Business obligations, registers and licences · Czechia and Slovakia
Outsourced data protection officer (DPO)
If your activities require a data protection officer under GDPR, you do not need to employ one. An external specialist can perform the role. First, we properly assess whether you need one at all. If you do, we take on the role: monitoring processing, advising on new projects, acting as a contact for data subjects and the authority, and handling breach notifications. A lawyer doing the work, rather than a name entered on a form.
- Assessment of the requirement first
- A lawyer familiar with Slovak and Czech practice
- A monthly retainer agreed upfront
What we'll do for you
An ongoing service. Following the assessment and appointment, the role is performed under a monthly retainer, with the scope agreed according to the volume of processing.
Select an item to see the details.
-
Assessing the requirement
A written, reasoned assessment of whether your activities require a DPO under GDPR, suitable for use in a future inspection.
-
Taking on the role
Appointment, notification of contact details to the authority, publication of contact details for data subjects and an initial review of the processing activities.
-
Ongoing oversight
Monitoring compliance, advising on new projects and contracts, providing opinions on impact assessments and reporting regularly to management.
-
Data subjects and the authority
We act as the contact point, handling responses to data subject requests and communications with the data protection authority.
-
Incidents
In the event of a personal data breach, we lead the assessment, any notification to the authority within the statutory time limit and communications with affected individuals.
Deliverablean appointed data protection officer performing the role on an ongoing basis — oversight, advice, notifications and contact with the authority
How it works
Does this process fit your matter? Describe it to the attorney →
- Assessmentday 0
We establish whether you need a DPO and propose the scope of the role.
- Appointment
Appointment, notifications and an initial processing audit.
- Ongoing performanceongoing
Oversight, advice, requests and notifications — the role is performed while you run your business.
A data protection officer is a role, not an entry on a form. The authority and data subjects expect someone who answers the phone, understands the company’s processing and can give informed answers — and, in an incident, ensures notification within the statutory time limit.
Having an external lawyer perform the role combines expertise with independence: oversight by someone outside your internal relationships, bound by professional confidentiality and equipped with legal support for difficult situations.
No-obligation enquiry
Ready to start?
Send us an enquiry. We usually reply within 24 hours with a price confirmation and next steps. The first 30-minute consultation is free and commits you to nothing.
- 1Send your enquiry via this form
- 2Usually within 24 h you get a price confirmation and plan
- 3We start work only after your approval
Not keen on calls or email? Message us on WhatsApp →
Prefer to book a time right away? Book a consultation →
Or email us about this matter.
What clients ask
Didn’t find your question? Ask us directly →
When must I appoint a data protection officer?
GDPR requires a DPO particularly for public authorities, large-scale regular and systematic monitoring of individuals, and large-scale processing of special categories of data, such as health data. Most ordinary businesses are not required to appoint one, but the boundaries of 'large-scale' processing are not precise and depend on the specific activity. That is exactly what our written assessment addresses.
Can an external provider act as DPO?
Yes. GDPR expressly permits a DPO to perform the role under a service contract. What matters is expertise, sufficient resources, independence and actual accessibility to data subjects and the authority. Outsourcing is especially useful for companies that cannot justify a dedicated employee for the role.
Why can our IT manager or managing director not be the DPO?
A DPO must not have a conflict of interest and cannot oversee processing decisions they make themselves. A managing director, head of IT or head of HR is therefore generally unsuitable. An external appointment addresses the conflict by placing oversight with someone who does not decide the processes being monitored.
What exactly will you do as our DPO?
Continuously monitor processing compliance with GDPR, advise on new projects and contracts, provide opinions on impact assessments, receive data subject requests, communicate with the authority and lead the incident response process. We tailor the scope and frequency to the volume of your processing and agree them in advance within the retainer.
Do you then become liable for fines instead of us?
No. Responsibility for compliance always remains with the controller — you. A DPO provides oversight and advice, not insurance. It is therefore important that the role is performed by someone who identifies problems promptly and in writing. Our opinions also provide evidence that you acted with professional care.
Legal Q&A
Common questions on this topic
-
What must we do to make shop and workplace CCTV lawful?
CCTV is lawful when its legal basis is documented in advance, generally legitimate interests under Article 6(1)(f) GDPR, and everyone entering the monitored area receives the required information. A balancing test comparing your interests with the privacy intrusion must exist before cameras start operating. At work, Section 13(4) of the Labour Code additionally requires prior consultation with employee representatives on the monitoring mechanism and notification to employees.
Read the answer -
How does the authority calculate a fine for a GDPR breach?
The EDPB methodology in Guidelines 04/2022 uses five steps: identify the processing operations, set a starting amount based on the infringement category, severity and the undertaking's turnover, adjust for aggravating and mitigating factors, check the statutory ceiling, and assess effectiveness and proportionality. Ceilings are EUR 10 or 20 million, or 2% or 4% of worldwide turnover for undertakings. Turnover means the whole group, rather than only the company at fault. Arguments can address severity, remediation and enhanced cooperation; mandatory notification itself is neutral. Inability to pay is considered only exceptionally.
Read the answer -
Can a group of companies have a single shared data protection officer (DPO)?
Yes. Article 37(2) GDPR allows a group of undertakings to appoint a single data protection officer provided they are easily accessible from each establishment. According to the guidelines of the European supervisory authorities, accessibility also means being able to communicate with data subjects and supervisory authorities in their language, which for a Slovak-Czech group means dealing with two authorities. Each company nevertheless remains a separate controller: it publishes the officer's contact details itself, notifies them to its own authority and must provide the conditions for the role to be performed.
Read the answer
Further reading
Two responsible persons: the DPO under the GDPR and the responsible person for whistleblowing
Slovak law knows two functions bearing the same name: the responsible person under the GDPR and the responsible person under the Whistleblower Protection Act. This article compares their tasks, independence and requirements, and explains when the same individual or external provider may perform both. For companies that must have one or both functions.
Read more →
A personal data breach: what to do in the first 72 hours and the data protection officer’s role
A stolen laptop, an email attachment sent to the wrong recipient, or encrypted servers. The GDPR generally gives the controller 72 hours to notify the authority of a breach and, where the risk is high, requires the individuals to be informed as well. This article explains the procedure step by step and the data protection officer’s role.
Read more →
When an AI user becomes its provider: roles under the AI Act
The AI Act allocates obligations by role, not by who wrote the code. A company that has a chatbot built on someone else's model, sells an AI product under its own brand or uses a general-purpose tool for a sensitive purpose may become a provider with all the attendant obligations. This article explains where the line runs and what follows from it for supplier contracts.
Read more →