A data protection officer needed, or the DPO just left.
The GDPR requires organisations that monitor people on a large scale or process special categories of personal data to appoint a data protection officer, and that officer may be external. Whether the DPO is leaving, the Dutch Data Protection Authority is asking questions, or a customer wants to know who your privacy officer is: you'll have an experienced DPO or privacy officer interviewed within two days. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
Sometimes it's a letter from the Dutch Data Protection Authority asking who your DPO is. More often it's a customer asking in its data processing agreement for a privacy contact, a data breach where it turns out nobody knows exactly who decides on reporting, or simply the DPO who has found another job while the record of processing activities and the DPIAs just carry on. In all those cases the question is the same: there needs to be someone quickly who can carry the role, preferably someone who has done it before.
Are you required to appoint a DPO?
Article 37 of the GDPR names three cases: public authorities, organisations whose core activity consists of large-scale, regular and systematic monitoring of people, and organisations whose core activity consists of large-scale processing of special categories of personal data or criminal data. Think of insurers, occupational health services, platforms that track behaviour and organisations working with health or biometric data. The officer may be an employee or someone external, must be able to work independently and is registered with the Data Protection Authority. Whether you fall under it is a legal question; we're not lawyers, and the text of article 37 and the Authority's guidance are the source for that. Those who aren't required often choose a privacy officer anyway because customers and the regulator ask for one.
What needs to happen now
- Getting the role assigned. Appoint a DPO, register them with the Authority and announce it internally, so there's a point of contact before the next data breach. The first week.
- The record and the DPIAs. The record of processing activities up to date, the high-risk processing assessed, the data processing agreements in order. Work for the DPO or a privacy officer, with the process owners.
- Data breaches and data subject requests. A working process for reporting within 72 hours and for access and erasure requests. Privacy officer, together with security and the service desk.
- Advising the board and the line. A DPO advises and monitors; the organisation remains responsible itself. That requires someone who understands the difference between those two roles and dares to name it.
- Handover if it's temporary. An external DPO who later makes way for an employee leaves behind a working system, not a folder of loose documents.
Who leads this
Organisations here look for a data protection officer who carries the statutory role, a privacy officer for execution, or privacy counsel when it's mainly about contracts and transfers. An external DPO on an interim basis is common, especially for organisations that can't fill the role full-time. Which of those roles it is for you depends on what's already in place; that's where the intake starts. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: why now, what's already in place, how big the work is, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. For a part-time DPO, which it often is, our margin per hour may be higher; you see that up front too. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
An external DPO is a role the GDPR itself recognises as a service, and a DPO by definition works independently and without instructions on the content of the work. That fits well with a freelance construction with a model agreement, especially when the role is part-time and for a defined period. If the question is in fact a full-time privacy officer who works in the line and stays, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
Can a data protection officer be external?
Yes. The GDPR explicitly allows the DPO to be an employee or someone external on the basis of a service contract. The DPO must be able to work independently, report directly to the highest management and is registered with the Dutch Data Protection Authority. An external DPO on an interim basis is therefore common, especially when the role isn't full-time work.
How fast can you provide someone?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about why the DPO is needed and what's already in place, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Are we required to appoint a DPO?
That's a legal question and we're not lawyers. Article 37 GDPR names three cases: public authorities, large-scale regular and systematic monitoring of people as a core activity, and large-scale processing of special categories or criminal data as a core activity. The Data Protection Authority's guidance is the source. Those in doubt or not required often choose a privacy officer anyway because customers ask for one.
Freelance, secondment or permanent: what suits a DPO?
A DPO by definition works independently and without instructions on the content of the work, and the role is often part-time and for a defined period. That fits well with a freelancer with a model agreement. If the question is actually a full-time privacy officer who works in the line and stays, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim DPO or privacy officer cost?
That depends on the person and the scope, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment; for a part-time role, which a DPO often is, the margin per hour may be higher. You see that up front, just like the rate.
Our DPO has left. How quickly does the role need to be filled again?
The obligation to have a DPO simply continues, and in the event of a data breach a decision on reporting has to be made within 72 hours. Practically speaking you want a point of contact within days, even if temporary. An external DPO who takes over the role until the successor is there is exactly what interim is for.
Can the DPO also be the security officer?
Preferably not. A DPO monitors the organisation, and whoever sets up the security themselves then monitors their own work; the GDPR requires that the DPO has no conflict of interest. Many organisations therefore combine an external DPO with their own security officer. If you need both, we can take that on in one move.
Do you also work for organisations outside the security sector?
Yes, privacy and information security are our field, the customer's sector isn't. Insurers, occupational health services, platforms, processors and manufacturing companies all need DPOs and privacy officers. We only don't actively approach public and semi-public organisations, education and healthcare providers; if they come to us themselves, we discuss whether we can help.
Call today, a DPO at the table this week?
Tell us why the DPO is needed and from when. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.