Outsourced DPO: data protection officer for your company
An outsourced DPO means a specialist who is responsible for GDPR on your behalf, at a fraction of the cost of an employee, with liability written into the contract.
Many organizations are required to have a data protection officer (DPO): public institutions, clinics and those who systematically monitor people, including through large-scale cameras. The rest can be designated voluntarily, so that they have someone to respond when a request or incident comes.
GreenSoft provides the function of outsourced DPO: designation at ANSPDCP, compliance monitoring, approval of new projects (an application, new cameras, a new supplier), management of requests from data subjects, management of incidents and notifications within 72 hours, periodic training of employees. All in a monthly subscription, with hours included and written response time.
Because we also manage the technical infrastructure of many clients, our DPO sees the incident at the same time as the IT team, not after learning from the press.
What does the service include?
- Designation of the DPO and notification to the ANSPDCP
- Compliance monitoring and annual documentation review
- Approval of new processing, suppliers and impact assessments
- Handling of data subject requests and incidents, including notification within 72 hours
- Annual employee training and periodic report to management
Why GreenSoft
A DPO must be independent, competent and accessible. Outsourced to GreenSoft, he is all three: he does not report to a department head, he has training in data protection and information security (ISO/IEC 27001) and he responds within the terms of the contract. And when the incident is technical, he does not have to translate between legal and IT: it is the same team.
How the project is progressing
- Initial assessment of compliance and the obligation to appoint a DPO
- Contract, designation and notification to ANSPDCP
- Taking over the documentation and establishing the verification schedule
- Current activity: notices, requests, incidents, training, periodic report
For which types of sites
- Public institutions
- clinics, laboratories and private hospitals
- schools and kindergartens
- hotels with extensive surveillance
- recruitment companies and call centers
- companies with multiple locations
Tell us what your activity is and if you already have GDPR documentation; we'll tell you the same day if you have a DPO obligation and you'll receive a subscription offer.
Where we work
We cover the entire county of Constanta: Constanta municipality, Mamaia, Năvodari, Ovidiu, Agigea, Eforie, Techirghiol, Mangalia, Medgidia and Cernavodă, including the port perimeter, based on the work license in the Port of Constanta. For larger works, we travel throughout Dobrogea.
Useful resources
- Video surveillance and GDPR in 2026: the rules for businesses
- What happens if ransomware reaches the building infrastructure?
Frequently asked questions
Who is required to have a DPO?
Public authorities and institutions, organizations whose main activity involves the systematic monitoring of individuals on a large scale, and those that process sensitive data on a large scale, such as medical data. We assess for free if you are in one of these situations.
Can the DPO be an employee of the company?
Yes, if he is not in a conflict of interest (he cannot be the administrator, IT or HR director) and has the necessary training. In practice, for small and medium-sized companies, outsourcing is cheaper and safer.
What does the monthly subscription include?
A number of hours included for notices, requests and checks, written response time for incidents, annual training and periodic report. Additional hours are billed at an agreed hourly rate.
What happens in a security breach?
You let us know or, if we also manage the infrastructure, we'll take care of it. We assess the severity, document the incident, notify ANSPDCP within 72 hours if necessary, and inform the affected people. Then we correct the cause.
Do I need to have GDPR compliance done first?
Not necessarily. If documentation is missing, we start with the GDPR compliance project and continue with the DPO for maintenance.
Shall we discuss your project?
Free initial technical consultation and quote within 3–5 business days.
