External DPO (DPO-as-a-Service)
The Data Protection Officer function performed under a service contract — the seniority, independence and availability o…
External DPO (DPO-as-a-Service)
The Data Protection Officer function performed under a service contract — the seniority, independence and availability of a DPO without the cost of an internal hire. The CNPD, in Deliberation 2025/267 (2025), expressly confirmed that the DPO may be external to the organisation and bound to it by a service-provision contract.
What it includes
- Formal designation and communication to the CNPD
- Standing point of contact for the authority and data subjects
- Continuous monitoring and periodic reporting to top management
- Independence and absence of conflict of interests
Legal basis: GDPR, Arts. 37–39; Law 58/2019; CNPD Deliberation 2025/267