Contact
Contact us

External DPO: GDPR compliance and Data Protection Officer services

External DPO: structuring and managing GDPR compliance over the long term

Since 2018, AUMANS AVOCATS has acted as an external DPO – Data Protection Officer – for companies, French and international groups, public bodies and organisations operating in highly regulated sectors.

Engaging an external DPO enables an organisation to benefit from specialised data protection expertise without necessarily creating a dedicated in-house function.

At the heart of data governance, the DPO informs and advises the organisation, monitors compliance with applicable rules, supports projects involving personal data issues and acts as a key point of contact for the CNIL or other data protection authorities, as well as for data subjects.

AUMANS AVOCATS therefore approaches the external DPO function as long-term legal, operational and strategic support, tailored to each client’s activities, organisation and risk profile.

Entrusting this role to AUMANS AVOCATS, a law firm recognised for its expertise in data protection and IT and data law, ensures an integrated, confidential and strategic approach.

Contact us
DPO & Health
DPO training

The legal framework applicable to the appointment of a DPO

When is the appointment of a DPO mandatory?

Article 37 of the GDPR sets out several circumstances in which the appointment of a Data Protection Officer is mandatory.

Large-scale regular and systematic monitoring of individuals

The appointment of a DPO is also mandatory where the core activities of the controller or processor consist of processing operations which, by virtue of their nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale.

This may in particular concern certain activities based on behavioural monitoring, profiling, geolocation, surveillance or continuous monitoring of users.

Why appoint a DPO voluntarily?

Outside the circumstances in which appointment is mandatory, the GDPR allows controllers and processors to appoint a DPO voluntarily.

Such an appointment may be particularly relevant where an organisation:

  • carries out numerous personal data processing activities;

  • processes sensitive or strategic data;

  • develops complex digital projects;

  • uses innovative technologies or artificial intelligence systems;

  • carries out profiling or monitoring activities;

  • works for clients imposing high compliance standards;

  • is particularly exposed to cyber or regulatory risk.

Appointing a DPO can then help structure data governance and establish an ongoing compliance monitoring framework.

Public authorities and public bodies

A DPO must, in principle, be appointed where processing is carried out by a public authority or body, subject to the exception applicable to courts acting in their judicial capacity.

Large-scale processing of sensitive data

A DPO must also be appointed where the core activities of the organisation consist of large-scale processing of special categories of data referred to in Article 9 of the GDPR, such as data concerning health, biometric data or genetic data, or personal data relating to criminal convictions and offences referred to in Article 10.

The processing of sensitive data does not, in itself, automatically trigger an obligation to appoint a DPO: the conditions laid down in Article 37 must be assessed in light of the nature and scale of the processing concerned.

Can the DPO function be outsourced?

Yes. Article 37(6) of the GDPR expressly provides that the DPO may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.

The GDPR therefore allows the DPO function to be entrusted to an external service provider with the expertise and safeguards necessary to perform the role.

Outsourcing provides access to specialised expertise, an independent external perspective on the organisation’s practices and the ability to tailor the resources allocated to the DPO function to the organisation’s actual needs.

It may be suitable for SMEs and growing businesses, as well as international groups or organisations that already have legal, compliance, IT or cybersecurity teams.

What are the DPO’s tasks under the GDPR?

Article 39 of the GDPR defines the minimum tasks of the Data Protection Officer.

Informing and advising the organisation

The DPO informs and advises the controller or processor, as well as employees who carry out personal data processing, of their obligations under the GDPR and other applicable European Union or national data protection rules.

This role includes, in particular, the ability to review new projects and identify their data protection implications at a sufficiently early stage.

Advising on Data Protection Impact Assessments - DPIAs

Where the characteristics of processing are likely to result in a high risk to the rights and freedoms of individuals, a Data Protection Impact Assessment may be required pursuant to Article 35 of the GDPR.

The DPO advises the organisation on the carrying out of such assessments and monitors their performance.

In particular, the DPO may assist in determining whether a DPIA is required, selecting the appropriate methodology, assessing risks, identifying measures to mitigate those risks and monitoring the implementation of recommendations.

Acting as a point of contact for data subjects

Data subjects may contact the DPO with regard to any matter relating to the processing of their personal data and to the exercise of their rights under the GDPR.

The DPO therefore contributes to organising and monitoring procedures for handling requests for access, rectification, erasure, objection, restriction of processing or data portability, where those rights apply.

DPO and accountability: who is responsible for compliance?

The appointment of a DPO does not transfer legal responsibility for the organisation’s compliance to the DPO.

Under the accountability principle, and in particular Article 24 of the GDPR, the controller is responsible for implementing appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR.

The DPO performs an advisory and monitoring role. The DPO provides opinions and recommendations, supports the organisation and assesses its compliance framework.

This distinction is essential to effective governance: the DPO advises and monitors; the organisation remains responsible for its decisions and processing activities.

Monitoring compliance with the GDPR

The DPO monitors compliance with the GDPR, other applicable data protection provisions and the organisation’s internal policies and procedures.

This monitoring role also covers the assignment of responsibilities, awareness-raising and training of staff, and related audits.

The DPO therefore contributes to assessing the organisation’s level of compliance over time and identifying corrective measures or priority actions to be implemented.

Cooperating with the CNIL

The DPO cooperates with the supervisory authority and acts as its contact point on issues relating to the processing of personal data.

This role is particularly important in the event of a request from the CNIL, an inspection or investigation, prior consultation, a personal data breach, a complaint or claim, or more generally any exchange with the supervisory authority.

An independent function within the organisation

The specific role of the DPO explains the safeguards laid down in Article 38 of the GDPR. The controller or processor must ensure that the DPO is involved, properly and in a timely manner, in all issues relating to the protection of personal data.

The DPO must be provided with the resources necessary to perform the role, have access to the relevant personal data and processing operations, and be able to maintain his or her expert knowledge. The DPO must also perform the role independently.

  • the DPO must not receive any instructions regarding the exercise of the DPO tasks;

  • the DPO may not be dismissed or penalised for performing those tasks;

  • the DPO must be able to report directly to the highest management level;

  • the DPO is bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with applicable law.

This independence does not isolate the DPO from the organisation. On the contrary, it requires the DPO to be involved in projects sufficiently early and to be able to engage directly with operational teams and senior management.

Preventing conflicts of interest

The DPO may fulfil other tasks and duties, provided that these do not give rise to a conflict of interests. In particular, the DPO must not be placed in a position in which he or she determines the purposes or means of processing that he or she would subsequently be required to monitor.

The existence of a conflict of interests must be assessed in practice, taking into account the tasks performed, the organisation concerned and the processing operations carried out.

This requirement applies to both internal and external DPOs and requires a clear allocation of functions and responsibilities and, where necessary, appropriate recusal arrangements.

AUMANS AVOCATS assists organisations in identifying and preventing such situations in order to safeguard the independence and effectiveness of the DPO function.

Engaging a law firm such as AUMANS AVOCATS to act as your external DPO ensures a legal and strategic approach.

Contact us

What does an external DPO do on a day-to-day basis?

The engagement is tailored to each client’s size, sector, organisation and level of maturity. AUMANS AVOCATS may in particular assist with:

  • carrying out an initial compliance audit;

  • mapping personal data processing activities;

  • establishing, reviewing and maintaining the record of processing activities;

  • defining a compliance roadmap;

  • analysing the legal bases for processing;

  • reviewing privacy notices and privacy policies;

  • organising the exercise of data subject rights;

  • assessing data retention periods;

  • implementing the principles of privacy by design and privacy by default;

  • advising on DPIAs and monitoring their performance;

  • reviewing contracts with processors in light of Article 28 of the GDPR;

  • governing international data transfers;

  • assisting with the implementation of Standard Contractual Clauses and transfer impact assessments;

  • reviewing new products, digital projects and processing activities;

  • supporting projects involving artificial intelligence systems;

  • participating in Data, IT, security, compliance or innovation committees;

  • training and raising awareness among staff;

  • organising and conducting internal audits;

  • handling requests and complaints from data subjects;

  • supporting the management of personal data breaches;

  • managing relations with the CNIL;

  • organising legal and regulatory monitoring.

The objective is not merely to build GDPR documentation, but to maintain an effective data protection governance framework tailored to the organisation’s actual activities.

DPO, personal data breaches and crisis management

A personal data breach may require the immediate mobilisation of legal, IT, cybersecurity, communications and senior management teams. The DPO must be involved promptly in the assessment of the incident.

AUMANS AVOCATS assists its clients in particular with:

  • legally assessing and classifying the incident;

  • identifying the categories of data and data subjects concerned;

  • assessing the risks to the rights and freedoms of individuals;

  • documenting the assessment carried out;

  • assessing whether notification to the CNIL is required under Article 33 of the GDPR;

  • assessing whether communication to data subjects is required under Article 34;

  • coordinating applicable regulatory obligations with the organisation’s contractual commitments;

  • monitoring remediation measures;

  • drawing lessons from the incident in order to improve internal procedures.

A DPO involved in new projects

Article 38 of the GDPR requires the DPO to be involved, properly and in a timely manner, in issues relating to the protection of personal data.

Such early involvement is particularly important for projects involving:

  • new technologies;

  • artificial intelligence;

  • processing of sensitive data;

  • profiling;

  • monitoring tools;

  • digital applications or platforms;

  • connected devices;

  • large-scale processing;

  • international data transfers;

  • new uses of existing data.

Involving the DPO from the design stage enables data protection requirements to be embedded in legal, organisational and technical choices and supports the implementation of the principles of privacy by design and privacy by default.

A DPO supporting governance and senior management

Data protection is now a governance issue. The GDPR expressly provides that the DPO is to report directly to the highest management level.

AUMANS AVOCATS may implement periodic reporting covering in particular:

  • progress against the GDPR compliance roadmap;

  • the main risks identified;

  • processing activities or projects requiring particular attention;

  • DPIAs completed or in progress;

  • data subject rights requests;

  • incidents and personal data breaches;

  • audits carried out;

  • awareness-raising and training initiatives;

  • regulatory developments;

  • compliance priorities for the following period.

A DPO activity report may also be presented periodically to senior management in order to assess changes in the organisation’s level of maturity.

Appointing AUMANS AVOCATS as your external DPO ensures professional confidentiality, cross-disciplinary legal expertise and proactive preparation for potential regulatory inspections.

Contact us

Why entrust the external DPO function to AUMANS AVOCATS?

Specialist data protection expertise

AUMANS AVOCATS is a law firm with in-depth expertise in data protection. In recognition of this expertise, the firm is ranked by The Legal 500. It advises on a daily basis on matters relating to the GDPR, personal data, cybersecurity and new technologies.

This practice enables the firm to approach the DPO function beyond document management alone and to address complex legal issues that may arise in the course of the engagement.

An approach combining IT, AI and cybersecurity issues

The DPO function increasingly sits at the intersection of multiple regulatory frameworks and technical issues.

AUMANS AVOCATS advises its clients in particular on artificial intelligence systems, Data projects, IT contracts, cybersecurity, personal data breaches, international data transfers and new European digital regulations.

Where necessary, the firm works with its clients’ CIOs, CISOs and technical service providers, as well as with specialised experts.

Experience of CNIL inspections and enforcement proceedings

Knowledge of the CNIL’s inspection practices makes it possible to incorporate, from the design stage of a compliance programme, the elements likely to be scrutinised by the supervisory authority.

AUMANS AVOCATS also assists its clients at the various stages of a CNIL inspection or investigation: preparing responses, documentary or on-site inspections, follow-up requests, formal notices and contentious proceedings where applicable. Where necessary, the firm also represents and assists clients before the CNIL’s restricted committee (formation restreinte), which is responsible for imposing sanctions.

This experience underpins an approach to the DPO function based on compliance that is effective, documented and demonstrable.

An external DPO engagement tailored to each organisation

The needs of an international group, an SME, a technology company or a public body are not the same. The engagement may therefore combine:

  • regular on-site support within the organisation;

  • remote support;

  • participation in internal committees;

  • ongoing assistance to teams;

  • specific arrangements for urgent situations;

  • periodic reporting to senior management;

  • audits and thematic reviews;

  • training and awareness-raising initiatives.

The organisation of the engagement and the resources allocated to it are defined according to the volume and sensitivity of processing activities, the complexity of the organisation, its sector of activity and its level of maturity.

AUMANS AVOCATS, external DPO

AUMANS AVOCATS assists its clients in building and managing sustainable governance of their personal data.

Our approach combines legal expertise, knowledge of digital environments, an understanding of sector-specific issues and practical experience of the DPO function.

The firm assists clients both in establishing an external DPO function and in strengthening an existing framework, supporting an internal DPO, or advising on projects and situations involving specific data protection issues.

A question ? Contact us !

FAQ - External DPO

When is the appointment of a DPO mandatory?

The appointment of a DPO is mandatory in the circumstances set out in Article 37 GDPR, including for public authorities and bodies, where the core activities require regular and systematic monitoring of data subjects on a large scale, or where they consist of large-scale processing of special categories of personal data or personal data relating to criminal convictions and offences.

Can a company appoint an external DPO?

Yes. Article 37(6) GDPR expressly provides that the DPO may be a staff member or may fulfil the tasks on the basis of a service contract. A company may therefore appoint an external DPO who has the expertise, resources and independence required to perform the role effectively.

What is the role of an external DPO?

An external DPO performs the tasks set out in Article 39 GDPR: informing and advising the organisation, monitoring compliance with the GDPR, providing advice regarding Data Protection Impact Assessments and monitoring their performance, cooperating with the supervisory authority, and acting as a contact point for the supervisory authority and for data subjects.

What is the difference between an internal DPO and an external DPO?

The tasks and safeguards laid down by the GDPR are the same. An internal DPO is a member of the organisation’s staff, whereas an external DPO performs the role under a service contract. In both cases, the DPO must have the expertise, resources and independence required for the effective performance of the role.

How is an external DPO designated to the CNIL?

Where the organisation falls within the competence of the CNIL, the DPO designation must be notified to the CNIL in accordance with the applicable procedure. The organisation must also ensure that the DPO’s contact details are published and communicated to the supervisory authority in accordance with the GDPR.

Recommended internal linking

Include contextual links to the External DPO - Healthcare / HealthTech / MedTech, Healthcare & Data Protection Compliance, AI & Healthcare, Health Data Warehouses, and CRO & Clinical Research pages. Those pages should also link back to this pillar page whenever the external DPO function is discussed.

A question ? Contact us !

Follow the latest news from the firm on DPO...

Our blog about DPO