RCMThe right package is more than just a name on a declaration. It must plan analysis time, deliverables, access to teams and handling of urgent situations.
From 4,900 MAD / monthAt RCM, an outsourced DPO costs from 4,900 MAD excl. VAT per month (about €450) for a simple organisation, from 8,500 MAD (about €780) for an SME and from 14,500 MAD (about €1,330) for a complex scope. The final price depends on the number of entities, processing activities and vendors, the sensitivity of the data and the availability agreed. The quote is fixed after a free scoping call.
| Plan | For whom | Monthly price excl. VAT |
|---|---|---|
| DPO Monitoring | Small organisation, few processing activities, no sensitive data | from 4,900 MAD (≈ €450) |
| DPO Operations | SME with several tools, vendors or European clients | from 8,500 MAD (≈ €780) |
| Managed Privacy Office | Multi-entity, high volumes or sensitive data | from 14,500 MAD (≈ €1,330) |
Prices updated October 2026. The GDPR Compliance Pack Complete includes 3 months of DPO Monitoring. Volumes and exclusions for each plan are on the pricing page.
Tell us which entities, systems and deadlines are involved. Your proposal should answer these three questions.
The amounts below are starting prices. A proposal confirms the scope, the contacts, the deadlines and the work outside the package.
For a small structure with little processing and without large-scale sensitive data.
For an SME with several tools, suppliers, flows or more sensitive processing.
For a multi-entity, high-volume organization with sensitive data or mandatory DPO.
Two businesses of the same size may require very different charges. We first look at the processing activities and decisions to be secured.
Number of activities, tools, bases, entities and managers to coordinate.
Sensitive data, surveillance, minors, profiling or large-scale processing.
Processors, non-EEA access, contractual terms and additional measures.
Frequency of committees, response times, projects and expected level of intervention.
The contract must distinguish recurring tasks, one-off missions, deadlines and internal responsibilities. The DPO advises and controls: he does not replace management, IT, or a lawyer when a reserved legal consultation is necessary.
Scheduled hours, requests or pace of intervention.
Register, notices, plans, reports and monitoring.
Initial audit, litigation, development and external costs.
On quotation, based on the agreed scope.
Yes. Article 37, paragraph 6 of the GDPR provides that the DPO can carry out its missions on the basis of a service contract. The organization must nevertheless give it the necessary resources, access and independence.
It depends on the package and the departure state. When the scope is unknown or extensive, a separate initial audit avoids underestimating the burden and allows a realistic plan to be contractualized.
Yes. A targeted consultation can clarify the need before a subscription, in particular to check whether the designation of a DPO is mandatory or simply recommended.
Describe your workforce, your salaries, your suppliers and your deadlines. We will tell you if a standard package is sufficient or if tailor-made scoping is necessary.