Service
Fractional DPO for UK and EU companies
A part-time, outsourced data protection officer on a monthly retainer, for companies that need the DPO role filled properly without a full-time hire. The service is designed for companies running AI systems, where the data protection questions change with each product release.
Led by Michael K. Onyekwere, a CIPP/E certified privacy professional and common law qualified lawyer, the service covers the DPO tasks in Article 39 of the UK and EU GDPR (advising your teams, monitoring compliance, advising on DPIAs and acting as your contact point with the regulator), together with data subject requests, breach assessment and keeping your records and privacy notices current.
DPO support from £500 a month; designated DPO from £1,000 a month. Three-month minimum.
When you need this
A one-off review answers a single question. The DPO role continues for as long as the processing does, so we offer it as a monthly retainer.
When the law requires a DPO
Article 37 requires a DPO where you are a public authority, where your core activities consist of processing operations that require regular and systematic monitoring of individuals on a large scale, or where they consist of large-scale processing of special category or criminal offence data. Products that profile or track user behaviour at scale can fall within the monitoring limb, so it is worth assessing this early.
Your product and suppliers keep changing
Each new vendor, model provider or data feature affects your DPIA, your privacy notice and your records of processing. A retainer keeps those documents current as the product changes, rather than reworking them in a single project before an audit or a funding round.
You need the role filled without a full-time hire
The GDPR allows the DPO to work under a service contract rather than as an employee (Article 37(6)). A fractional DPO provides the expert knowledge and independence the role requires, with hours matched to your processing.
What's included
Documentation
- DPIA preparation support and review for new AI systems
- Privacy notice updates as products change
- Records of Processing Activities (Article 30)
- DPA register and vendor reviews
- EU AI Act technical documentation
Operations
- Data subject access request handling
- Breach assessment and support with notification under Article 33
- Regulator liaison (ICO, DPC, NDPC)
- Quarterly compliance reviews
- Vendor due diligence on new AI providers
Advisory
- Architecture review on new features
- Pre-launch compliance checks
- Monthly advisory sessions (Slack or email)
- Regulatory horizon scanning
Designated DPO role
- Named external DPO for your organisation
- Contact details published and notified to the ICO or your EU regulator (Article 37(7))
- Available to staff and to individuals exercising their rights (Article 38(4))
- Reports directly to your highest management level (Article 38(3))
Pricing
Foundation
£500
/ month
For small teams running 1-2 AI systems. Quarterly reviews, documentation maintenance, async advisory.
- 2 hours of advice a month
- Quarterly compliance review
- DSAR and breach support
- Email response within 48 hours
Operating
£1,000
/ month
For active product teams shipping AI features regularly. Monthly reviews, full DPO designation, ongoing documentation.
- 5 hours of advice a month
- Monthly review and horizon scan
- Designated DPO role
- Pre-launch reviews on new features
- Asynchronous access by Slack or email
Programme
£1,500
/ month
For companies with multiple AI products, multi-jurisdictional operations, or active regulatory scrutiny.
- 10 hours of advice a month
- Bi-weekly reviews
- DPO support across the UK, EU and Nigeria
- Regulator liaison and audit prep
- Priority response within 24 hours
3-month minimum commitment. Quarterly invoicing available. Pricing fixed for the term.
Established outside the UK and also need a UK representative under Article 27? That is a separate, smaller appointment: UK GDPR representative, £349 a year.
Fractional DPO: common questions
What is a fractional DPO?
A fractional DPO is a data protection officer who works for your organisation part-time under a service contract, rather than as a full-time employee. The UK GDPR and the EU GDPR both allow this: Article 37(6) provides that the DPO "may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract". The tasks are the same either way.
Does my company need a DPO?
Article 37(1) requires one where the processing is carried out by a public authority or body (other than courts, and in the UK tribunals, acting in their judicial capacity), where your core activities consist of processing operations that require regular and systematic monitoring of individuals on a large scale, or where your core activities consist of large-scale processing of special category data or criminal offence data. In the EU, national law can require a DPO in further cases; Germany, for example, requires one where at least 20 people are regularly engaged in automated processing (section 38 BDSG). Other organisations may appoint a DPO voluntarily, and the ICO's guidance is that the same requirements on the position and tasks then apply as if the appointment had been mandatory.
What does a DPO do?
Article 39 sets the minimum tasks: informing and advising the organisation and its staff about their data protection obligations, monitoring compliance (including staff training and audits), advising on data protection impact assessments where requested and monitoring their performance, and cooperating with and acting as the contact point for the regulator. Individuals can also contact the DPO about the processing of their data and the exercise of their rights (Article 38(4)).
Can an external DPO be independent?
Yes. The organisation must ensure that the DPO receives no instructions about how to carry out the DPO tasks, is not dismissed or penalised for performing them, and reports directly to the highest management level (Article 38(3)). Article 38(6) allows a DPO to hold other duties only where they do not create a conflict of interests, and the ICO's guidance is that the DPO must not hold a position that leads them to decide the purposes and means of processing.
How much does a fractional DPO cost?
Our retainers run from £500 to £1,500 a month, depending on the number of systems and jurisdictions and the hours of advice you need, with a three-month minimum term. The designated DPO role is included from £1,000 a month. Most engagements start with a £500 written scoping review, and that fee is deducted from the retainer if you go ahead.
Is a DPO the same as a UK GDPR representative?
No. A DPO advises on and monitors your compliance. A representative under Article 27 is required where a company with no establishment in the UK offers goods or services to people in the UK or monitors their behaviour there, unless its processing is occasional, is unlikely to result in a risk to individuals' rights and freedoms and excludes large-scale special category or criminal offence data, or it is a public authority. The representative acts as the local point of contact for the ICO and for individuals. A company can need both. For the EU, the European Data Protection Board considers the role of representative incompatible with that of an external DPO (Guidelines 3/2018, section 4), because the representative acts on the controller's instructions, so we do not act as both EU representative and DPO for the same client.
Sample Deliverables
See the work before you buy
Blog posts explain the ideas. These sample deliverables show what the work product actually looks like.
See the paid work before you buy it
What a £500 scoping review actually says
A complete worked example of the paid review itself, on an invented client, with real findings traced to primary sources and the limits stated. No PDF, no email needed.
Most useful for GDPR + AI buyers
Sample DPIA structure for an AI chatbot
A redacted outline showing the sections, risk analysis, and controls we include in a real AI-system DPIA.
Quick proof of practical drafting
Sample privacy notice update
A before-and-after example showing how a privacy notice changes once an AI system is introduced.
Useful before hiring any AI vendor
AI vendor due diligence checklist
A practical checklist covering DPAs, retention, subprocessors, transfers, security, and exit risk.
Start with the written scoping review.
A £500 written assessment of your setup, with the fee deducted from any DPO engagement that follows. Reply within 48 hours.
Request the scoping review