GDPR and outsourced DPO

GDPR compliance audit and compliance plan

We record the gap between what you do and what the Regulation requires, then turn it into a dated and prioritised plan. The detail of the scope and of the deliverables is set out below.

Outsourced DPO and long-term monitoring

We act as your data protection officer, under a service contract. Duties, rhythm and the mechanics of appointment: again, see below.

Record of processing, policies and privacy notices

The record of processing under article 30 is not a table to be filled in once: it is the document the CNIL asks for first during an investigation, and the one that has to reflect your actual processing on the day of that investigation. We build it with your operational teams, then we draft what follows from it — the privacy notices required by articles 13 and 14, the privacy policy, the retention policy, the procedure for handling requests from data subjects, the breach notification procedure. We also train the people who will have to use it: a record that nobody knows how to update is out of date within six months.

Technology contracts: processing, hosting, SaaS

Every supplier that touches your data calls for a processing agreement that complies with article 28(3). Where the servers or the support team are outside the Union, the safeguards in Chapter V are added — the Commission's standard contractual clauses and a transfer impact assessment. We audit your existing supplier contracts, we draft the ones you impose on your own customers, and we negotiate the schedules that the large publishers present as non-negotiable — they are so more often than people think. This work joins up with what we do on your terms and conditions and your services agreements, and, for the software asset itself, on protecting your code and your databases.

The GDPR compliance audit: scope, duration, deliverables

No rule requires an audit. What the Regulation does require is article 5(2): you must be able to demonstrate your compliance. The audit is the shortest way of getting there — and the only one that produces dated evidence if the CNIL asks you questions.

Our audit covers eight blocks: the mapping of processing activities, the legal basis for each one (art. 6), retention periods, information given to data subjects (arts. 13 and 14), the exercise of rights (arts. 15 to 22), security (art. 32), the processing chain (art. 28) and transfers outside the Union (Chapter V). To that is added a review of the website: trackers and consent fall under article 82 of the French Data Protection Act (the loi Informatique et Libertés), which is distinct from the GDPR and is often the most visible point from the outside.

It runs in three stages: interviews with the operational leads — sales, HR, IT, marketing — a documentary and technical review, then the report-back. You come away with the record of processing filled in, the list of gaps ranked by risk rather than alphabetically, the dated action plan with an owner for each action, and the model documents to roll out.

The outsourced DPO: duties, rhythm, appointment

Article 37(6) expressly provides for it: the officer may be a member of staff orfulfil the tasks “on the basis of a service contract”. Outsourcing is therefore not a tolerated arrangement, it is a route written into the text.

The officer's duties are set by article 39: to inform and advise, to monitor compliance with the Regulation, to give advice on the data protection impact assessment (art. 35), to cooperate with the CNIL and to act as the point of contact. Article 38(3) protects that role: the officer receives no instructions regarding those tasks, cannot be penalised for performing them, and reports to the highest management level.

In concrete terms, the engagement takes the form of a recurring meeting, a watch on the decisions of the CNIL and of the European Data Protection Board, the handling of requests from data subjects as they come in, the running of impact assessments where a new processing activity calls for one, and an availability that proves its worth on the day an incident starts the 72-hour clock. Once appointed, the officer must be published and communicated to the CNIL (art. 37(7)).

Why a lawyer rather than a consultant

Two reasons, both legal and both verifiable.

Professional secrecy. Advice given by a lawyer to a client, and the correspondence exchanged with that client, are covered by article 66-5 of Act no. 71-1130 of 31 December 1971, breach of which is punishable under article 226-13 of the French Criminal Code. An audit report setting out your non-compliances in black and white is, in the hands of a consultant, a document like any other: disclosable, seizable, capable of being passed on. That is a difference in kind, not in degree — and it weighs at the exact moment the document becomes sensitive.

The absence of a conflict of interest.Article 38(6) prohibits the officer's other tasks from giving rise to a conflict of interest. The Court of Justice of the European Union spelled this out in its judgment of 9 February 2023 (X-FAB Dresden, C-453/21): the officer cannot be given duties that would lead them to determine the purposes and means of the processing. An internal DPO who is also the IT director, the general counsel or a company director is structurally exposed to that criticism. A lawyer outside the organisation chart is not — and that lawyer checks for conflicts before accepting the engagement in any event, article 4 of the profession's Règlement Intérieur National, the national rules of the French Bar, already requiring it.

Here we follow the four steps we follow on every file, applied to data protection.

1. We listen to your situation. A first conversation, at the office or by video call, to establish your classifications — controller, processor, or both — and the real origin of the request: a customer, an investor, the CNIL, or an internal decision.
2. We build a strategy that fits. You receive a written proposal: the scope of the audit, the options, the timescale, the agreed amount. Nothing starts without your agreement.
3. We handle the file. Audit, record of processing, documentation, processing agreements, impact assessments, or acting as the data protection officer: your contact stays the same from start to finish.
4. We stay available. Compliance has no end point: a new tool, a new country, a new offer reopens the file. That is what the outsourced DPO engagement covers on a continuous basis.

Our fees follow the three formats used by the firm, set out in detail with the amounts of our fixed fees and of our fee schedule: the monthly retainer for continuous support — that is the format used for the data protection officer engagement, whose workload is regular by nature; the fixed fee per assignment for the GDPR audit, whose scope can be defined before starting; the detailed fee agreement for litigation or enforcement proceedings before the CNIL.

The amount is stated and accepted before the work begins. That is a commitment from the firm, not a turn of phrase: you never discover the cost of a piece of work after the event.

The firm has described itself as a digital business law firm since long before compliance became a boardroom subject, and technology law is one of its long-standing areas of practice.

• The background.Me Jérôme Pujol was admitted to the Bar in 2000. ESSEC master's degree, a spell with Gide Loyrette Nouel in Bucharest, partner of the firm.
• Three offices.Paris, Perpignan and Barcelona — the last on registration on Liste E with the city's Bar.
• The startup ecosystem. Patron of the UPVD iN CUBE incubator, present at the Mobile World Congress in 2021: businesses whose product is the processing of data are not unfamiliar to us.
• Openness about fees, practised publicly by the firm for years — which is rare in the profession, and which can be checked.

One last point, which we prefer to make ourselves: this site records where your visits come from — campaign parameters, click identifiers, referrer — in order to know which communication activities work. That measurement does not fall within the consent exemptions provided for by article 82 of the French Data Protection Act. It is described in our own privacy policy. We rarely advise a business on a subject we do not apply to ourselves.

The GDPR is a regulation: it applies in the same terms everywhere in the Union, and the French authority is national. Where the office is therefore changes nothing about the applicable law — it changes everything else: the ability to run interviews with operational teams on site, and the regular presence a data protection officer is expected to have.

From our office in the 7th arrondissement, we act for software publishers, groups and investors, for whom the data chapter most often arrives through due diligence or through a customer's questionnaire.

In Perpignan, the demand comes rather from the small, medium-sized and mid-cap businesses of Roussillon appointing their first officer, often after a contract with a large customer or a public body that requires it.

Our Catalan office handles French-Spanish flows. For a group established on both sides of the border, article 56 of the GDPR designates a lead supervisory authority according to the location of the main establishment: the one-stop-shop mechanism decides whether your counterpart is the CNIL or the Spanish AEPD. That question is settled when the structure is set up, not at the time of an investigation.