Can a DPO be outsourced under GDPR?
Last updated 15 October 2026. General information only, not legal advice.
Yes. Article 37(6) of the GDPR says the Data Protection Officer (DPO) may be a member of staff or may “fulfil the tasks on the basis of a service contract”. An outsourced DPO is therefore allowed, but the organisation stays responsible for compliance, and the DPO must still meet the independence, resourcing and registration requirements.
What the GDPR says about an outsourced DPO
Article 37 covers when a DPO must be designated and who can fill the role. The DPO is chosen for professional qualities, in particular expert knowledge of data protection law and practice and the ability to carry out the tasks in Article 39. Article 37(6) then allows either an employee or an external provider. The tasks are the same either way: advising, monitoring compliance, advising on data protection impact assessments, and acting as the contact point for the Data Protection Commission (DPC) and for individuals. For a full run-through, see our guide on what a DPO does.
Whether you need a DPO in the first place depends on your core activities, not on your size. Our guide to whether you need a DPO in Ireland covers the tests.
What stays the same when the DPO is external
Outsourcing the role does not outsource the responsibility. The controller or processor remains accountable for GDPR compliance. In addition, Article 38 applies in full:
- the DPO must be involved properly and in good time in issues relating to personal data;
- the organisation must provide the resources and access the DPO needs;
- the DPO must not take instructions on how to carry out their tasks, and cannot be dismissed or penalised for doing so;
- the DPO reports to the highest management level;
- the DPO must be free of conflicts of interest.
It is sensible to reflect these points in the service contract, including the scope of the work, how the DPO is kept informed, and who they report to inside the organisation.
Registering an outsourced DPO in Ireland
According to the DPC, an organisation with an outsourced DPO still has to notify the DPC of the DPO’s contact details. Notification is a one-off step with no fee, and changes to the details must be notified. You must also publish the DPO’s contact details, for example in your privacy notice, so individuals can reach them.
Need help with this? Plus Promotions Limited provides an outsourced DPO service for Irish businesses, from €750 per month.
Frequently asked questions
Can a company use an outsourced DPO instead of an employee?
Yes. Article 37(6) allows the DPO to perform the role under a service contract instead of being an employee.
Does an outsourced DPO have to be registered with the Data Protection Commission?
Yes, according to the DPC. The organisation notifies the DPC of the DPO’s contact details, and there is no fee.
Is the organisation still responsible for GDPR compliance if the DPO is external?
Yes. The controller or processor remains responsible. The DPO advises and monitors, but does not take over the organisation’s compliance obligations.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
