Hire a DPO

Under Article 37(1) of the GDPR, a controller or processor must designate a data protection officer where:

• the processing is carried out by a public authority or body, other than a court acting in its judicial capacity;
• its core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale; or
• its core activities consist of "processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10".

Outside those cases you may appoint one by choice, or because Union or national law requires it (Article 37(4)). Article 37(6) allows a DPO to "fulfil the tasks on the basis of a service contract", which is how a DPO from the catalogue works for you. Whether you need one is your decision, and the DPO you hire can advise you on it. A DPO is a different role from the GDPR representative that EU Presence acts as under Article 27.

1. Go to More › Data Protection Officer.
2. Search by name, specialty or certification, or narrow the list with the All countries, All verticals and All services filters.
3. Select a DPO's card to open their profile. Overview has their bio, highlights, verticals, current role, starting price, work experience, projects and case studies, and resources and credentials. The Services tab lists what they sell.

Our team writes the profiles and decides the order they're listed in. A profile states no availability: what each service covers is in its description.

1. On the profile, select Choose services →, or open the Services tab.
2. Tick the services you want. They're grouped under Monthly and One-time, and you can mix both.
3. Select Acquire service, or Acquire 2 services and so on when you've ticked several.
4. Check the review: each service and its price, what you pay today, and for monthly services the monthly total that follows.
5. Optionally, write a first message in the box named after the DPO, such as Message to Anna, in up to 10,000 characters. It's posted in each service's conversation once your payment is confirmed.
6. Select Continue to payment, and pay in Stripe's checkout on the service's page.

• One purchase covers services from one DPO. To buy from two DPOs, make two purchases.
• A service you already have, paid or waiting for payment, shows a link to it in place of its checkbox, and you can't buy it twice.
• Prices are in US dollars, and nothing is charged until you pay in the checkout.

Every service in a purchase is paid in one payment. Each monthly service then becomes a subscription of its own, so you can end one without the others. The invoice is in Settings › Billing, and Manage or end a DPO service covers the rest.

Until you pay, you can leave and come back: the service's page keeps the checkout, and Cancel Purchase withdraws it.

1. The service's page confirms the payment and reads Paid · arranging access. The DPO is invited to your workspace at the email address we hold for them, and the service's conversation opens, so you can introduce your company straight away.
2. Once the invitation has gone, the status reads Invitation sent.
3. The DPO accepts or declines. Accepting makes them a member of your workspace with the DPO role, and the status becomes Active.

If the DPO declines, the status reads Declined by the DPO. Every service of theirs that was waiting for them in your workspace ends, any monthly billing stops, the conversation closes, and EU Presence refunds your payment. You can then choose another DPO from the catalogue.

Article 37(7) of the GDPR asks you to publish your DPO's contact details and to communicate them to your supervisory authority. Hiring through EU Presence does neither for you, and your Privacy Center doesn't show your DPO. Agree with your DPO in the service's conversation which details to publish, for example as the Privacy contact on your Privacy Center (see Set up and publish your Privacy Center).