Shared DPO: how a single officer can cover multiple entities

What the GDPR allows regarding pooling

Article 37(3) of the GDPR provides that 'a group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment'. This principle also applies to public authorities and bodies. A single person (natural or legal) can therefore be DPO for several legal entities, provided they are easily accessible and have sufficient resources. See also the cases where the DPO is mandatory.

For whom does pooling make sense?

• Groups with several subsidiaries sharing common tools and processing activities
• Franchise or homogeneous establishment networks
• Small local authorities and inter-municipal bodies (the most common solution)
• Federations and network umbrella organisations
• Healthcare and social care establishments within the same hospital group or foundation

Conditions to be met

Pooling is not simply cost-sharing. The DPO must remain accessible to each entity, have sufficient resources and avoid conflicts of interest. Each entity must be declared to the CNIL with the same DPO (the name or company name of the service provider appearing on each declaration). An outsourced DPO is particularly suitable, as they provide availability and tools.

The advantages

Pooling significantly reduces costs whilst ensuring consistent compliance across entities. It facilitates the sharing of best practices, harmonisation of records and a coordinated response in the event of an incident. With a shared platform, each entity retains visibility of its own compliance score.

Limitations to monitor

Be careful not to under-resource the mission: a pooled DPO covering dozens of heterogeneous entities is not credible if they do not have the means to act. Actual availability and knowledge of each entity's specific features are the real criteria for success.