Compliance & Framework Readiness
A Named DPO on Record With Your Regulator in Two Weeks.
A named DPO appointed under Article 37(6), notified to your supervisory authority, and kept independent of your IT and security function, which is the part most providers get wrong.
Appointed in two weeks. From EUR 1,100 per month, fixed.
An independent seat, reachable by regulators and by your own people.
Acts as your external DPO and signs off on the decisions that carry real liability.
Connect on LinkedIn01 / THE DETAIL
Why Companies Appoint an External DPO
Because the role has to be independent, reachable by regulators and data subjects, and free of any conflict with the systems it oversees. That is difficult to satisfy internally in a company of any size, and a conflicted appointment is itself a finding.
A customer, tender or regulator asked who your DPO is
GDPR Article 37 makes the appointment mandatory for public bodies and for any organisation whose core activities involve large-scale monitoring or large-scale special-category data. Several member states lower the threshold further. If you cannot name a person, the conversation stalls there.
The person you named is also running IT or security
Article 38(6) requires the DPO not to determine the purposes and means of processing. Supervisory authorities have fined companies precisely because the DPO sat inside IT security. An appointment that fails the independence test is not an appointment.
A full-time DPO is a salary for a part-time need
A qualified in-house DPO costs EUR 80,000 to 150,000 a year for a function most mid-size companies need a few days a month. An external DPO under Article 37(6) is explicitly permitted, and the appointment is notified to the supervisory authority in exactly the same way.
02 / THE DETAIL
What the DPO Actually Does
Articles 38 and 39 define the position and the tasks. The DPO informs and advises, monitors compliance, consults on impact assessments, cooperates with the supervisory authority and acts as its contact point, and reports directly to the highest level of management. The tasks are the deliverables of the seat, not a quantity of consulting hours.
03 / THE DETAIL
The Conflict Rule Most Providers Ignore
Article 38(6) allows the DPO to have other tasks, provided they do not result in a conflict of interests. Deciding how personal data is processed is such a conflict, and IT and security leadership decide exactly that. A Polish supervisory authority fined a bank because its DPO sat inside the IT security team.
This is why we treat the DPO seat and any security seat as mutually exclusive for the same client, and put that rule in the appointment letter. If you already use us for a security audit or a virtual CISO, we will tell you plainly that the DPO has to be someone else, and help you structure it.
An appointment that would not survive a regulator asking one question is worse than no appointment, because it signals you knew the rule.
04 / THE DETAIL
Who Needs a DPO?
05 / THE DETAIL
Compared With the Usual Arrangement
| Atlant Security | Typical arrangement | |
|---|---|---|
| Independence | We hold the DPO seat only, never a security or IT seat for the same client | The IT manager or an MSP consultant wearing a second hat |
| On record | Named, notified to the supervisory authority, published on your privacy page | A privacy@ mailbox and nobody accountable |
| Technical depth | A security practitioner who can read the architecture behind the DPIA | A legal generalist who cannot assess the technical controls |
| Pricing | Published fixed monthly fee, 12-month term, quarterly exit | Hourly billing or an unstated retainer |
06 / PROCESS
How the Appointment Works
Designation check and scoping
We confirm whether Article 37 or national law makes the appointment mandatory for you, map your processing, and agree the scope and monthly hours in writing.
Appointment pack
Appointment letter, independence and conflict statement, reporting line to top management, and the published contact details GDPR requires.
Notification
We notify the supervisory authority, the Commission for Personal Data Protection in Bulgaria or your national authority elsewhere, so the appointment is on record.
Monthly operation
DPIAs, data subject requests, register upkeep, vendor reviews, staff questions and a quarterly report to management. Breach support is on the same line.
07 / PRICING
Pricing
Only one in nineteen external DPO providers publishes a price. We do. Fixed monthly fee, 12-month term, quarterly exit, hour band and overage rate written into the contract.
Standard DPO Seat
One legal entity, routine processing, up to roughly 500 staff.
- Named DPO, notified to the supervisory authority
- Data subject request handling
- DPIA consultation and sign-off
- Article 30 records kept current
- Breach assessment and 72-hour support
- Quarterly management report
Extended DPO Seat
Groups, multi-entity structures, high request volumes or special-category data at scale.
- Everything in the Standard seat
- Multiple entities and supervisory authorities
- Vendor and international transfer reviews
- Privacy programme roadmap and training
- Monthly management reporting
- Priority response on incidents
08 / THE DETAIL
Put a Real Name on the Appointment
A free designation check tells you whether the appointment is mandatory for you and what it would take. Two weeks later the DPO is on record.
Book the Designation Check09 / THE DETAIL
Get Your Designation Check
Choose a time for your scoping call.
10 / FAQ
External DPO FAQ
When is appointing a DPO mandatory?
Can the DPO be external?
Why can the DPO not also be our security lead?
What does the DPO do month to month?
How much does it cost?
Which supervisory authority is notified?
Do you also handle security work for DPO clients?
How quickly can the appointment be in place?
11 / THE DETAIL