data protection officer
Fidem provides an outsourced Data Protection Officer (DPO) service for public bodies and private companies. Our certified legal and IT consultants ensure independent oversight and full GDPR compliance for clients in Italy and the EU.
Fidem works with legal-tech professionals able to provide specialized, targeted advice to ensure data protection and compliance with the regulations in force.
What the Data Protection Officer (DPO) Is.
The DPO is an expert in charge of ensuring the protection of personal data within an organization. Their main responsibility is to monitor data processing and make sure data is handled securely and in compliance with data protection rules, while also providing ongoing advice.
Why a DPO Is Needed.
The DPO is essential to ensure that an organization complies with data protection rules. Their advice helps reduce legal risks and fines, making sure personal data is processed correctly and protecting the organization from potential breaches.
Benefits of Having a DPO.
The DPO improves the organization’s compliance, reduces legal risks and protects the company’s reputation. The DPO’s advice also helps in handling data breaches and in optimizing cybersecurity measures, ensuring effective protection of sensitive information.
What do we detect?
- Potential breaches that could compromise the protection of company information.
- Non-compliance with personal data protection requirements and security regulations.
- Risks related to the protection of individuals' rights and to data management and security.
How does it work?
- The DPO oversees data protection policies, making sure they comply with the regulations.
- Provides advice on the management of personal data and helps assess risks.
- Trains employees on data protection best practices and regulations.
- Cooperates with the competent authorities, handling communications and requests.
The DPO as a Service
The Data Protection Officer is the role set out in Articles 37-39 of the GDPR: a data protection officer who monitors compliance, acts as the contact point with the supervisory authority and with data subjects, and supports the controller in decisions concerning personal data.
Fidem provides the service as DPO as a Service: the role is entrusted to an external organization instead of an internal resource. For most organizations it is the most solid choice, because the DPO must be able to act independently and without conflicts of interest, a condition that is hard to guarantee when the appointment falls on someone who already manages the systems or processes they should be overseeing.
We work with private companies and public bodies in Italy and across the EU.
The Fidem DPO's Expertise
The service combines legal expertise in data protection with technical cybersecurity expertise. It is a less common combination than it seems: the GDPR asks the DPO to assess technical and organizational measures, and a purely legal assessment cannot say whether a system is really protected.
Our team brings together legal-tech professionals and cybersecurity specialists. When an impact assessment involves encryption, access segregation or log retention, the answer comes from people who design and run those measures every day.
Operational Activities
The DPO service includes the activities set out in Art. 39 and those that, in practice, are needed to withstand an inspection:
Periodic audits of processing activities: review of the record, legal bases, retention periods and relationships with external processors.
Data Protection Impact Assessments (DPIA): for high-risk processing, with analysis of the supporting technical measures.
Contact point: with the supervisory authority and with data subjects exercising their rights.
Staff training: because most breaches start from a behavior, not from a system.
Contract support: appointment of processors, joint controllership agreements, clauses for transfers outside the EU.
Data Breach Management
In the event of a personal data breach the available time is short: notification to the supervisory authority must be made within 72 hours of the controller becoming aware of it, and when the breach involves a high risk the data subjects must also be informed.
The Fidem DPO activates the handling protocol: qualification of the event, assessment of the risk to people’s rights and freedoms, drafting of the notification, entry in the breach register and guidance on containment measures.
This is where integration with operational security makes a concrete difference: reconstructing what happened, which data was affected and when, requires access to logs and forensic analysis skills, not just an opinion.
Integration with Cybersecurity
The advantage of entrusting the role to Fidem is that compliance does not stay separate from real defense. The DPO works alongside the services that protect the infrastructure: vulnerability assessment, managed SOC and threat detection, email security, digital forensics in case of an incident.
The technical measures required by Art. 32 therefore do not remain a statement in a document: they are active services, verifiable and documentable before a supervisory authority.
When Appointing a DPO Is Mandatory
The appointment is mandatory in three cases set out in Art. 37 GDPR: when the processing is carried out by a public authority or body; when the core activities of the controller or processor require regular and systematic monitoring of data subjects on a large scale; when the core activities consist of large-scale processing of special categories of data (health, biometric, criminal records).
Outside these cases the appointment is optional, but it often becomes a practical choice when the organization takes part in public tenders, answers questionnaires from enterprise customers or handles health data even in small volumes.
If it is not clear which case applies to your organization, the check is short and should be done before the appointment, not after.
External or Internal DPO: How to Choose
The GDPR allows both. The difference lies in three requirements the regulation sets for the role, which weigh differently in the two cases.
No conflict of interest. The DPO cannot oversee processes they are responsible for. Appointing the IT manager, the administrative director or the owner is the most frequent reason for objections: supervisory authorities have intervened several times on appointments of this kind.
Specialist expertise. The role requires knowledge of the law and of practice, kept up to date over time. An internal resource doing the job part-time rarely manages to maintain it.
Independence and resources. The DPO must be able to report to top management and must not be penalized for performing their tasks. An external organization is, by design, harder to influence.
An external DPO solves all three points at once and, in most cases, at a lower cost than a dedicated internal role.
How We Start
Checking the obligation and the scope. We establish whether the appointment is required, for which processing activities and to what extent. It is the step that prevents everything else from being sized wrongly.
Assessment of the current state. Record of processing activities, privacy notices, processor appointments, technical measures in place. This produces the list of real gaps, in order of risk.
Appointment and kick-off. Formal designation, communication of contact details to the supervisory authority, publication of the contacts, first-year activity plan.
If you are already working on NIS2 compliance, it pays to handle the two areas together: the required technical measures largely overlap, and dealing with them twice costs double without adding security.
For advice on whether you need to appoint a DPO, contact us.
Compliance and guarantees: ISO 27001, 27017, 27018 and 9001 certifications · risk management · managed backup
How much does an external DPO cost?
The cost of an external DPO depends on how much processing there is to oversee, not on the number of employees. A company with few staff but health data or profiling needs more work than a large organization with ordinary processing.
- Nature of the data: special categories (health, biometric, criminal records) increase the workload.
- Number of processing activities and suppliers: every external processor has to be assessed and regulated by contract.
- Interaction with the authority: a reply to the supervisory authority or a data breach is a separate activity.
- Training: whether included and how often.
- Presence: remote only or also on site.
The service is normally an annual fee: the DPO is an ongoing role, not a project that ends.
External or internal DPO: what really changes
The decisive difference is the conflict of interest. The DPO cannot oversee decisions they took themselves: whoever runs information systems, HR or marketing can hardly monitor the processing they govern. It is the most frequent reason an internal appointment is challenged.
An external DPO brings structural independence and experience gathered elsewhere; an internal one knows the processes better and is there every day. The criterion is whether a position genuinely free of conflict, with time to dedicate to the role, exists within the organization.
What happens if no DPO is appointed when it is mandatory
Failing to appoint is a separate infringement, regardless of whether the data was then handled well. In practice it emerges at the worst moment: during the investigation following a complaint or a data breach, when the authority asks who the data protection officer is and there is no answer.
The second consequence is practical: without a DPO, the deadlines for replying to data subjects and to the authority fall on people who have never handled them, and are missed through inexperience.
What the DPO does NOT do
The DPO does not decide the purposes and means of processing: that responsibility stays with the controller and cannot be delegated. The DPO does not write the documents in place of the company, is not liable in case of a breach, and does not replace the technical measures, which remain the work of compliance and technical verification.
What a DPO is, in plain words
The DPO is the person who checks whether the company processes personal data as the law requires: they inform, monitor and act as the contact point with the supervisory authority. They are not a consultant who delivers a document and disappears, nor are they responsible for what the company decides: it is an ongoing role with a monitoring task.
What a DPO actually does
They keep the record of processing activities under control, check that privacy notices and legal bases hold up, review contracts with suppliers that touch the data, assess incidents and decide whether they must be notified, answer requests from data subjects and handle relations with the authority. When something is wrong, they put it in writing: it is the part of the job that makes the role both useful and uncomfortable.
Internal or external?
The criterion is not cost, it is the conflict of interest: the DPO cannot monitor decisions they took themselves. Whoever runs information systems, HR or marketing can hardly hold the role, and it is the most frequent reason an internal appointment is challenged. An external DPO brings independence and experience; an internal one knows the processes and is there every day.
Terms and references in the cybersecurity glossary.
Where we provide the DPO role
The external DPO works continuously and almost always remotely, with regular meetings. We serve organizations and companies across Italy and the EU; in North-East Italy kick-off meetings and periodic reviews can take place on site.
Definitions: DPO · data breach in the cybersecurity glossary.