Once the obligation is established, another question comes up quickly: who? An employee in-house, an external provider, a DPO shared between several entities? There is no right choice in the absolute: there is a choice suited to your real workload and to a trap that is almost always forgotten.

The trap first: conflict of interest

The DPO monitors the compliance of data processing. So they cannot be the person who decides on that processing. A company head, a chief information officer, a marketing director or a CISO with decision-making power would be monitoring themselves, which the Court of Justice of the European Union has explicitly ruled out.

Holding several roles is not forbidden in itself. It becomes a problem as soon as the other hat lets the person set the purposes or means of a processing activity. That is the most common reason why "let's give it to our IT manager" is a bad idea.

You can't be both the one who decides on the processing and the one who checks that it is lawful.

In-house: proximity, if the workload justifies it

An in-house DPO knows the organization inside out and is available day to day. That makes sense for a mid-sized company, a large company or a sensitive sector, with ongoing processing. The risks: isolation, an inappropriate reporting line, and genuinely insufficient time when the role is part-time.

External: expertise and independence

An external DPO brings specialist expertise and natural organizational independence. For an SME whose workload is steady but limited, it is often the best balance of safety and cost, provided the contract guarantees availability, a backup and real knowledge of your processes. A few hours a year is not enough for a digital platform or a company that handles sensitive data.

Shared and hybrid: for organizations with several entities

A group can appoint a single DPO, provided they are easy to reach from each establishment. The hybrid model, with a central DPO, a network of internal contacts and external experts, suits mid-sized companies and groups well: the DPO keeps the independence of oversight, while the contacts gather information and roll out actions.

The deciding criterion: your real workload

Before comparing quotes, estimate the workload: number of entities, employees and customers, volume of projects, data subject requests, incidents, impact assessments, subprocessors, countries involved. That figure, not the listed price, tells you whether a package holds up.

  • Few processing activities, no sensitive data → shared external DPO, package with a guaranteed minimum.
  • Digital activity, HR, health or advertising → specialist external DPO or in-house DPO with significant time, backup mandatory.
  • Several entities, shared governance → central DPO + internal contacts, formalized escalation lines.

The conflict-of-interest test

List the roles of the person you have in mind and ask yourself whether any of them lets them decide on a processing activity. If so, look elsewhere. Then estimate your annual workload before looking at any price: it is the only honest basis for choosing a model that will last.

A poorly chosen DPO costs less than a good one, until the day of the inspection.