Outsourced DPO services
For a company that must appoint a data protection officer under GDPR Art. 37, or that sells into the EU from outside it and must name a representative under Art. 27. 6 firms that take on either role, measured against the duties in Arts 27 and 37–39, from each firm’s own service pages. read 2026-10-22
Best for a company that must appoint a DPO
VeraSafe
Its pages say yes on every DPO row, and it files its own appointment with the supervisory authority.
Best for a small team that wants the DPO inside its software
heyData
TÜV-certified DPOs working in its own compliance platform, with audits and staff training in the basic package.
Best for a non-EU company that only needs a representative
Prighter
An appointment signed online, a member state of your choice, a request tool, and no DPO role mixed in.
The DPO duties, firm by firm
Each row is a duty Articles 37 to 39 put on the DPO or on the company that appoints one, with the paragraph cited. Read across for one duty; read down for one firm. Not sure you need a DPO at all? The which-laws tool starts from where you are and who you sell to.
| Requirement | VeraSafe | GDPR Local | heyData | GRC Solutions |
|---|---|---|---|---|
| Acts as your DPO under a service contractGDPR Art. 37(6) | yes | yes | yes | yesa named individual |
| States its DPOs’ expert knowledge of data protection lawGDPR Art. 37(5) | yesprivacy attorneys | yescertified DPO team | yesTÜV-certified DPOs | yes“a qualified DPO” |
| Contact details published and filed with the authorityGDPR Art. 37(7) | yes | partialpublished; filing not stated | partialappointment support; filing not stated | yes |
| Works free of instructions on its DPO tasksGDPR Art. 38(3) | yes“impartial oversight” | yescites Art. 38(3) | not stated | yes“independent oversight” |
| Contact point for data subjectsGDPR Art. 38(4) | yes | yesyou answer requests day to day | yes | yeshandles DSARs |
| Advises on data protection impact assessmentsGDPR Art. 39(1)(c) | yes | yes | yes | not stated |
| Monitors compliance, with audits and staff trainingGDPR Art. 39(1)(b) | yes | yestraining support is an add-on | yesin the basic package | partialaudits; training not stated |
| Contact point for the supervisory authorityGDPR Art. 39(1)(d)–(e) | yes | yesincl. Art. 36 consultations | yes | yes |
Source: each firm’s own service pages, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||
The representative duties, firm by firm
A separate table, because it is a separate legal role with a separate trigger: no establishment in the EU, but goods or services offered to people there, or their behaviour monitored. Our guide on whether the GDPR applies to a US company walks through that test.
| Requirement | VeraSafe | GDPR Local | GRC Solutions | Prighter | EDPO |
|---|---|---|---|---|---|
| Named in writing as your EU representativeGDPR Art. 27(1) | yes | yes | yes | yessigned online | yes |
| Offices in more than one member stateGDPR Art. 27(3) | yes | not stated“EU office” | not stated | yesyou choose the member state | yeshead office Brussels |
| Can be addressed by authorities and data subjects in your placeGDPR Art. 27(4) | yesreplies after consulting you | yeslogs and forwards | yes | yesrequest tool included | yesfree translation |
| Keeps your record of processing for the authorityGDPR Art. 30(1), (4) | partialhelps you build it | yes | not stated | yes | yes |
| Also acts as your UK representativeUK GDPR Art. 27 | yes | yes | yes | yes | yes |
Source: each firm’s own service pages, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||
DPO or representative: what the law asks for
The two roles are often sold side by side and often confused. A data protection officer watches over your compliance from the inside, and the GDPR makes one mandatory in three cases: public bodies, core activities built on large-scale regular and systematic monitoring of people, and core activities built on large-scale processing of special-category or criminal-offence data (Art. 37(1)). A representative is the EU address of a company that has no establishment in the EU but sells to, or monitors, people there. Our guide to what a data protection officer does covers the first role in full.
| Your situation | DPO (Art. 37) | EU representative (Art. 27) |
|---|---|---|
| An EU business whose core activity is large-scale, regular and systematic monitoring of people | required — Art. 37(1)(b) | not needed: you are established in the EU |
| An EU business whose core activity is large-scale processing of health or other special-category data | required — Art. 37(1)(c) | not needed: you are established in the EU |
| An EU business with neither of those core activities | optional, unless national law requires one — Art. 37(4) | not needed |
| No EU establishment, but you sell to or track people in the EU | only if one of the Art. 37(1) cases applies | required — Art. 27(1) |
| No EU establishment, and the processing is occasional, low-risk and not large-scale special-category data | only if one of the Art. 37(1) cases applies | exempt — Art. 27(2)(a) |
Source: GDPR Arts 27 and 37, read 2026-10-22. Public authorities need a DPO (courts acting judicially aside) and are exempt from the representative duty. | ||
“The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.”
That sentence is what makes an outsourced DPO lawful. What you buy is oversight, not operations: the DPO must be free of your instructions on its tasks and reports to your top management (Art. 38(3)), and its tasks are to advise, monitor compliance, advise on impact assessments and be the regulator’s contact point (Art. 39(1)). Running the assessments and answering requests stays with you. Our privacy impact assessment template is where a DPO’s DPIA advice gets written down.
A representative carries one piece of paperwork with it: Art. 30(1) says the record of processing is kept by the controller “and, where applicable, the controller’s representative”, and Art. 30(4) makes it available to the authority on request. That is why the representative table has a records row. If you have no record yet, the data map template is a start.
Of the firms here, 3 sell both services. The EDPB, in its guidelines on territorial scope, “does not consider the function of representative in the Union as compatible with the role of an external data protection officer” established in the Union, because a representative acts under your instructions and a DPO must not (Guidelines 3/2018, section 4). If one firm offers you both, ask how it keeps them apart.
Each firm in short
What each one is, who it fits, how it meets the rows, and what to ask before you sign. A DPO who handles requests still needs somewhere to log them; our DSAR software comparison covers the tools.
VeraSafe
What it is
A privacy firm that sells DPO as a service plus EU and UK representative programs. Its DPO team is made up of privacy attorneys and security professionals.
Who it fits
A company that must appoint a DPO and wants one provider to cover the EU, the UK and its other markets: its page says it serves as DPO under privacy laws on several continents.
What the rule requires and whether it meets it
Its page names every DPO duty in the table. It notifies the supervisory authority of its own appointment and gives the authority its contact details, which is the Art. 37(7) filing. As your representative it receives and relays messages from regulators and data subjects, and replies only after consulting you.
Check with the vendor
Its representative page offers to help you build a record of processing, not to hold one for the authority. Ask who keeps it. If you want it as both DPO and representative, ask how it keeps the two roles apart (see the note above).
GDPR Local
What it is
An outsourced DPO service and EU, UK and Swiss representative services, run from an online account you can open for free.
Who it fits
A firm that wants the independence terms in writing. Its page says it takes no instructions on how the DPO function is performed, and cites Art. 38(3).
What the rule requires and whether it meets it
It advises on DPIAs, monitors compliance, and acts as the authority’s contact point, prior consultations under Art. 36 included. As your representative it holds a copy of your Art. 30 record and makes it available to the authority on request.
Check with the vendor
Your own team still answers data subject requests day to day, and help with staff training is an extra service. The page does not say who notifies the authority of the DPO’s details, or where its EU office is. Ask both.
heyData
What it is
A compliance platform for small and mid-sized firms with an external DPO service on top, sold at a fixed monthly fee. A UK GDPR version names the DPO under Art. 37 UK GDPR.
Who it fits
A small team that wants its DPO working inside the same software as its documentation, audits and training.
What the rule requires and whether it meets it
Its DPOs are TÜV-certified. The DPO acts as contact point for regulators and data subjects, supports DPIAs and helps with data breaches. Regular audits and multilingual employee training are in the basic package.
Check with the vendor
The page does not address the DPO’s independence or say who files the appointment with the authority. It lists no EU representative service, so a company outside the EU would need one elsewhere.
GRC Solutions
What it is
A governance, risk and compliance firm selling DPO as a service and EU and UK representative services. IT Governance’s DPO-as-a-service address now redirects to it.
Who it fits
A firm that wants one named person as its DPO, with hours that scale from month to month.
What the rule requires and whether it meets it
You get a named individual. Registration with the supervisory authority is part of the service, and the DPO handles audits, policies, breach management and data subject access requests, and deals with regulators for you.
Check with the vendor
The DPO page does not name DPIA advice or staff training; both appear among its separate consultancy and training services. Its representative page does not mention records of processing.
Prighter
What it is
A representation specialist: EU, UK, Swiss and Turkish privacy representatives, plus representatives under newer EU digital rules.
Who it fits
A company with no EU office that only needs its Art. 27 representative, such as a SaaS product or app with EU users.
What the rule requires and whether it meets it
You sign the appointment online and choose the member state. A request tool for data subject requests is included, and it helps draft and maintain your record of processing.
Check with the vendor
It sells no DPO service. Its own page answers “can a DPO also be an EU GDPR representative?” with a no, citing a conflict of interest and the EDPB. If you also need a DPO, it comes from somewhere else.
EDPO
What it is
The European Data Protection Office: a representative service headquartered in Brussels, with companies in London and Geneva and offices in several other EU cities.
Who it fits
A company outside Europe that needs EU, UK and Swiss representatives from one provider.
What the rule requires and whether it meets it
It is the point of contact for data protection authorities and individuals, and it stores your record of processing. Its home page lists unlimited requests, free translation, a compliance certificate and help with breach notices.
Check with the vendor
No DPO service is listed. Ask which office will be named as your representative.
How we compared them
We picked firms that sell a DPO or an EU representative as a standalone, published service a company without a privacy team can buy, and whose own pages describe what the service includes. Law firms that take the role only within a wider legal mandate are left out. Software that helps an in-house DPO is compared on our GDPR compliance software page instead.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Here the “vendor documentation” is each firm’s own service page; we did not request quotes or engagement letters. A firm with no DPO service, or no representative service, is left out of that table rather than marked “no”.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does a small company need a DPO?
The GDPR sets no headcount for it. A DPO is mandatory in three cases: a public body, core activities that need regular and systematic monitoring of people on a large scale, or core activities that process special-category or criminal-offence data on a large scale (Art. 37(1)). National law can add more cases (Art. 37(4)), so check the law of the country where you are established. Anyone can appoint one voluntarily.
Can our EU representative also be our DPO?
The EDPB says the two functions are not compatible when the DPO is external and established in the EU: a representative acts on your instructions, and a DPO must not take instructions on its tasks (Art. 38(3)). Buy them as separate roles, even if from one firm, and ask how that firm separates them.
Will an outsourced DPO answer our data subject requests?
The DPO is a contact point people can write to about their data and their rights (Art. 38(4)), but the answer is still yours to give: within one month of receipt, extendable by two further months where needed (Art. 12(3)). Some firms here run the request for you, others hand it back. Our guide to what a DSAR is walks through the answer itself.
Does appointing a representative move our liability to them?
No. Art. 27(5) says naming a representative is without prejudice to legal actions against the controller or processor itself. Failing the DPO and representative duties (Arts 25–39) sits in the lower fine tier: up to EUR 10 000 000 or, for an undertaking, up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)).
We sell into both the EU and the UK. Do we need two representatives?
If you have no establishment in either, usually yes: the UK GDPR has its own Art. 27, so the UK representative sits in the UK and the EU one in a member state. Every firm in the representative table offers both. Our GDPR checklist puts the appointment beside the other GDPR duties.