Regulation (EU) 2016/679, Article 37

Outsourced DPO: the data protection officer mandate on subscription

An outsourced DPO is a data protection officer who fulfils the mandate on the basis of a service contract rather than a contract of employment, a possibility Article 37(6) of the GDPR provides for expressly. The text is neutral between internal and external DPO services. What decides in practice is the ability to satisfy three requirements that are not negotiable: expertise, absence of conflict of interests, and independence in the exercise of the tasks. A service contract satisfies the second by construction, because there is no relationship of subordination.

By Younès Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Mandatory appointment or voluntary step

Article 37(1) of Regulation (EU) 2016/679 makes appointment mandatory in three situations: the processing is carried out by a public authority or body, except for courts acting in their judicial capacity (point a); the core activities of the controller or processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale (point b); or those core activities consist of processing on a large scale of special categories of data under Article 9, or of personal data relating to criminal convictions and offences under Article 10 (point c).

Outside those three cases, appointment is a voluntary step, which an organisation may take in order to structure its compliance and to have an identified point of contact for the supervisory authority. Article 37(4) also allows Union or Member State law to provide for further cases of mandatory appointment, which must be checked against national law rather than assumed.

"Core activities"

Operations essential to achieving the objectives of the controller or processor, as opposed to support functions. Payroll and internal IT are support functions, however indispensable. The processing of health data by a hospital is not: treating patients presupposes processing those data.

"Large scale"

Assessed against a combination of factors: the number of data subjects, in absolute terms or as a proportion of the relevant population; the volume and range of data; the duration or permanence of the processing; and its geographical extent. No numerical threshold appears in the text, and none should be relied on as if it did.

What the subscription covers

The mandate covers the tasks assigned to the officer by Article 39, performed on a continuing basis rather than as a one-off engagement.

Single point of contact for the supervisory authority

The officer cooperates with the supervisory authority and acts as the contact point on any issue relating to processing (Article 39(1)(e)). Their contact details are published and communicated to the authority in accordance with Article 37(7).

Handling data subject requests

Processing requests for access, rectification, erasure, restriction, portability and objection, within the one-month period in Article 12(3), extendable by two further months depending on the complexity and number of requests.

Annual review of the records of processing

Updating the Article 30 records annually and at each significant change in the processing activities, so that the records remain capable of being produced in the event of an inspection.

Regulatory watch

Monitoring developments in the Regulation, in the guidelines of the European Data Protection Board and in the positions of the supervisory authority, and informing the controller of the obligations that follow (Article 39(1)(a) and (b)).

Breach notification within 72 hours

Conducting the notification procedure to the supervisory authority within the period set by Article 33(1) and, where the risk to data subjects requires it, the communication provided for by Article 34.

Availability

The officer is involved, in advance and in a timely manner, in all issues relating to the protection of personal data within the meaning of Article 38(1), rather than consulted after the fact on decisions already taken.

Terms of the mandate

The mandate is formalised in a service contract, a possibility expressly provided for by Article 37(6). Article 38(3) guarantees that the officer receives no instructions regarding the exercise of the tasks and is not dismissed or penalised for performing them. Article 38(6) allows the officer to fulfil other tasks provided they do not result in a conflict of interests, which a service contract addresses by construction, there being no relationship of subordination.

Article 38(2) requires the organisation to provide the resources necessary to carry out the tasks, access to personal data and processing operations, and the means to maintain expert knowledge. An external mandate does not relieve the organisation of that duty.

One point is frequently misunderstood: Article 39 entrusts the officer with monitoring compliance, not with responsibility for compliance. That responsibility remains entirely with the controller under Article 24. Appointing an officer, internal or external, transfers no liability.

The engagement renews by tacit agreement on an annual basis. The scope of the subscription, the deliverables and the amount are set out in the quotation issued within 48 hours of the scoping discussion.

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

Frequently asked questions

Can the data protection officer be external to the company?

Yes. Article 37(6) of Regulation (EU) 2016/679 provides that the data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. In both cases Article 38(3) guarantees the absence of instructions regarding the exercise of those tasks, and Article 37(7) requires publication of their contact details and communication of them to the supervisory authority.

Can the mandate be terminated during the subscription?

The service contract sets the termination conditions before the engagement begins. A mandatory appointment under Article 37(1) presupposes that the function remains filled continuously, so termination of an external mandate is articulated in the contract with the appointment of a new officer, internal or external, in order to avoid any vacancy.

Can a company that already has an internal DPO also use an external one?

The Regulation provides for the designation of a single data protection officer per controller under Article 37, unless a group of undertakings designates a single officer for the group (Article 37(2)). An external officer therefore replaces an internal one rather than being added to it; a separate, one-off advisory engagement distinct from the officer mandate remains possible.

Does appointing a DPO transfer liability for compliance?

No. Article 39 of Regulation (EU) 2016/679 entrusts the officer with monitoring compliance with the Regulation, with internal policies, with the assignment of responsibilities, with awareness-raising and training, and with audits. Responsibility for compliance itself remains with the controller under Article 24, which requires it to implement appropriate technical and organisational measures and to be able to demonstrate that the processing is performed in accordance with the Regulation.

What this regime triggers elsewhere

Appointing an officer only makes sense once it has been established that Regulation (EU) 2016/679 applies, and on what basis: controller or processor, Article 3(1) or Article 3(2).

Establishing GDPR scope first

Regulation (EU) 2024/1689 creates no function equivalent to the data protection officer, but the record of processing activities the officer maintains is the starting point for the inventory of AI systems and their classification.

Classifying the organisation's AI systems

A foreign company establishing in Europe bears the appointment obligation from the start of the activity where Article 37 is satisfied.

Appointing an officer from the point of establishment

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.