The DPO (Data Protection Officer), or Responsible for Data Protection, is the role established by Articles 37-39 of the GDPR to monitor compliance with data protection legislation within an organization. The DPO acts independently and serves as the point of contact between the organization, data subjects, and the Italian Data Protection Authority (Garante per la protezione dei dati personali).

The main tasks, provided for by Article 39, are:

• Information and consultancy to the owner, the data processor, and employees on the obligations arising from the GDPR and other data protection regulations.
• Compliance monitoring to internal rules and policies, including assignment of responsibilities, staff awareness and training and related audits.
• Opinions on impact assessment (DPIA) for processing operations likely to present a high risk to the rights and freedoms of data subjects, and monitoring of its implementation.
• Cooperation with the Guarantor and act as a point of contact for issues relating to processing, including prior consultation.
• Point of reference for interested parties, who can contact the DPO to exercise their rights (access, rectification, erasure and other rights provided for by the GDPR).
• Support in managing violations of personal data (data breach), assisting the owner in the assessment and in any notifications to the Guarantor and the interested parties.

The GDPR expressly allows the appointment of an external DPO based on a service contract (Article 37, paragraph 6). This is the most common choice for organizations that lack the necessary expertise internally or that cannot justify a dedicated role. The main advantages:

• Specialist skills: knowledge of the legislation, the Guarantor's indications and good security practices, without having to develop them internally.
• Independence and absence of conflicts of interestAn external DPO does not hold roles that require him or her to decide on the purposes and means of processing, as required by Article 38.
• Proportionate costs: the burden of a dedicated internal figure is avoided, with a service sized to the complexity of the treatments.
• Continuous update on the evolution of regulations, provisions and guidelines.
• Flexibility: the level of support adapts to needs, with the possibility of increasing it during critical phases such as new projects, audits or incidents.
• Multidisciplinary approach: integrated legal and technical skills, from documentation to cyber security.
• Continuity of the garrison: a point of reference always available for questions, checks and management of critical situations.

We start with your organization's industry, size, and the processes it actually performs. Based on this, we identify the professional with the skills and experience best suited to your context, supported by the technical team for security aspects.

Yes. The GDPR allows this, provided that no conflicts of interest arise and that the DPO has the necessary time and resources to perform their duties effectively for each organization.

The DPO is legally bound by secrecy or confidentiality in the performance of their duties (Article 38, paragraph 5 of the GDPR). This is in addition to specific contractual confidentiality commitments and internal security procedures for managing documents and communications.

The DPO can be reached by phone, email, or other agreed-upon channels, and works closely with your contacts to ensure open and ongoing communication.

Please remember that the DPO's contact details must be published and communicated to the Data Protection Authority, as required by Article 37, paragraph 7 of the GDPR: we can also assist you in this process.

As a rough guide, an average annual expenditure of €12.000 is a good starting point for many organizations. However, the actual cost depends on several factors:

• Organization size and complexity of processes that process personal data.
• Business sector: areas such as healthcare or finance require specific skills and more stringent controls.
• Volume and type of data processed, in particular for special categories of data.
• Geographical scope and data transfers to non-EU countries.
• Frequency and level of support: periodic meetings, reviews and reports.
• Additional services, such as staff training, data protection audits, or breach management.
• Specific needs which require tailor-made agreements in addition to the tasks provided for in the Regulation.

After an initial analysis, we will provide you with a clear quote tailored to your needs.

Yes. The appointment of an external DPO with a service contract is expressly required by Article 37, paragraph 6 of the GDPR. Our professionals are familiar with the Regulation, the Privacy Code, and the provisions of the Italian Data Protection Authority and work to support your organization in achieving compliance, which remains the responsibility of the data controller.

We provide periodic reports on our activities and organize regular meetings, including online meetings via Google Meet, to review compliance status, identified critical issues, and priorities for action.

The terms of termination are clearly defined in the service contract. If any issues arise, we will work with you to resolve them, but you can terminate the service at any time according to the agreed terms. Please note that if the designation of a DPO is mandatory, the organization will need to appoint another.