RCMProject advice
Assess privacy risks and document decisions.
Illustrative deliverable, scope agreed by proposalRCM · EU-BASED DPO EXPERTISEYour external DPO.
Your external DPO.
EU-based expertise, ongoing support.
A dedicated point of contact to advise your teams, review privacy risks and coordinate GDPR oversight. Scope, availability and responsibilities are agreed in writing.
30-minute meeting via Calendly · No obligation
Defined scopePractical deliverablesRGPD · CNDP
PRACTICAL DELIVERABLES
Know what you will receive.
The proposal defines the documents, scope and responsibilities before work begins.
Discuss my requirements ↗Review programme
Review actions and evidence with your team.
Illustrative deliverable, scope agreed by proposalManagement review
Make priorities clear for management.
Illustrative deliverable, scope agreed by proposalDIRECT ANSWER · EXTERNAL DPO
What is an external DPO service?
An external DPO performs the statutory data protection officer tasks under a service contract. The DPO informs and advises the organisation, monitors GDPR compliance, supports DPIAs and cooperates with supervisory authorities. The organisation remains accountable for its processing and must give the DPO appropriate independence, resources and access to information.
External DPOSMEsArticle 37Ongoing oversight
Official sourcesGDPR · Articles 37–39 ↗EDPB · DPO guidance ↗
The DPO advises, controls and alerts. The company remains responsible for its choices.
01
Governance
Program, register, responsibilities, arbitrations and reporting.
02
Project advice
Legal basis, information, minimization, contracts, DPIA and security.
03
Operational response
Rights, incidents, controls, customer requests and authorities.
PILOTAGEA regular cycle,
A regular cycle,
Not an isolated intervention.
The pace and DPO time are defined in the contract according to risks and projects.
Annual plan
Priorities and controls.
DPO Points
Decisions and actions.
Notice
Projects and incidents.
Reporting
Risks and progress.
What the contract should clarify.
Perimeter
Entities, activities, contacts and systems covered.
Means
Time, access, tools, availability and internal cooperation.
Independence
Lack of instruction on the exercise of the function and conflict management.
Data and access
Location, confidentiality, security and possible transfers.
The CNIL recalls the role, means and conditions of exercise of the DPO, internal or external. Consult the CNIL page →
Frequently asked questions about outsourced DPO services
How much does an outsourced DPO cost? +
At RCM, from 4,900 MAD excl. VAT per month (about €450) for a simple organisation, 8,500 MAD for an SME and 14,500 MAD for a complex scope. Details are on the outsourced DPO pricing page.
Can an outsourced DPO be based outside Morocco? +
Yes. The GDPR allows the DPO role to be performed under a service contract. The DPOs coordinated by RCM are based in the European Union, which makes working with European clients and partners easier.
What does the DPO actually do each month? +
Depending on the plan: a regular check-in with your contact, opinions on projects, record maintenance, vendor reviews, support with data subject requests and incidents, and reporting to management.
Do the compliance packs include a DPO? +
The GDPR Compliance Pack Complete includes 3 months of DPO Monitoring after delivery. The Essential pack does not; a monthly DPO remains available as an option.