# External DPO with several clients: how to manage GDPR for all of them without drowning
URL: https://pulsaiq.com/en/guides/external-dpo-multiple-clients/
Last reviewed: 2026-10-23
Language: en
Legal basis: GDPR Art. 37 to 39
A routine for anyone working as an external DPO, the data protection officer (DPO) of several organisations at the same time: what the law requires, where your role ends, and how to organise clients, deadlines and evidence so that you reach Friday with everything up to date.
## In two minutes
- **You can be the DPO of several organisations.** The GDPR expressly provides for a DPO under a service contract. The condition is having enough time and resources for each client, and the authorities have started to check this.
- **The DPO advises and monitors; the client decides.** If you are the one deciding purposes and means, or carrying out data protection impact assessments (DPIAs) on your own, your independence is at stake.
- **The deadlines are the client's, not yours.** The 72 hours for a personal data breach run from the moment the client becomes aware, and the month to answer a subject access request (DSAR) runs from the day the request arrived, even if nobody has read it. That is why triage always starts there.
- **It scales with a single method.** Classify clients by risk, use the same folder structure and the same record format for all of them, follow a yearly calendar and log every piece of advice you give.
## Who this guide is for: external DPOs and consultants
Made for
External DPOs, consultants and small teams who look after anything from five to a few dozen organisations.
Also useful, in part
If you are the in-house DPO of a single company, the parts on independence and evidence will also help you; the rest may not.
## Fourteen clients, fourteen ways of organising things
Inês opens her email with her first coffee. None of this is out of the ordinary. The problem is that every client seems urgent and each one has its own system.
Inês's inbox
3messages with the subject "is this a data breach?", two of them from different clients
2access requests forwarded by receptionists, one of them nine days old
1annual report for the board of a farming cooperative, due on Thursday
14shared folders, each organised the way whoever created it saw fit
Inês doesn't need to work longer hours; she needs a single way of working with all of them. That routine is what this guide describes.
Inês, Oficina Rocha and the other clients are fictional.
## What the law allows, and what it requires, of a DPO with several clients
The GDPR says clearly that the DPO may be a staff member of the organisation or may fulfil the tasks "on the basis of a service contract". In Portugal, Law 58/2019 adds that the DPO acts with technical autonomy, whatever the nature of the legal relationship, and does not need professional certification.
Art. 37(6) GDPR; Law 58/2019, Art. 9
Being external does not change the obligations of whoever hires you. Each client still has to:
- involve you, properly and in a timely manner, in all data protection issues;
- give you the necessary resources, including access to personal data and processing operations;
- not give you instructions on how to carry out your tasks, and allow you to report directly to the highest level of management;
- publish your contact details and communicate them to the CNPD (Portugal's data protection authority). The CNPD has its own form for this, and each organisation makes its own communication.
Art. 37(7) and 38(1)–(3) GDPR; [CNPD, page on the data protection officer](https://www.cnpd.pt/organizacoes/outras-obrigacoes/encarregado-de-protecao-de-dados/) (in Portuguese)
On your side, there are three rules that weigh more when there are many clients. You are bound by professional secrecy, which continues after your role ends. You may have other tasks, as long as they don't create a conflict of interest. And you must have due regard to the risk of the processing operations, which in practice means prioritising what is riskiest, without ignoring the rest.
Art. 38(5) and (6), and 39(2) GDPR; Law 58/2019, Art. 10
In Portugal, the law gives the DPO three tasks on top of those in the GDPR: arranging audits, periodic or unscheduled; raising users' awareness so that they detect security incidents and report them immediately; and handling relations with data subjects. The last one matters for triage: data subjects' requests come to you.
[Law 58/2019, Art. 11](https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf) (Diário da República, in Portuguese)
If you work as a team, the European guidelines on DPOs accept that a group of people can carry out the role, but recommend a simple rule: one person named as the lead contact and the person in charge for each client. For the client, it should never be "the team".
[WP243 Guidelines on DPOs, section 2.5](https://ec.europa.eu/newsroom/article29/items/612048) (endorsed by the European Data Protection Board, EDPB)
## What the authorities found
In 2023, 25 European authorities carried out a coordinated action on the designation and position of DPOs. The EDPB report, published in January 2024, portrays the daily life of the people reading this guide.
Responses collected (organisations and DPOs)17,490It is the most complete picture of the profession in Europe.
Responses where the DPO prepares and carries out DPIAs≈ 1 in 3The impact assessment is the controller's job. If you are the one doing it, you can no longer monitor it impartially.
Most common frequency of reporting to top management1–2× a yearAn annual report is the minimum. In four countries, 30% or more said not even that was planned.
Yearly training for DPOs≤ 24 hMost fall below this figure. Plan your own training the way you plan your clients'.
Source: EDPB, CEF 2023 report on the designation and position of DPOs (median values across authorities).
Two conclusions directly concern the external DPO. Several authorities warned that a DPO who works for many clients may end up "spreading themselves too thinly". And the EDPB recommends that, when hiring an external DPO, the organisation checks how many clients the DPO has, to confirm there is enough time and capacity. It also recommends that the tasks and conditions are set out in an engagement letter.
There is no maximum number of clients in the law or in the report. What is expected is that you can show the time is enough. Step 4 shows how.
[EDPB, CEF 2023 report on the designation and position of DPOs](https://www.edpb.europa.eu/system/files/2024-01/edpb_report_20240116_cef_dpo_en.pdf), sections 4.2 to 4.6
## Where your role ends
The more a client trusts you, the more tempting it is to decide for them. This is where independence is lost, almost always out of goodwill.
The scene · Tuesday, 15:20
“We're putting facial recognition at the entrance. Do the impact assessment for us and sign it, we trust you.”The director of a dental clinic, on the phone
Inês suggests something else: the clinic carries out the assessment with a template she provides, she gives written advice on the method and the conclusions, and the final decision is recorded as the management's.
Fictional scene.
The European guidelines are direct: it is the controller, not the DPO, who carries out the impact assessment when needed. The DPO advises on whether one is needed, which method to use and whether the conclusions comply with the GDPR.
Art. 35(2) and 39(1)(c) GDPR; WP243, section 4.2
On conflicts of interest, the Court of Justice of the European Union (CJEU) ruled in the X-FAB case that there is a conflict when the DPO has other tasks that lead them to determine the purposes and means of processing, and that this is assessed case by case. The European guidelines give an example that matters to consultants: there is a conflict if the external DPO is asked to represent the client in court in a data protection case.
[CJEU, C-453/21, X-FAB Dresden](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0453); WP243, section 3.5
In practice, three habits protect you:
- Give your advice in writing, even short advice.
- When the client doesn't follow your advice, ask them to record why. The European guidelines describe this as good practice, and the impact assessment must actually justify why the advice was not followed.
- Turn down tasks that put you on the side of whoever decides, such as approving campaigns, choosing vendors or signing on the client's behalf.
WP243, sections 3.1 and 4.2; Art. 38(6) GDPR
## Classify clients by risk, not by fees
The client who pays most is not necessarily the one who needs most attention. The GDPR asks the DPO to have regard to the risk of processing operations, and that is what defines how often you follow up each one. A simple model, with six criteria scored from 0 to 2 points:
0 points1 point2 points
Number of data subjectsUnder 1,0001,000 to 50,000Over 50,000
Special category or criminal conviction data (Art. 9 and 10)NoOccasionallyCore activity
Transfers outside the EEANoWith an adequacy decisionWith other safeguards
Breaches or complaints in the last 12 monthsNoneOneTwo or more
Change under way (new system, merger, new product)NoSmallMajor
Working model proposed by Pulsaiq, based on Art. 39(2) GDPR. It is not a legal criterion: adjust it to your client portfolio.
Tier A8–12 points
Monthly meeting, quarterly review of the record8 h a month
Tier B4–7 points
Quarterly meeting, twice-yearly review of the record4 h a month
Tier C0–3 points
Twice-yearly meeting, yearly review of the record2 h a month
Hours a month as a starting point.
Inês's sum3 A clients · 6 B · 5 C
A 24 h · B 24 h · C 10 hmargin 12 h70 h available
The hours are for a sum worth doing before you take on one more client. Inês has 3 tier A clients, 6 B and 5 C: 24 + 24 + 10 = 58 hours a month of planned follow-up, before breaches, requests and the unexpected. If she only has 70 hours a month for this work, the margin is thin. It is exactly the check the EDPB recommends clients make, and it is better if you make it first.
Review the classification once a year and whenever something from the last criterion happens.
## The same onboarding kit for every client
Time is lost above all in switching context: each client organises things their own way. Solve that on day one, with four pieces.
It is the EDPB's recommendation, and it is also your protection. It should state, at least:
the DPO's tasks (Art. 39 GDPR and, in Portugal, Art. 11 of Law 58/2019) and what you don't do, such as making decisions or drafting impact assessments;
the expected time per month and what happens when it is exceeded;
who you report to, at the highest level of management, and how often;
that you receive no instructions on how to carry out your tasks;
the access you will have to people, systems and documents;
the client's commitment to tell you on the same day about any incident and any request from a data subject;
who communicates the DPO's contact details to the CNPD, and when.
2. Initial questionnaire
A single list of questions for everyone. The answers feed the risk classification and the first version of the record of processing activities (ROPA).
business areassystemsvendors that process personal datatransfersCCTVpast incidentsexisting documentation
3. The same folder structure
Client_Name/
01_Appointment_and_contractletter, communication to the CNPD02_Record_of_processingone format for everyone03_DPIAassessments and advice04_BreachesArt. 33(5) register05_Data_subject_requestslog and replies06_ProcessorsArt. 28 contracts07_Trainingattendance and materials08_Management_reportsannual report09_Advice_and_evidenceevidence log
Opening folder 04 for any client and knowing at once where the breach register is saves minutes every day. Over a year, it saves days.
4. Named contacts
For each client, one person for incidents and another for data subject requests, with a stand-in. And a DPO contact address that isn't your personal email, so that no request gets lost in an inbox you only look at on Fridays.
## The yearly calendar
With the same calendar for everyone, recurring work stops depending on memory. Each client gets these tasks in the same months; the risk tier only sets how often reviews and meetings happen.
All clientsOnly the tiers shown
JanuaryAnnual report to management
February—
MarchReview of the record of processing
AprilTraining and awareness
MayProcessor review (Art. 28)
JuneRecord review · A only
JulyInternal audit (Law 58/2019, Art. 11)
AugustEmpty on purpose
SeptemberRecord review · A and BReview of the risk classification
OctoberTraining and awareness
NovemberData breach drill
DecemberRecord review · A only
Suggested by Pulsaiq; the law does not set these dates.
August is left empty on purpose. Incidents don't take holidays, but your clients do, and meetings that month rarely happen.
## Triage: when everything arrives at once
Back to Inês's Monday. The order doesn't depend on who shouts loudest, but on which clock is running.
1st
Possible personal data breaches
72 hours
The controller has 72 hours, from the moment it became aware, to notify the CNPD, unless the breach is unlikely to result in a risk. The clock is the client's and it has already started. If the client is a processor, it must tell the controller without undue delay. And every breach is recorded, even those that are not notified.
One month from receipt, extendable by two more if the request is complex or there are many, as long as the data subject is informed within the first month. Inês's nine-day-old request has already used almost a third of the time.
Requests for information from the CNPD, management meetings, product launches.
4th
Everything else
To the calendar
Goes into the calendar, with a date, instead of staying in the inbox.
15min
The first 15 minutes of every day
Go through all your clients' contact inboxes looking for two things only: incidents and data subject requests. Log them straight away: the date and time the client became aware, for breaches, and the date the request arrived, for requests. That log is what later shows the deadlines were met.
## An evidence log that proves the work
The accountability principle requires the client to comply with the GDPR and to be able to demonstrate it. A large part of that demonstration rests on your work: the advice, the training, the reviews. If it isn't written down, for an inspection it is as if it never happened.
Art. 5(2) and 24 GDPR
One line per piece of work is enough, in a single log for all clients:
Clínica Sorriso · Facial recognition at the entrance2026-10-13
AdviceDPIA required; suggest a badge-based alternative
Client's decisionCarry out the DPIA, decide in November
Followed?Yes
Next stepReview DPIA by 2026-11-10
Oficina Rocha · Email with customer data sent by mistake2026-10-16
AdviceNotify the CNPD within 72 h (risk can't be ruled out); don't contact customers for now; reassess if there are signs of misuse
Client's decisionNotified on 19/10, 09:30; additional information sent
Followed?Yes
Next stepTraining on sending attachments
Coop. Vale Verde · Retention of job applicants' CVs2026-10-16
AdviceDelete after 12 months unless there is consent
Client's decisionKeep for 3 years
Followed?No reason recorded by management
Next stepInclude in the annual report
Fictional examples. In practice, add a column with the link to the document in the client's folder 09.
This log does three things at once
It shows what you did for each client.
It writes half of the annual report for you.
It protects you if one day someone asks why your advice was not followed.
## Spreadsheets or software?
Everything in this guide works with spreadsheets and a good folder structure. For many DPOs with few clients, that is enough. The problems appear with scale, and almost always in the same places:
| Where it hurts | With spreadsheets | What a dedicated tool should solve |
|-------------------------|------------------------------------------------------|--------------------------------------------------------------------|
| Versions | "Record_v4_final_revised.xlsx" in three places | One version, with a change history |
| Deadlines | Reminders in your personal calendar, created by hand | 72-hour and one-month deadlines calculated when the case is logged |
| Overview | Opening 14 files to know where everything stands | One dashboard with all clients and what is overdue |
| Evidence | Copying advice from emails into the log | Advice, decisions and documents linked to each other |
| Sharing with the client | Email attachments with personal data inside | Controlled access to each client's own area |
Whatever you choose, the method comes first. A tool won't fix a portfolio with no risk classification or a client who doesn't report incidents.
Updated 21 October 2026
### What may change
There are two EU proposals under way that amend the GDPR. Neither changes the core of this guide: the DPO's tasks and position. But they do change the work you do for clients.
- **Record of processing activities (Omnibus IV).** The Commission proposed extending the exemption from the record to organisations with fewer than 750 employees. In the provisional agreement of 26 June 2026, the Council and Parliament raised the threshold to fewer than 1,000 people, while keeping the record mandatory for high-risk activities, for activities that require a DPO and for public bodies. The plenary vote is scheduled for 23 November 2026. Some tier C clients may no longer be required to keep the record, but they will still need to know their data to answer requests and demonstrate compliance.
- **Breaches and requests (Digital Omnibus).** The November 2025 proposal would require notifying the authority only for high-risk breaches, extend the deadline to 96 hours, create a single EU entry point for notifications, and clarify when an access request is abusive. It also provides for common EU lists of processing that does, or does not, require an impact assessment. The EDPB and the European Data Protection Supervisor (EDPS) support several of these measures with reservations. Member States' ambassadors were discussing the Council's negotiating mandate on 21 October 2026.
**Until the new rules are published in the Official Journal and apply, the current ones apply:** 72 hours, notification whenever there is a risk, and the record with the current Art. 30(5) exemption.
We explain what the Digital Omnibus changes for data breaches and access requests in our article on the Digital Omnibus.
[Procedure 2025/0130(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0130%28COD%29); [COM(2025) 837](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837); [EDPB-EDPS Joint Opinion 2/2026](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf); [Coreper agenda, 21 Oct 2026](https://data.consilium.europa.eu/doc/document/ST-14633-2026-INIT/en/pdf)
## Checklist for an external DPO with several clients
0 of 11 checked
Appointment
Portfolio and capacity
Common method
Routine and independence
## Frequently asked questions
### How many clients can an external DPO have?
The law sets no maximum, and neither does the EDPB report. What is expected is that you can show you have the time and resources for each client, and the EDPB recommends that organisations check this before they hire. The Capacity sheet in the multi-client DPO kit does that calculation for you.
### Can an external DPO carry out the impact assessment for the client?
They shouldn’t. The impact assessment is the controller’s job (Art. 35(2)). The DPO advises on whether it is needed, which methodology to use and whether the conclusions comply with the GDPR (Art. 39(1)(c)). You can provide the template, but the decision is recorded as the client’s.
### Does a DPO need a certification in Portugal?
No. Law 58/2019 says the DPO does not need professional certification (Art. 9). The DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices (Art. 37(5) GDPR).
### Who notifies the authority of the DPO’s contact details?
Each client, for itself. The organisation that designates the DPO publishes the contact details and communicates them to the supervisory authority (Art. 37(7)). The engagement letter should say who does this and when.
### What if the client doesn’t follow the DPO’s advice?
Ask for the reason to be recorded. The written advice and the client’s decision go in the evidence log, and an impact assessment must justify why the advice was not followed. That way the decision stays with whoever made it, and your work is on record.
## Sources
### Legislation and case law
- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Art. 5, 12, 24, 33, 35, 37 to 39 (EUR-Lex)
- [Law 58/2019 of 8 August](https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf), Art. 9 to 11 (Diário da República, in Portuguese)
- [CJEU judgment of 9 February 2023, C-453/21, X-FAB Dresden](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0453)
### EDPB and CNPD
- [Guidelines on Data Protection Officers (WP243 rev.01)](https://ec.europa.eu/newsroom/article29/items/612048), endorsed by the EDPB
- [EDPB, 2023 Coordinated Enforcement Action: designation and position of DPOs](https://www.edpb.europa.eu/system/files/2024-01/edpb_report_20240116_cef_dpo_en.pdf) (January 2024)
- [CNPD, page on the data protection officer](https://www.cnpd.pt/organizacoes/outras-obrigacoes/encarregado-de-protecao-de-dados/) (in Portuguese)
### Changes under way
- [European Parliament, procedure 2025/0130(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0130%28COD%29) (Omnibus IV)
- [COM(2025) 837, Digital Omnibus proposal](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837)
- [EDPB-EDPS Joint Opinion 2/2026](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf)
- [Council of the EU, Coreper agenda of 21 October 2026](https://data.consilium.europa.eu/doc/document/ST-14633-2026-INIT/en/pdf)
Last reviewed: 21 October 2026. We review this guide whenever the law or the guidance changes. This guide is general information and does not replace legal advice on a specific case. People, companies and situations in the scenes are fictional. Pulsaiq · GDPR with minimal effort