How Much DPO Time is Right? - Guidance on DPO Outsourcing

In my experience, many organisations don’t know that hiring an outsourced DPO is even a possibility. When we’re talking to customers about their cyber and compliance challenges, and they mention GDPR and data protection in general, they’re over the moon to find out about the DPO service. Someone who knows the data protection landscape inside out, who’s seen it all before and already knows the solutions, and who can just come it and start managing it, is a very useful business resource. It’s one of Bulletproof’s most popular services for this reason.

The amount of time needed of course varies on the size of your business, the nature of your operations and how often things change, but in my experience there is a great starting point that seems to be universal for most SMEs: 1 day per month.

If you’re one of those organisations who are really in a bad place, I’d recommend combing DPO services with some GDPR compliance support. Get your GDPR sorted as an initial project, and then let the DPO take care of it all ongoing.

Let’s look more closely at what a DPO does to find out where 1 day per month comes from.

For most SMEs, doing all this to a good standard takes around a day per month. If your business is particularly complex, or interfaces with a lot of personal data, or if you’ve never done anything with data protection, then perhaps a bit more. One of the main benefits of an outsourced services vs an internal hire is that you can flex your DPO time to meet your actual requirements. This means you’re not over-paying, or under-delivering. Enterprises also benefit from this right-sized approach as a means to supplement their internal data protection officers at busy periods.

A good DPO will also work with your CISO (or virtual CISO) to see where efficiencies and synergies can be found. For example, making sure your penetration test includes the systems that interact with personal data to ensure compliance with Article 32 of the GDPR, or combining GDPR training with your annual security training to minimise operational impact.

As our customers like to tell me, getting all this for 1 day a month is a bargain.