Can't find your question? Ask us directly, or see the full resources library.
Outsourced DPO services
A named Data Protection Officer provided by Engage and notified to the supervisory authority.
Do I need a DPO?
Not all companies formally need one. You need a DPO if your core activities involve large-scale processing of personal data or systematic monitoring of individuals. But even if you don't technically need one, most companies we work with appoint a DPO because enterprise customers, investors, and regulators expect it. It comes up in almost every funding round and big deal.
From Outsourced DPO services: a dedicated Data Protection Officer embedded in your team
How much does a DPO cost?
Depends on your company size, data complexity, and how many regulations you need to cover. We offer four tiers: Privacy Advisory (From €600 per month), DPO Foundation (From €1,000 per month), DPO Partner (From €2,500 per month), and DPO Complete (From €4,500 per month), plus custom Enterprise scoping. Every engagement is tailored to only what you actually need.
From Outsourced DPO services: a dedicated Data Protection Officer embedded in your team
How quickly can you start?
Engagements start within one day. Month one is a focused privacy audit, building your core documentation, aligning priorities, and being notified to the supervisory authority as your DPO. From month two your DPO is fully embedded and handling ongoing compliance, enterprise questionnaires, and anything privacy-related.
From Outsourced DPO services: a dedicated Data Protection Officer embedded in your team
What regulations do you cover?
- EU GDPR, UK GDPR.
- US state and federal privacy laws (CCPA/CPRA, HIPAA, GLBA, and others).
- Brazil LGPD, Canada PIPEDA.
- Thailand PDPA, China PIPL, India DPDPA, Japan APPI, South Korea PIPA.
- UAE and Saudi Arabia data protection laws, the EU AI Act, NIS2, DORA.
- Frameworks like ISO 27001, ISO 27701, SOC 2, and NIST.
From Outsourced DPO services: a dedicated Data Protection Officer embedded in your team
Is DPaaS the same as an outsourced or fractional DPO?
Yes. DPaaS, outsourced DPO, external DPO, virtual DPO, and fractional DPO all describe the same role: a qualified Data Protection Officer provided by an external firm rather than employed in-house. The legal standing under GDPR Article 37(6) is identical regardless of which term you use.
Who can be a data protection officer?
The DPO can be an employee or an external service provider (GDPR Article 37(6)). They must have expert knowledge of data protection law and practice, act independently, report to the highest level of management, and be free of conflicts of interest, so the role cannot sit with someone who also decides the purposes and means of processing, such as a CTO or head of marketing. An external DPaaS provider satisfies these conditions by design, which is why the independence requirement is easier to meet from outside the business.
Is vendor due diligence included in your DPO plans?
Yes. Vendor management is part of DPO Foundation, From €1,000 per month. Transfer impact assessments are charged at client rates on Privacy Advisory and DPO Foundation and are included in scope on DPO Partner and DPO Complete. See pricing for the full list.
From Vendor due diligence
What does the training cost?
Privacy training is €750 per session at client rates on Privacy Advisory and DPO Foundation, and it is included in scope on DPO Partner and DPO Complete. See pricing for the plans.
EU, UK and other representative services
A representative for companies with no establishment where the law asks for one, starting with GDPR Article 27.
Do I need an EU Representative?
If your company is based outside the EU and offers goods or services to individuals in the EU or monitors their behavior, you likely need one under GDPR Article 27. There are limited exceptions for occasional, low-risk processing.
Which member state does the appointment have to be in?
One of the ones where your data subjects are, under Article 27(3), and one of them rather than each of them. Our appointment is made from the Netherlands, which satisfies that for any company with users in the Netherlands, and a company selling across the Union almost always has them. You do not need a separate representative per country and there is nothing to choose here.
Does appointing an EU Representative give my company an establishment in the EU?
No. Article 27 only applies where you have no establishment in the Union in the first place, and the appointment is a written mandate for us to be addressed by authorities and data subjects, not a presence of yours. Our Amsterdam establishment is ours. The Digital Services Act says the same thing in terms for its own representative at Article 13(5): the designation of a legal representative within the Union shall not constitute an establishment in the Union. Appointing us is not a tax, corporate or regulatory footprint for you, and if you are watching your establishment position for another reason this does not move it.
How quickly can you set this up?
Seconds, once you have answered the short form. You pay, you answer five questions about your company and who we should send correspondence to, and the appointment document, the certificate, your public verification link and the exact wording to publish all issue automatically at that moment. Nobody at Engage has to approve anything.
Does a UK company need an EU representative after Brexit?
Yes, where it targets or monitors people in the EU and has no EU establishment. The UK is a third country for GDPR purposes, so a UK company selling into the EU is in exactly the position Article 27 was written for. The mirror also holds: an EU company targeting the UK needs a UK representative under UK GDPR Article 27.
What is the penalty for not appointing one?
Failure to appoint falls under Article 83(4), the lower tier, capped at €10 million or 2 percent of worldwide annual turnover, whichever is higher. In practice the bigger exposure is that the omission surfaces during an unrelated investigation or a data subject complaint, and it tells the authority that the basics were not covered.
Do I need a data protection representative outside the EU and UK?
It depends on the country. China's PIPL requires a dedicated body or a representative inside the PRC for handlers caught by its extraterritorial rule, Korea's PIPA requires a domestic agent above certain thresholds, and Turkey requires a Turkish representative for foreign controllers with a VERBIS filing duty. Thailand's own statute requires a representative in the Kingdom for controllers and processors caught by its extraterritorial rule. Brazil and Nigeria do not require a foreign company to appoint a representative at all. Engage Compliance maps which of these apply to you and arranges the ones that do.
DPO and representative together
How the two roles differ, and when you need both.
Is an EU representative the same as a DPO?
No. The Article 27 representative is a contact point in the Union for a company established outside it, so that supervisory authorities and data subjects have someone to address. The Article 37 DPO monitors the organization's compliance with GDPR and advises on it, wherever the organization is established. The tests are different, the duties are different, and the two are frequently needed at the same time.
Can our DPO also be our EU representative?
The two are separate products, and we can provide both where you need them. Each does a different job: the representative is the company's point of contact for regulators, while the DPO independently monitors compliance and reports to your highest management.
Can a company need both?
Yes, and it is a common combination: a US SaaS company with no EU entity, running product analytics on EU users at scale. Article 27 applies because there is no establishment and the company targets and monitors people in the EU. Article 37 applies because large-scale regular and systematic monitoring is a core activity.