades of experience across the director team, so the role is filled by people who understand both the law and how organisations really work.
An in-house DPO knows your people and systems well, but finding someone with genuine expertise, enough time and no conflicting responsibilities is difficult, especially in a smaller organisation. The UK GDPR expressly allows the DPO tasks to be carried out under a service contract, so an external appointment is a recognised option rather than a workaround. Outsourced DPO services give you an independent adviser who sits outside your internal reporting lines and brings a wider view of how other organisations approach the same problems. The trade off is that an external DPO needs good access to the right people and information, so we agree clear points of contact and ask to be brought in early when new projects or suppliers involve personal data. For some organisations a blend works best, with a named person in-house handling day to day matters and our team providing the expert oversight.
We start with a conversation about your organisation, the personal data you hold and why you are considering a DPO. We then review your current arrangements, such as your records of processing, privacy notices, policies, supplier contracts and the way you handle requests and incidents. From that review we agree a practical plan that deals with the most important gaps first. Once appointed, we act as your named DPO: you publish our contact details and tell the ICO, and we become a point of contact for the regulator and for individuals with questions about their data. From there we provide ongoing advice, support with data breaches and data subject access requests, and guidance on policies and risk, shaped around your sector. We work with organisations in Sussex, London and across the UK, and much of the work is delivered remotely.
We work with organisations across the UK. Much of our work is delivered remotely, so we support clients wherever they are based, with particular strength in London and the Southeast. We are based in Haywards Heath, West Sussex, and the areas we cover include London, Brighton and Hove, Crawley, Horsham, Haywards Heath, Burgess Hill, Worthing, Guildford, Tunbridge Wells, Reading, Slough, Newbury, Swindon and Bristol.
Want to know if this is the right fit for your organisation? We will talk it through with you, with no obligation.
Get in touchWhere a Data Protection Officer is required, we act as your named DPO. Ongoing compliance advice, support with data breaches and access requests, and guidance on policies and risk management, tailored to your sector and risk profile.
Book a consultation and we will tailor this service to your organisation and the risks it faces.
Some organisations do, depending on what they do and the scale and sensitivity of the data they handle. We can assess your position and tell you clearly whether you need one.
It starts from £850 per month, with the exact figure depending on your needs. It is designed to be proportionate, far less than a full-time hire while giving you the expertise the role requires.
Yes. As well as acting as your named DPO, we can mentor and support an in-house person, depending on what suits your organisation best.
No. Under the UK GDPR a DPO is mandatory for public authorities and bodies, and for organisations whose core activities involve large scale, regular and systematic monitoring of individuals, or large scale processing of special category or criminal offence data. Many small and medium sized businesses fall outside those tests. Even so, every organisation needs someone responsible for data protection, and some appoint a DPO voluntarily to meet client expectations.
A DPO informs and advises the organisation and its staff about their data protection obligations, monitors compliance, including policies, awareness, training and audits, and advises on data protection impact assessments. They also cooperate with the ICO and act as its contact point, and individuals can contact the DPO about how their data is used. Our outsourced DPO services cover these tasks, with us acting as your named officer.
The UK GDPR does not require a specific qualification. It requires expert knowledge of data protection law and practice, matched to the complexity and sensitivity of the processing involved. Qualifications are a useful sign of that knowledge, alongside practical experience. Our team includes CIPP/E certified privacy expertise and ISO 27001 Lead Auditor and Lead Implementer experience, which helps where data protection and information security overlap.
In most cases, no. Under the UK GDPR, responsibility for compliance sits with the organisation as controller or processor, not with the DPO. The DPO's role is to advise and monitor, while the organisation decides how personal data is used. That is also why the DPO must be free to raise concerns and able to report directly to the highest level of management.
We help you establish what has happened and whether the breach is likely to result in a risk to people's rights and freedoms. Where it is, the ICO usually has to be told without undue delay and, where feasible, within 72 hours of you becoming aware. We help you prepare that report, decide whether affected individuals need to be told, and record the breach and what you learned from it.
Book a consultation and we will tailor the right level of support to your organisation.
Book a Consultation