External Data Protection Officer (DPO)
Many organisations need a DPO but cannot justify a permanent in-house appointment. Our external DPO service gives you a named, experienced practitioner who assumes the full responsibilities of the role.
Why is a DPO required?
Not every organisation is legally required to have a DPO. But the question of whether you need one is worth asking. We’ll tell you honestly.
DPO independence in practice
An in-house DPO can find themselves caught between good advice and internal pressure. PMA don’t do this as we are accountable to the regulations.
What an external DPO gives you
We work as a genuine extension of your team. Attending board meetings, advising on new projects, handling regulatory enquiries and keeping your accountability framework current. You get value-added advice tailored to your business, not a helpline.
Under Article 38(3) UK GDPR, a DPO must be able to perform their tasks independently. Our external model is structured to ensure genuine independence. Advice to your organisation is given honestly and in line with the regulations’ guidance.
- A named DPO who works with the ICO
- Regular compliance reviews and board reporting
- First point of contact for data subjects and the ICO
- Data Subject Access Request (DSAR) management and escalation handling
- Data breach assessment and notification support
- Ongoing policy and documentation maintenance
How this service works
Our external DPO services are structured as retainers.
This gives you a defined level of service for a sustained period, which enables us to effectively support you and your teams.
You’ll have direct access to your named DPO, scoped to the size and complexity of your business.
All retainers are scoped individually. There are no standard packages. We assess what you need based on your processing activities, risk profile and where you are currently with your compliance.
Pricing is fixed, transparent and agreed before we start working together.
Foundation
For smaller organisations that need a light-touch DPO. SMEs, new start-ups and charities. You get a named DPO, quarterly review, relevant policies written, DSAR and breach support as needed.
Growth
For organisations with more complex processing. Regulated businesses, healthcare providers and legal firms. You get monthly reporting, project advice, training delivery, and documentation creation and delivery.
Enterprise
For organisations with large-scale or cross-border processing and handling. You get attendance at board meetings, DPO committee representation, international transfer management and ISO 27001 integration.
Sectors we work with as external DPO
Fintech & regulated businesses
Where FCA obligations, Payment Card Industry Data Security Standard (PCI DSS), and UK GDPR intersect, you need a DPO who understands all three. We work with payment platforms, lending businesses, and financial technology companies in complex regulatory environments.
Healthcare & social care
Special category health data carries the highest obligations under UK GDPR. We provide DPO support to healthcare providers and social care businesses navigating NHS data sharing and Care Quality Commission (CQC) requirements.
Charities & non-profits
Charities often handle sensitive personal data, including special category data, without the compliance infrastructure of a larger organisation. We provide proportionate DPO support that works within charity budgets.
SMEs scaling quickly
Growing businesses often find they need a DPO before they can justify hiring one. Our external model gives you a qualified practitioner from day one, scaling with you as your data processing evolves.
Talk to us about External DPO services
Frequently asked questions…
Who does GDPR apply to?
GDPR applies to any business or organisation that processes the personal data of individuals within the EU, regardless of the organisation’s location. This includes companies, government bodies and non-profits. It also applies to data processors and controllers. The reality is that most businesses are affected.
What is the difference between a Data Controller and a Data Processor?
A Data Controller determines the purposes and means of processing personal data, while a Data Processor processes data according to the controller’s written instructions. Both have specific obligations under GDPR to ensure data is handled securely and compliant with the law.
What rights do individuals have under GDPR?
Individuals have several rights under GDPR, including the right to access, the right to be informed, the right to rectification, the right to erasure (also known as the “right to be forgotten”), the right to restrict processing, the right to data portability, the right to object and rights concerning automated decision-making and profiling.
If not handled correctly or if you don’t have the right processes in place, this can be a time-consuming job should a customer or member of staff request any of the above.
What qualifies as personal data under GDPR?
Personal data includes any information that can identify an individual, such as names, email addresses, phone numbers, IP addresses and even more specific information like location data, biometric data and online identifiers.
What is a Data Protection Officer (DPO), and do we need one?
A Data Protection Officer is responsible for overseeing data protection strategy and implementation to ensure organisational compliance. Under GDPR, organisations must appoint a DPO if they are a public authority, engage in large-scale processing of sensitive data or systematically monitor individuals extensively.
How do I know if I need a DPO?
If you process a lot of data, you will need a DPO. Many businesses feel it is necessary to remain compliant and deal effectively with any issues. This role doesn’t have to be full-time – it can be done virtually or on a part-time basis
What does ‘explicit consent’ mean under GDPR?
Explicit consent means individuals must provide a clear, informed agreement for their personal data to be processed. Consent must be freely given, specific, informed and unambiguous, and there must be an option to withdraw it at any time.
How can businesses ensure compliance with GDPR?
Compliance requires a systematic approach, including conducting data audits, implementing data protection policies, securing personal data, training staff, appointing a DPO if necessary and ensuring that data processing agreements are in place with third parties.
What is a data breach?
This term is used when you lose your data. It can happen because of human error or by malicious intent. You need to ensure you are at least prepared for this event. This will involve a plan for managing a data breach within your business, including liaison with the ICO and other stakeholders impacted by the data breach.
How should businesses handle a data breach?
In the event of a data breach, organisations must notify, if required, the relevant supervisory authority within 72 hours if the breach poses a risk to individuals’ rights and freedoms. They must also inform the affected individuals immediately if the breach is likely to result in high risks to their rights and freedoms.
Why do you need training for GDPR?
The ICO recognises training as an important element of accountability and compliance with GDPR. Experience has shown the human element of any organisation is the weakest link in losing data or clicking on a phishing email link. The ICO recommends that training be done at least twice a year.
It’s important to provide bespoke training modules to your teams. We answer the question most employees have – “what do I need to do differently in my role under GDPR?”. These sessions can be delivered face-to-face or over Zoom.