Can an outsourced DPO be a company rather than an individual?

Yes, Article 37 permits the designation of a legal person; a natural person must then be identified as contact, and the organisation must publish the DPO's contact details and communicate them to the French data protection authority (CNIL).

Is the DPO liable in the event of a CNIL sanction?

No, the controller (or processor) remains solely responsible for compliance; the DPO advises, informs and monitors.

How much does an outsourced DPO cost?

The price depends on the volume and sensitivity of processing activities; for an SME, the order of magnitude ranges from a few hundred to a few thousand euros per month. Always ask for the number of days included.

Can a DPO be shared between several companies in a group?

Yes, Article 37, paragraph 2, permits a single DPO for a group of companies, provided that they are easily accessible from each establishment.

Can the CIO be the DPO?

The CIO function is cited by the European Committee among those that create a conflict of interest, since the CIO determines the means of processing; the combination is not recommended and has already been sanctioned.

Outsourced DPO or in-house DPO: which should you choose for your business?

15 octobre 2026 · Updated on 2026-10-21 · By Aymeric Guyard · 10 min read

In brief

GDPR permits both models (Article 37, paragraph 6) and requires the same from each: competence, independence, absence of conflicts of interest, sufficient resources and direct access to management. An in-house DPO suits organisations that process data on a large scale continuously and can dedicate a full-time position without conflicts of interest. An outsourced DPO suits the majority of SMEs, mid-caps and local authorities: it costs less than a position, delivers immediate multi-regulatory expertise and avoids the conflict of interest risk most often sanctioned by the French data protection authority (CNIL).

When is the designation of a DPO mandatory?

Article 37 of GDPR requires the designation of a data protection officer in three cases:

The processing is carried out by a public authority or body (except courts in the exercise of their judicial function).
The core activities consist of regular and systematic monitoring on a large scale of individuals (profiling, geolocation, behavioural advertising, surveillance).
The core activities consist of large-scale processing of special category data (health, biometric, opinions, sexual orientation, etc.) or data relating to criminal convictions.

Outside these cases, designation is voluntary, but the French data protection authority (CNIL) recommends it and the same rules apply once a DPO is designated. In practice, a recruitment agency, a mutual insurance company, a mobile app publisher with trackers, a healthcare establishment or a local authority are concerned. The DPO must be declared to the French data protection authority (CNIL) via the online form.

What GDPR requires of the DPO, regardless of status

Article 38 sets out guarantees that the controller must ensure:

Involvement in a timely manner in all issues relating to the protection of personal data.
Necessary resources: time, budget, access to data and processing operations, ongoing training.
Independence: the DPO shall not receive any instructions regarding the exercise of their tasks and shall not be dismissed or penalised for performing their tasks.
Direct reporting to the highest management level.
Absence of conflict of interest: the DPO cannot determine the purposes and means of processing themselves. The European Data Protection Board lists as incompatible the positions of chief executive officer, chief operating officer, chief financial officer, chief marketing officer, head of human resources and chief information officer.

This last point is the most discriminating. In an SME, the internal DPO is often the CIO, the CFO or the sole legal counsel, precisely the functions listed as incompatible. Several European authorities, including the French data protection authority (CNIL), have sanctioned organisations for DPO conflicts of interest, and the French data protection authority (CNIL) has made the verification of these guarantees a systematic point in its inspections.

Comparison between internal DPO and external DPO

Criterion	Internal DPO	Outsourced DPO
Cost	Loaded salary for an experienced legal or compliance profile, plus training and tools	Monthly or annual package, scaled to the volume of processing activities; as a rough guide, a few hundred to a few thousand euros per month for an SME or mid-market company
Implementation time	Recruitment or upskilling: 3 to 9 months	Contract signature and onboarding: 2 to 4 weeks
Expertise	Depends on the profile; typically one field only	Multi-disciplinary team (legal, security, business), guaranteed monitoring, often covering NIS2, DORA and AI Act
Independence and conflict of interest	High risk if combined with an operational role	Structurally independent; conflict of interest is contractually excluded
Knowledge of the organisation	Strong, daily presence	To be built; requires an internal contact and regular meetings
Continuity	Fragile: departure, absence, change of role	Guaranteed by the provider (paired working, replacement)
Liability	The controller remains liable; the DPO is not personally liable for compliance	Same; the provider accepts contractual liability for its deliverables
Suited to	Large groups, organisations processing sensitive data at scale, heavily regulated sectors	SMEs, mid-market companies, local authorities, groups of SMEs, subsidiaries, multi-regulation organisations

Questions to ask an outsourced DPO provider

Who will be formally designated as DPO with the French data protection authority (CNIL), and who replaces them in their absence?
How many days or hours per month are actually dedicated to your organisation?
What deliverables are included: record of processing activities, DPIA, responses to data subject requests, breach management, training, annual report to management?
Does the provider also cover NIS2, DORA or the AI Act, or will a second provider be required?
What management tool is provided and who owns the data at the end of the contract?
Has the provider previously supported a CNIL inspection, and with what outcome?
How does the DPO access management and how frequently?

The hybrid model, often the most effective

Many organisations opt for a combination: an outsourced DPO designated with the CNIL, guaranteeing independence and expertise, and an internal contact (legal counsel, quality manager, CIO) who provides on-the-ground knowledge, collects information and implements actions. GDPR permits this: it requires a DPO, not a DPO alone. This model also enables expertise to be shared across multiple regulations, which the proliferation of texts (NIS2, DORA, AI Act) makes increasingly necessary.

How to decide in four steps

Verify the obligation to designate (Article 37) and, if it does not exist, decide whether or not to designate voluntarily.
Map processing activities: volume, sensitivity, number of data subjects; this determines the requirement in days. See our comparison of outsourced DPO providers.
Test for conflict of interest for each internal candidate: do they determine the purposes and means of processing (controller)?
Compare the total cost over three years (loaded salary, training, tools, replacement) with an outsourced package, factoring in the cost of risk: the fine for absence or failure of a DPO can reach €10 million or 2% of worldwide turnover (Article 83, paragraph 4). Start with the GDPR self-assessment.

Take action

Manage your compliance with Data Comply One: all-in-one software and outsourced DPO/CISO experts.

Discover the outsourced DPO →Test my GDPR compliance →

Sources

Regulation (EU) 2016/679 (GDPR), Articles 37, 38, 39 and 83, EUR-Lex.
European Data Protection Board, Guidelines on Data Protection Officers (WP243 rev.01).
The French data protection authority (CNIL), 'Désigner un délégué à la protection des données' and practical guide for DPOs.