Français
NederlandsOutsourced DPO and CISO
Expert capability without a full-time hire. We act as your data protection officer or information security officer, or support your teams, drawing on more than 25 years of governance experience.
Who it is for
- Public authorities and bodies, which must appoint a DPO.
- Organisations whose activities involve regular and systematic monitoring of individuals, or large-scale processing of sensitive data.
- SMEs and organisations that need security leadership without hiring a full-time CISO.
- NIS2 entities, whose management body must approve and oversee cybersecurity measures.
- Organisations that develop or use artificial intelligence systems.
What we take on
Appointed or supporting DPO
We act as your data protection officer and contact point for the supervisory authority, or support your in-house DPO.
Day-to-day GDPR compliance
Records of processing, data protection impact assessments (DPIA), processor agreements and responses to data subject requests.
Data breaches
Assessment, documentation and, where required, notification to the authority within 72 hours, backed by digital forensics.
Part-time CISO
Roadmap, security policies, risk analysis, supplier oversight and reporting to management.
AI governance
AI management system based on ISO/IEC 42001 and preparation for the obligations of the AI Act.
Management training
Cyber risk awareness for the management body, as NIS2 requires, and for staff according to your actual risks.
How we work
A regular, predictable presence, a single point of contact and priorities approved by management.
Baseline
Interviews, review of existing documents and processing activities, identification of priorities.
Action plan
Dated roadmap, approved by management.
Implementation and follow-up
Presence agreed in advance, tracking of actions and answers to requests as they arise.
Annual review
Report to management: what was done, residual risks and next priorities.
Frequently asked questions
Does the GDPR allow an external DPO?
Yes. Article 37 of the GDPR allows the DPO to be a staff member or an external provider under a service contract. The DPO must have the required expertise and perform the role without any conflict of interest.
Can the DPO also be the CISO?
Yes, if combining the roles does not create a conflict of interest: the DPO cannot determine the purposes and means of the processing they oversee. This is assessed case by case, before any appointment.
How much time does the external DPO spend on our organisation?
The volume is set in the contract according to your size and processing activities, with arrangements for emergencies such as a data breach or a request from the authority.
What does ISO/IEC 42001 bring?
It is the international standard for artificial intelligence management systems. It structures the inventory of AI uses, the analysis of their risks and the controls to put in place, which also helps prepare for the requirements of the AI Act.