How to contract with your outsourced DPO
Organizations that find themselves in need of a data protection officer (DPO) under the GDPR will need to decide on whether to staff it internally or outsource it, whether it is a full-time or part-time position, and whether the DPO will handle their responsibilities hands-on or by mentoring, overseeing, or training others. If an organization has decided on outsourcing the DPO role and selected its DPO based on their skills for the role, an agreement must be reached on a services contract. This involves certain legal considerations important to the parties, addressing DPO-specific issues that may arise and determining the types of outsourced DPO services desired.
