A GDPR consultant helps you meet the General Data Protection Regulation in practice. The title has no legal definition, so what you get depends on who you hire. Engage Compliance gives you a privacy specialist on demand through Privacy Advisory and, when your situation calls for the formal role, the same team can act as your named DPO.
Key takeaways
- A GDPR consultant advises and does operational privacy work. The role has no formal status under the GDPR, unlike a DPO, which Articles 37 to 39 define.
- If Article 37 applies to your company you must designate a DPO, and a consultant who has not accepted that role does not meet the requirement.
- Privacy Advisory starts From €600 per month. DPO Foundation, with a named DPO, starts From €1,000 per month.
- A company outside the EU that sells to people in the EU often needs an EU representative under Article 27 as well.
What does a GDPR consultant do?
The work depends on where you are starting from. For most tech companies it looks like this:
- A gap assessment against the GDPR, so you know what is missing before a customer or regulator asks.
- Privacy notices, cookie and consent wording, and internal policies that match what your product really does.
- A record of processing activities (Article 30), built with the people who run the systems.
- Review of processor contracts and data processing agreements (Article 28), including the ones enterprise customers send you.
- A process for access, deletion and other data subject requests, with templates and a log.
- Data protection impact assessments (Article 35) for higher-risk features, and transfer assessments for data that leaves the EU or UK.
- Answers to the privacy sections of customer security questionnaires, which is where many deals slow down.
None of this needs a formal appointment. It needs someone who has done it many times and can tell you which gaps matter to your buyers.
GDPR consultant or DPO: which do you need?
Article 37 says you must designate a data protection officer where:
- the processing is carried out by a public authority or body, except courts acting in their judicial capacity;
- your core activities require regular and systematic monitoring of people on a large scale; or
- your core activities are large-scale processing of special category data or criminal conviction data.
Some member states add their own triggers. If none applies to you, a DPO is optional, and a consultant is often enough at the start. Many companies add a named DPO anyway once enterprise customers ask for one or the privacy workload becomes steady.
A DPO also has a protected position. Under Article 38(3) the DPO receives no instructions about how to carry out the tasks and reports to the highest management level, and under Article 37(7) the company publishes the DPO’s contact details and communicates them to the supervisory authority. A consultant has none of that, which is why the two roles are not interchangeable. Our comparison of a DPO, a privacy consultant and privacy counsel goes through the difference in detail, and Do I need a DPO? helps you check whether Article 37 applies to you.
If you want the formal role, see our outsourced DPO services. The two fit together: many clients start with advice and move to a named DPO later, with the same people.
GDPR consultant or lawyer?
A lawyer’s advice is typically protected by attorney-client privilege, and a consultant’s is not. So a regulator investigation, a dispute or a contract negotiation that needs privilege belongs with your counsel. The ongoing program work usually costs less with a specialist consultant, and we coordinate with your counsel when a matter needs legal advice.
How much does a GDPR consultant cost?
Our prices start here:
- Privacy Advisory: From €600 per month. Lighter-touch privacy advisory for earlier-stage companies: policy reviews, ad-hoc guidance, consent advice and documentation support on demand, with one hour of support a month.
- DPO Foundation: From €1,000 per month. A named DPO for teams that run privacy day to day themselves: you lead, and we guide, review and help.
The full ladder, including the higher tiers, is on the pricing page. A one-off gap assessment is available through our GDPR audit services.
Selling into the EU from outside it
A US company with EU customers usually needs more than a clean privacy notice. Where the GDPR applies to you under Article 3(2), Article 27 requires you to designate a representative in the EU in writing, unless your processing is occasional, low risk and does not involve large-scale special category data, or you are a public authority. Our EU representative service covers that appointment, and we scope it together with the consultant or DPO work so you deal with one team.
How an engagement works
- A call to understand your product, your data and what a customer or regulator has asked for.
- A gap assessment with a short, ranked list of fixes.
- The work itself: documents, processes and contracts, done with your team.
- Ongoing support as the product changes, on the Privacy Advisory hour or a DPO plan.
Experience across 100+ startups and enterprises, including Amazon, Coinbase, Robinhood, Fanatics, Medtronic, AbbVie, IKEA, Nestle and Hopin. If you are weighing a consultant against a DPO for your own company, start with a free intro call and we will tell you which fits, including when the answer is neither yet.
Sources and references
This page is general information, not legal advice.