In two minutes
- You can be the DPO of several organisations. The GDPR expressly provides for a DPO under a service contract. The condition is having enough time and resources for each client, and the authorities have started to check this.
- The DPO advises and monitors; the client decides. If you are the one deciding purposes and means, or carrying out data protection impact assessments (DPIAs) on your own, your independence is at stake.
- The deadlines are the client's, not yours. The 72 hours for a personal data breach run from the moment the client becomes aware, and the month to answer a subject access request (DSAR) runs from the day the request arrived, even if nobody has read it. That is why triage always starts there.
- It scales with a single method. Classify clients by risk, use the same folder structure and the same record format for all of them, follow a yearly calendar and log every piece of advice you give.
Who it's for
Who this guide is for: external DPOs and consultants
External DPOs, consultants and small teams who look after anything from five to a few dozen organisations.
If you are the in-house DPO of a single company, the parts on independence and evidence will also help you; the rest may not.
The scene · Monday, 9:05
Fourteen clients, fourteen ways of organising things
Inês opens her email with her first coffee. None of this is out of the ordinary. The problem is that every client seems urgent and each one has its own system.
- 3messages with the subject "is this a data breach?", two of them from different clients
- 2access requests forwarded by receptionists, one of them nine days old
- 1annual report for the board of a farming cooperative, due on Thursday
- 14shared folders, each organised the way whoever created it saw fit
Inês doesn't need to work longer hours; she needs a single way of working with all of them. That routine is what this guide describes.
Inês, Oficina Rocha and the other clients are fictional.
Free template: the Multi-client DPO Kit puts this guide into a ready-to-use spreadsheet.
Step 1
What the law allows, and what it requires, of a DPO with several clients
The GDPR says clearly that the DPO may be a staff member of the organisation or may fulfil the tasks “on the basis of a service contract”. In Portugal, Law 58/2019 adds that the DPO acts with technical autonomy, whatever the nature of the legal relationship, and does not need professional certification.
Art. 37(6) GDPR; Law 58/2019, Art. 9
Being external does not change the obligations of whoever hires you. Each client still has to:
- involve you, properly and in a timely manner, in all data protection issues;
- give you the necessary resources, including access to personal data and processing operations;
- not give you instructions on how to carry out your tasks, and allow you to report directly to the highest level of management;
- publish your contact details and communicate them to the CNPD (Portugal’s data protection authority). The CNPD has its own form for this, and each organisation makes its own communication.
Art. 37(7) and 38(1)–(3) GDPR; CNPD, page on the data protection officer (in Portuguese)
On your side, there are three rules that weigh more when there are many clients. You are bound by professional secrecy, which continues after your role ends. You may have other tasks, as long as they don’t create a conflict of interest. And you must have due regard to the risk of the processing operations, which in practice means prioritising what is riskiest, without ignoring the rest.
Art. 38(5) and (6), and 39(2) GDPR; Law 58/2019, Art. 10
In Portugal, the law gives the DPO three tasks on top of those in the GDPR: arranging audits, periodic or unscheduled; raising users’ awareness so that they detect security incidents and report them immediately; and handling relations with data subjects. The last one matters for triage: data subjects’ requests come to you.
Law 58/2019, Art. 11 (Diário da República, in Portuguese)
If you work as a team, the European guidelines on DPOs accept that a group of people can carry out the role, but recommend a simple rule: one person named as the lead contact and the person in charge for each client. For the client, it should never be “the team”.
WP243 Guidelines on DPOs, section 2.5 (endorsed by the European Data Protection Board, EDPB)
Step 2
What the authorities found
In 2023, 25 European authorities carried out a coordinated action on the designation and position of DPOs. The EDPB report, published in January 2024, portrays the daily life of the people reading this guide.
Source: EDPB, CEF 2023 report on the designation and position of DPOs (median values across authorities).
Two conclusions directly concern the external DPO. Several authorities warned that a DPO who works for many clients may end up “spreading themselves too thinly”. And the EDPB recommends that, when hiring an external DPO, the organisation checks how many clients the DPO has, to confirm there is enough time and capacity. It also recommends that the tasks and conditions are set out in an engagement letter.
EDPB, CEF 2023 report on the designation and position of DPOs, sections 4.2 to 4.6
Step 3
Where your role ends
The more a client trusts you, the more tempting it is to decide for them. This is where independence is lost, almost always out of goodwill.
“We're putting facial recognition at the entrance. Do the impact assessment for us and sign it, we trust you.”The director of a dental clinic, on the phone
Inês suggests something else: the clinic carries out the assessment with a template she provides, she gives written advice on the method and the conclusions, and the final decision is recorded as the management's.
Fictional scene.
The European guidelines are direct: it is the controller, not the DPO, who carries out the impact assessment when needed. The DPO advises on whether one is needed, which method to use and whether the conclusions comply with the GDPR.
Art. 35(2) and 39(1)(c) GDPR; WP243, section 4.2
On conflicts of interest, the Court of Justice of the European Union (CJEU) ruled in the X-FAB case that there is a conflict when the DPO has other tasks that lead them to determine the purposes and means of processing, and that this is assessed case by case. The European guidelines give an example that matters to consultants: there is a conflict if the external DPO is asked to represent the client in court in a data protection case.
CJEU, C-453/21, X-FAB Dresden; WP243, section 3.5
In practice, three habits protect you:
- Give your advice in writing, even short advice.
- When the client doesn’t follow your advice, ask them to record why. The European guidelines describe this as good practice, and the impact assessment must actually justify why the advice was not followed.
- Turn down tasks that put you on the side of whoever decides, such as approving campaigns, choosing vendors or signing on the client’s behalf.
WP243, sections 3.1 and 4.2; Art. 38(6) GDPR
Step 4
Classify clients by risk, not by fees
The client who pays most is not necessarily the one who needs most attention. The GDPR asks the DPO to have regard to the risk of processing operations, and that is what defines how often you follow up each one. A simple model, with six criteria scored from 0 to 2 points:
Working model proposed by Pulsaiq, based on Art. 39(2) GDPR. It is not a legal criterion: adjust it to your client portfolio.
Hours a month as a starting point.
The hours are for a sum worth doing before you take on one more client. Inês has 3 tier A clients, 6 B and 5 C: 24 + 24 + 10 = 58 hours a month of planned follow-up, before breaches, requests and the unexpected. If she only has 70 hours a month for this work, the margin is thin. It is exactly the check the EDPB recommends clients make, and it is better if you make it first.
Review the classification once a year and whenever something from the last criterion happens.
Step 5
The same onboarding kit for every client
Time is lost above all in switching context: each client organises things their own way. Solve that on day one, with four pieces.
1. Engagement letter
It is the EDPB's recommendation, and it is also your protection. It should state, at least:
- the DPO's tasks (Art. 39 GDPR and, in Portugal, Art. 11 of Law 58/2019) and what you don't do, such as making decisions or drafting impact assessments;
- the expected time per month and what happens when it is exceeded;
- who you report to, at the highest level of management, and how often;
- that you receive no instructions on how to carry out your tasks;
- the access you will have to people, systems and documents;
- the client's commitment to tell you on the same day about any incident and any request from a data subject;
- who communicates the DPO's contact details to the CNPD, and when.
2. Initial questionnaire
A single list of questions for everyone. The answers feed the risk classification and the first version of the record of processing activities (ROPA).
3. The same folder structure
Opening folder 04 for any client and knowing at once where the breach register is saves minutes every day. Over a year, it saves days.
4. Named contacts
For each client, one person for incidents and another for data subject requests, with a stand-in. And a DPO contact address that isn't your personal email, so that no request gets lost in an inbox you only look at on Fridays.
The ROPA deserves its own guide: see Record of processing activities: build yours in an afternoon.
Step 6
The yearly calendar
With the same calendar for everyone, recurring work stops depending on memory. Each client gets these tasks in the same months; the risk tier only sets how often reviews and meetings happen.
- JanuaryAnnual report to management
- February—
- MarchReview of the record of processing
- AprilTraining and awareness
- MayProcessor review (Art. 28)
- JuneRecord review · A only
- JulyInternal audit (Law 58/2019, Art. 11)
- AugustEmpty on purpose
- SeptemberRecord review · A and BReview of the risk classification
- OctoberTraining and awareness
- NovemberData breach drill
- DecemberRecord review · A only
Suggested by Pulsaiq; the law does not set these dates.
August is left empty on purpose. Incidents don’t take holidays, but your clients do, and meetings that month rarely happen.
Step 7
Triage: when everything arrives at once
Back to Inês’s Monday. The order doesn’t depend on who shouts loudest, but on which clock is running.
- 1st
Possible personal data breaches
72 hoursThe controller has 72 hours, from the moment it became aware, to notify the CNPD, unless the breach is unlikely to result in a risk. The clock is the client's and it has already started. If the client is a processor, it must tell the controller without undue delay. And every breach is recorded, even those that are not notified.
Art. 33(1), (2) and (5) GDPR · see the guide Data breach: what to do in the first 72 hours - 2nd
Data subject requests
1 monthOne month from receipt, extendable by two more if the request is complex or there are many, as long as the data subject is informed within the first month. Inês's nine-day-old request has already used almost a third of the time.
Art. 12(3) GDPR · see the guide Access and erasure requests - 3rd
Deadlines set by the client or the authority
Set dateRequests for information from the CNPD, management meetings, product launches.
- 4th
Everything else
To the calendarGoes into the calendar, with a date, instead of staying in the inbox.
The first 15 minutes of every day
Go through all your clients' contact inboxes looking for two things only: incidents and data subject requests. Log them straight away: the date and time the client became aware, for breaches, and the date the request arrived, for requests. That log is what later shows the deadlines were met.
Step 8
An evidence log that proves the work
The accountability principle requires the client to comply with the GDPR and to be able to demonstrate it. A large part of that demonstration rests on your work: the advice, the training, the reviews. If it isn’t written down, for an inspection it is as if it never happened.
Art. 5(2) and 24 GDPR
One line per piece of work is enough, in a single log for all clients:
Fictional examples. In practice, add a column with the link to the document in the client's folder 09.
Step 9
Spreadsheets or software?
Everything in this guide works with spreadsheets and a good folder structure. For many DPOs with few clients, that is enough. The problems appear with scale, and almost always in the same places:
| Where it hurts | With spreadsheets | What a dedicated tool should solve |
|---|---|---|
| Versions | “Record_v4_final_revised.xlsx” in three places | One version, with a change history |
| Deadlines | Reminders in your personal calendar, created by hand | 72-hour and one-month deadlines calculated when the case is logged |
| Overview | Opening 14 files to know where everything stands | One dashboard with all clients and what is overdue |
| Evidence | Copying advice from emails into the log | Advice, decisions and documents linked to each other |
| Sharing with the client | Email attachments with personal data inside | Controlled access to each client’s own area |
Whatever you choose, the method comes first. A tool won’t fix a portfolio with no risk classification or a client who doesn’t report incidents.
Updated 21 October 2026
What may change
There are two EU proposals under way that amend the GDPR. Neither changes the core of this guide: the DPO’s tasks and position. But they do change the work you do for clients.
- Record of processing activities (Omnibus IV). The Commission proposed extending the exemption from the record to organisations with fewer than 750 employees. In the provisional agreement of 26 June 2026, the Council and Parliament raised the threshold to fewer than 1,000 people, while keeping the record mandatory for high-risk activities, for activities that require a DPO and for public bodies. The plenary vote is scheduled for 23 November 2026. Some tier C clients may no longer be required to keep the record, but they will still need to know their data to answer requests and demonstrate compliance.
- Breaches and requests (Digital Omnibus). The November 2025 proposal would require notifying the authority only for high-risk breaches, extend the deadline to 96 hours, create a single EU entry point for notifications, and clarify when an access request is abusive. It also provides for common EU lists of processing that does, or does not, require an impact assessment. The EDPB and the European Data Protection Supervisor (EDPS) support several of these measures with reservations. Member States’ ambassadors were discussing the Council’s negotiating mandate on 21 October 2026.
Until the new rules are published in the Official Journal and apply, the current ones apply: 72 hours, notification whenever there is a risk, and the record with the current Art. 30(5) exemption.
We explain what the Digital Omnibus changes for data breaches and access requests in our article on the Digital Omnibus.
Procedure 2025/0130(COD); COM(2025) 837; EDPB-EDPS Joint Opinion 2/2026; Coreper agenda, 21 Oct 2026
Print this
Checklist for an external DPO with several clients
Common questions
Frequently asked questions
How many clients can an external DPO have?
The law sets no maximum, and neither does the EDPB report. What is expected is that you can show you have the time and resources for each client, and the EDPB recommends that organisations check this before they hire. The Capacity sheet in the multi-client DPO kit does that calculation for you.
Can an external DPO carry out the impact assessment for the client?
They shouldn’t. The impact assessment is the controller’s job (Art. 35(2)). The DPO advises on whether it is needed, which methodology to use and whether the conclusions comply with the GDPR (Art. 39(1)(c)). You can provide the template, but the decision is recorded as the client’s.
Does a DPO need a certification in Portugal?
No. Law 58/2019 says the DPO does not need professional certification (Art. 9). The DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices (Art. 37(5) GDPR).
Who notifies the authority of the DPO’s contact details?
Each client, for itself. The organisation that designates the DPO publishes the contact details and communicates them to the supervisory authority (Art. 37(7)). The engagement letter should say who does this and when.
What if the client doesn’t follow the DPO’s advice?
Ask for the reason to be recorded. The written advice and the client’s decision go in the evidence log, and an impact assessment must justify why the advice was not followed. That way the decision stays with whoever made it, and your work is on record.
Official sources only
Sources
Legislation and case law
- Regulation (EU) 2016/679 (GDPR), Art. 5, 12, 24, 33, 35, 37 to 39 (EUR-Lex)
- Law 58/2019 of 8 August, Art. 9 to 11 (Diário da República, in Portuguese)
- CJEU judgment of 9 February 2023, C-453/21, X-FAB Dresden
EDPB and CNPD
- Guidelines on Data Protection Officers (WP243 rev.01), endorsed by the EDPB
- EDPB, 2023 Coordinated Enforcement Action: designation and position of DPOs (January 2024)
- CNPD, page on the data protection officer (in Portuguese)
Changes under way
- European Parliament, procedure 2025/0130(COD) (Omnibus IV)
- COM(2025) 837, Digital Omnibus proposal
- EDPB-EDPS Joint Opinion 2/2026
- Council of the EU, Coreper agenda of 21 October 2026
Last reviewed: 21 October 2026. We review this guide whenever the law or the guidance changes. This guide is general information and does not replace legal advice on a specific case. People, companies and situations in the scenes are fictional. Pulsaiq · GDPR with minimal effort