DPO as a service: when you must appoint a data protection officer, and when you may
7 min read · Updated 2026-11-12
A data protection officer (DPO) is a defined role under GDPR Articles 37 to 39. In Dutch, the title is functionaris voor gegevensbescherming (FG). Many startups do not have a legal duty to appoint one. Some still choose to. This guide explains the difference and what 'DPO as a service' should mean in practice.
When appointment is mandatory
You must appoint a DPO when you are a public authority or body (with limited exceptions), when your core activities require regular and systematic monitoring of data subjects on a large scale, or when your core activities consist of large-scale processing of special categories of data or criminal data (Article 37). 'Core activities' means what is essential to your business, not a one-off use of a payroll tool.
A typical early-stage SaaS company that stores customer accounts and billing data, without large-scale profiling or special-category data at the centre of the product, often falls outside the mandatory cases. You still have to check the facts. If the product is built around health data, children's data used at scale, or systematic monitoring of behaviour, the duty may apply.
What the role requires
The DPO must have expert knowledge of data protection law and practice, and the ability to fulfil the tasks in Article 39: inform and advise, monitor compliance, advise on data protection impact assessments, and cooperate with the supervisory authority as a contact point. The DPO may be a staff member or fulfil the tasks under a service contract (Article 37(6)).
Independence matters. Article 38(3) says the DPO shall not receive instructions regarding the exercise of those tasks, and shall not be dismissed or penalised for doing the job. A 'DPO as a service' offer that only produces automated reports, or that sits under sales instructions, does not meet that standard. A named person, a clear service schedule, and a path to the AP are the minimum you should expect.
Voluntary appointment
You may appoint a DPO even when the law does not require it. If you do, the same articles apply: independence, resources, and the tasks in Article 39. In the Netherlands, the AP expects you to mean it. Do not give someone the title if they cannot perform the role.
On DPOne, the DPO Service designates Mahdi Barkabian Zanjani as named external DPO under a defined schedule, with independent review of critical findings. That is a contracted service, not a certification that your company is compliant.
Frequently asked questions
Can one person be DPO for several companies?
Yes, a DPO may act for a group of undertakings, or serve several organisations under a service contract, provided they remain easily accessible and can perform the tasks independently for each controller.
Is a privacy lawyer automatically a DPO?
No. A lawyer can advise you without being appointed as DPO. The DPO title is specific. Use it only when the person is appointed and can meet Articles 37 to 39.