A named, statutory DPO — as a service.

The legal obligation

The GDPR requires a Data Protection Officer if (a) you’re a public authority or body (except courts acting in their judicial capacity), or (b) your core activities involve large-scale regular and systematic monitoring of data subjects, or (c) your core activities involve large-scale processing of special-category or criminal-conviction data (Art 37(1)) — unless an exemption applies. The tests are open and fact-specific; there is no fixed size threshold, so during onboarding we tell you plainly whether you need a DPO or not. Even when not required, a voluntary appointment (Art 37(4)) carries full statutory force and is a recognised way to demonstrate accountability.

How we solve it

The GDPR allows the DPO to be engaged through a service contract with an outside body (Art 37(6)). Your DPO at Zeno Kition is a named person (“person in charge”, WP29 Guidelines 243 §2.5), backed by our small senior team, with the full statutory scope:

• Inform and advise on GDPR and other data-protection law (Art 39(1)(a)).
• Monitor compliance, and give DPO advice on Data Protection Impact Assessments (Art 39(1)(b)–(c); Art 35).
• Cooperate with, and act as the contact point for, supervisory authorities (Art 39(1)(e); Art 58(1)(d)).
• Act as contact point for data subjects on all matters of processing (Art 38(4)).
• Report to our client’s senior management (Art 38(3)) — delivered as routine and quarterly accountability summaries.

All of it as a fixed monthly service with a documented procedure, a fair-use envelope instead of an hourly meter, and quarterly accountability summaries. Project work outside the envelope is quoted fixed, in advance.

Independence — the point of the role

The DPO’s value is its independence. The client cannot instruct the DPO on the substance of its duties (Art 38(3)); the DPO reports to the highest level of management, is bound by professional secrecy (Art 38(5)), and the role is kept clear of conflicting positions. Our engagement letter commits to this in writing.

Not your EU representative

The functions of EU representative and external DPO for the same controller are not compatible under EDPB Guidelines 3/2018. We deliver them as two strictly separate products — and never to the same client.

What you provide

• Your legal details and the management reporting line.
• Screening answers on core activities and processing (so we size the role honestly).
• The processing picture: systems, data flows, processors, destination countries.
• Any existing DPO or compliance post.
• Signature of the engagement contract naming your lead DPO.
• Publication and communication of the contact details to the supervisory authority (Art 37(7)).
• Staff, system, and resource access so the role can be performed (Art 38(2)).

Pricing

Pricing is sized to your processing during a short onboarding call — no published figures, no surprises. Contact us.