Outsourced DPO: your data protection officer is a lawyer.
They know your contracts, they are bound by professional secrecy, and they cannot be both judge and party.
Appointing a DPO means entrusting them with oversight
The data protection officer monitors your compliance over time. Four questions determine how robust this oversight is, whoever you appoint.
Conflict of interest
They cannot be both judge and party. The person who monitors your compliance cannot be the one who sold, configured or deployed what they must monitor.
Independence
They receive no instructions regarding the exercise of their tasks, in accordance with Article 38.3 of the GDPR.
Liability
They are covered by professional indemnity insurance and supervised by their Bar.
Dismissal
Article 38.3 of the GDPR protects the DPO against any dismissal linked to the performance of their tasks. That is why your exit option is written into the agreement.
Three ways to appoint a DPO
Your DPO is a lawyer. They are bound by professional secrecy, covered by professional indemnity insurance and supervised by their Bar. They receive no instructions regarding the exercise of their tasks, in accordance with Article 38.3 of the GDPR. They are bound by professional secrecy and cannot disclose what they learn from you, except where the law requires it.
In return, we cannot represent you in proceedings that call into question your liability as a data controller. That is why litigation and sanction proceedings remain outside the fixed fee. This limit is not commercial, it is ethical, and it is this limit that keeps the oversight of your compliance independent from the defence of your interests in the event of a dispute.
| Criterion | GDPR tool or platform | Consultancy firm | Law firm |
|---|---|---|---|
| Who performs the role | A software subscription, with no designated person | A consultant; who the person is depends on the contract | An identified lead lawyer, with a deputy |
| Confidentiality of what they learn within your organisation | A clause in its general terms and conditions | The DPO’s duty of confidentiality, Article 38.5 of the GDPR | The lawyer’s professional secrecy, backed by criminal penalties, Article 226-13 of the French Criminal Code (Code pénal) |
| Independence in performing the role, Article 38.3 of the GDPR | Not applicable: no DPO is designated | Yes, by law | Yes, by law |
| Professional indemnity insurance | Depending on its general terms and conditions | Depending on the contract | Mandatory for every lawyer |
| Supervision by a professional body | None | None | Yes, the Bar (Ordre des avocats) |
| Legal review of your contracts | No | Depending on the scope of the engagement | Yes: the firm drafts and reviews them |
| Representation in litigation or sanction proceedings | No | Depending on the contract: before the CNIL’s restricted committee, the organisation may be assisted or represented by any counsel of its choice | No, by ethical choice: oversight remains independent from your defence |
Professional secrecy protects the relationship between the lawyer and their client. It does not extend to the record of processing activities or to impact assessments, which are documents you must keep and provide to the CNIL.
The first two columns refer to ways of practising, not to specific providers. A cell shows what follows from the status itself, or “depending on the contract” where it depends on the provider. The third column describes the status of a lawyer and the firm’s written commitments. These columns describe common market practice; each provider may depart from it, and that is the question to ask them.
A lead lawyer, designated with the CNIL
The designation
Hashtag Avocats is designated as data protection officer with the CNIL. A lead lawyer is identified by name, with a designated deputy, and you know at all times who is handling your file.
Availability
We are available on working days, with a quarterly steering meeting and availability between meetings for your day-to-day questions.
What the outsourced DPO engagement includes
Our role is to ensure the continuity of your compliance, its monitoring over time and the momentum within your teams.
What we do
- Designation with the CNIL
- Taking over your existing documentation
- Steering your compliance programme
- Monitoring your record of processing activities and your documentation
- Monitoring your action plans and remediation projects
- A quarterly meeting with your teams
- Day-to-day support on their questions
- First-line assistance in the event of a personal data breach
- Monitoring of developments that affect your processing
- An annual review setting priorities for the following year
A distinction to understand before signing
The record of processing activities remains your obligation, under Article 30 of the GDPR. We monitor and update it, but we do not take your place.
See also
GDPR compliance, personal data breach, corporate cyber risk.
What is not included, in writing before signing
Each of these services is subject to a quote that you approve before any work begins.
- A full audit or rebuild of your compliance programme
- Projects linked to the launch of a new business activity or a new product
- Mapping of new and complex processing operations
- Technical audits and penetration tests
- Large-scale renegotiation of your contracts
- Handling a major personal data breach
- Assistance with a CNIL inspection or sanction proceedings
- Data protection litigation
- Legal services unrelated to the DPO role
Your name stays confidential, even after the engagement ends
A DPO engagement gives access to your processing operations, your contracts and your incidents. The law imposes secrecy on every lawyer. We make it an in-house rule that goes further.
What we do not publish
No logo, no client name, no testimonial, no cited reference, either during the engagement or afterwards. The mere fact of being our client is covered by professional secrecy.
What we can tell you
In a meeting, we describe situations comparable to yours, by sector and company size.
Why this matters for a DPO
A DPO learns of your data breaches before anyone else. What they learn in the course of your relationship with the firm is covered by professional secrecy.
An outsourced DPO from €1,000 excl. VAT per month, on a scope agreed with you
The exact scope is set after a scoping discussion, based on an annual allocation of days agreed with you, according to your size, the volume of your processing and the state of your compliance.
Commitment
The commitment is annual and renewable, with notice, and you can terminate it at any time without giving a reason.
It can be added to your subscription, on the basis of a quote.
The tool
We manage your compliance using a dedicated platform, invoiced directly by its publisher. We receive no remuneration in this respect and you remain free to use another tool.
Outside the fixed fee
Nine services are outside the fixed fee. Each is subject to a quote that you approve before any work begins.
Four steps
Scoping discussion
We review your size, the volume of your processing and the state of your compliance. The annual allocation of days is set at the end of this discussion.
Checking that we can act for you
A lawyer cannot act against an existing client. We check this before any discussion of your file.
Agreement and designation with the CNIL
A written fee agreement is signed. The lead lawyer and their deputy are identified by name in it, and the designation is then notified to the CNIL.
Taking over the documentation and first meeting
We take over your existing documentation, then set priorities with your teams.
What you prepare
- Your existing compliance documentation, even if incomplete
- The list of your tools and your main processors
- Projects planned in the next twelve months
- The name of your internal contact
Outsourced DPO, external DPO: your questions
What is an outsourced DPO?
An outsourced DPO, or external DPO, is a data protection officer who performs their tasks on the basis of a service contract, as permitted by Article 37.6 of the GDPR. They have the same tasks and the same safeguards as an employed DPO. At Hashtag Avocats, the role is held by a lead lawyer identified by name, with a deputy.
Is it mandatory to appoint a DPO in France?
Article 37.1 of the GDPR requires public authorities and bodies to appoint a DPO. It also requires it of organisations whose core activities call for regular and systematic monitoring of individuals on a large scale, or consist of large-scale processing of sensitive data or data relating to criminal convictions and offences. In other cases, the CNIL encourages designation. See when a DPO is mandatory.
Internal or external DPO: which should you choose?
The GDPR leaves the choice open: the DPO may be a staff member or a service provider, and may be shared. According to the CNIL, an external DPO addresses a lack of internal resources and brings experience of similar organisations; it requires regular meetings with management and the teams. See our comparison of internal, external and shared DPOs.
What is a shared DPO?
It is a DPO designated for several organisations. A group of undertakings may appoint a single DPO provided that they are easily accessible from each establishment (Article 37.2 of the GDPR). Several public authorities or bodies may also share a DPO (Article 37.3). Each entity designates them with the CNIL.
How much does an external DPO cost?
No legislation sets this price: it depends on the time required, the volume and sensitivity of the processing, and the state of your compliance. Our engagement starts at €1,000 excl. VAT per month, on a scope agreed with you. It can be added to your legal subscription, on the basis of a quote. See what drives the cost of an external DPO.
How is a DPO designated with the CNIL?
It is done online only, through the CNIL’s online service. The effective date is chosen in the form: it cannot be earlier than the request. Where the DPO is a legal entity, the natural person who performs the tasks is identified (Article 83 of the Decree of 29 May 2019). See the designation process step by step.
Can a lawyer be a DPO?
Yes. The CNIL accepts that a lawyer may be designated as an organisation’s DPO on the basis of a service contract. The lawyer cannot represent that organisation in court in personal data matters where this would create a conflict of interest. That is why litigation and sanction proceedings remain outside the fixed fee in our engagement.
What are the tasks of a DPO?
Article 39 of the GDPR sets at least five: to inform and advise, to monitor compliance with the rules, to advise on the impact assessment, to cooperate with the CNIL and to act as its contact point. The DPO takes into account the risk specific to each processing operation. See the tasks of the DPO in detail.
Official sources, checked on 1 October 2026:
- Regulation (EU) 2016/679 (GDPR), Articles 37 to 39 – EUR-Lex
- Decree No. 2019-536 of 29 May 2019, Articles 83 and 84 – Légifrance (in French)
- GDPR practical guide – Data protection officers (Guide pratique RGPD – Délégués à la protection des données) – CNIL (in French)
- Designating a data protection officer or amending a designation – CNIL (in French)
- Data protection officer: identifying and managing conflicts of interest (10 August 2026) – CNIL (in French)
These answers present the law for general information purposes; every situation is different.
A DPO who monitors, and who cannot monitor themselves
We start with a scoping discussion, with no commitment, to set the scope and the annual allocation.
