Outsourced DPO

The Data Protection Officer (DPO) is the role that Article 37 of the General Data Protection Regulation (GDPR, EU 2016/679) and Article 34 of Spain's Organic Law 3/2018 on Data Protection and Digital Rights Guarantee (LOPDGDD) set aside to oversee regulatory compliance, act as the point of contact with the Spanish Data Protection Agency (AEPD), and advise internally on any personal data processing. It is not a decorative title: the AEPD can require the DPO's direct involvement during an inspection, and failing to appoint one — when it is mandatory — is itself a sanctionable infringement.

An outsourced DPO carries out exactly the same functions as an in-house one, with two practical differences: cost (you pay for the service, not for a full salary plus ongoing training) and independence (Article 38(3) GDPR requires that the DPO receive no instructions on how to exercise their tasks and not be dismissed for performing them, which is easier to guarantee under a service contract than under an employment relationship). We act as a registered third party before the AEPD, with different working templates for each sector — we do not apply the same procedure to a parish as to a dental clinic or a state-subsidised school — because data categories, risks and sector-specific rules change in each case.

Article 37(1) GDPR requires a DPO to be appointed in three cases: when processing is carried out by a public authority or body (except courts acting in their judicial capacity); when the core activities of the controller or processor require regular and systematic monitoring of data subjects on a large scale; and when the core activities consist of large-scale processing of special categories of data (health, ideology, trade-union membership, sexual orientation, biometric or genetic data) or of personal data relating to criminal convictions and offences.

Article 34(1) of the LOPDGDD develops these cases for Spain and adds a list of entities obliged in any case, regardless of whether they meet the large-scale thresholds of Article 37(1): professional associations and their general councils, schools offering regulated-level education and public and private universities, operators of electronic communications networks and services processing data on a large scale, information society service providers that profile users on a large scale, credit institutions, financial credit establishments and insurers, investment services firms, electricity and gas distributors and retailers, entities managing shared creditworthiness and credit files, entities carrying out advertising and commercial prospecting based on data subjects' preferences or profiling, healthcare centres legally required to keep patient records, entities issuing commercial reports on individuals, online gambling operators, private security firms, and sports federations when they process minors' data.

Outside these mandatory cases, appointing an outsourced DPO still makes sense: it strengthens the data protection system with a role formally registered with the AEPD, provides a consultation and incident-management channel the organisation would otherwise lack, and gets ahead of what many large clients now require before signing a contract.

The rules do not require the DPO to be an employee: Article 37(6) GDPR expressly allows the role to be fulfilled on the basis of a service contract. The real difference lies in cost (an in-house DPO with the legal-technical training the role demands typically costs more than an outsourced service sized to the organisation's actual needs), in availability (an outsourced DPO works across several clients and keeps up to date with cases from different sectors, which rarely happens with an in-house profile that only sees its own organisation), and in the functional independence required by Article 38(3), which is easier to sustain in a contractual relationship than in a hierarchical employment one.

It is also common to combine both roles: someone on the team acts as the day-to-day internal point of contact — logging incidents, coordinating training, keeping the records of processing up to date — while the outsourced DPO takes on the formal responsibility before the AEPD, periodically reviews the system, and steps in whenever an incident or an inspection arises. If you already have an in-house DPO, an outsourced one complements them as a second opinion and as backup at the most demanding moments, without replacing them.

The penalty regime under Article 83 GDPR sets two tiers. Lower-tier infringements — including failing to appoint a DPO when required under Article 37, not providing the DPO with the necessary resources, or not publishing their contact details — can reach €10 million or 2% of total worldwide annual turnover from the previous financial year, whichever is higher. Upper-tier infringements — breach of the processing principles, absence of a legal basis, or systematic failure to honour data subjects' rights — can reach €20 million or 4% of worldwide turnover.

The LOPDGDD, in Articles 72 to 74, classifies infringements as very serious, serious and minor, with limitation periods of three, two and one year respectively. The AEPD treats an active supervisory function (precisely the one exercised by the DPO), corrective action taken before any formal request, and the degree of cooperation with the investigation as mitigating factors. In practice, having a DPO — in-house or outsourced — is not only a legal obligation in certain cases: it is also the documentary evidence of diligence the AEPD expects to find when it opens an investigation.

Summum has been supporting organisations with regulatory compliance since 2007, with more than 2,000 digitalisation projects delivered and close to 200 ISO certification processes supported across the group — the same team that can take you, when you need it, to ISO 27001 or ISO 27701 through Summum Calidad, without changing point of contact. We work from five offices in Valladolid (headquarters), Burgos, Palencia, Aranda de Duero and Las Palmas de Gran Canaria, which lets us offer a DPO you meet in person, not an account managed from another province.

We do not promise a specific outcome before the AEPD, nor do we replace its judgment: we support the organisation so it reaches any inspection or request with the documentation, procedures and track record the regulator expects to find.

We do not publish a fixed rate because the real cost of an outsourced DPO depends on variables that vary a great deal from one organisation to another: the number of personal data processing activities carried out, whether special categories of data are processed (health, minors, biometric data), the number of sites or centres, whether the organisation operates in a sector with extra regulation (healthcare, education, financial), the volume of people whose data is processed, and whether the service fully replaces an in-house DPO or complements one as a second opinion and backup.

We always confirm it on an initial, free call, once we understand the organisation's actual processing activities — not before, since any figure given without that diagnosis would be an unhelpful guess. If you want a market benchmark and to see which variables move the price the most, we have published a dedicated analysis on the blog: Outsourced DPO pricing: variables and an indicative range for 2026.