Compliance and privacy consultancy: roles, differences and DPO-as-a-Service

Compliance and privacy show up in almost every digital project: a new shop, a CRM implementation, an AI application or a customer asking for evidence in a contract. This page explains which roles exist, what they do and when to bring in which. We broker these specialists from our network and do not give legal advice ourselves — but we will honestly tell you when you need someone.

Compliance consultant: demonstrably meeting requirements

A compliance consultant maps which rules, standards and contractual requirements you must meet, and how to organise that demonstrably. Demonstrably is the key word: not "we do it properly", but policy, documented processes, responsibilities and periodic control.

Typical triggers:

• A customer or tender asks for certification or proof of your information security.
• You grow and the agreements that used to live in someone's head now need to be on paper.
• There has been an incident and "how do we prevent this" needs a structural answer.

What a compliance engagement produces: an overview of requirements, a gap analysis, a plan with priorities and a rhythm of checking. Where it goes wrong: a folder of documents nobody uses, because practice differs from policy.

Privacy consultant: personal data in order

A privacy consultant helps set up how you handle personal data. In practice that covers:

• Processing register — which data you process, for what purpose, on which legal basis and for how long.
• Retention periods — what you delete when, and whether that actually happens.
• Processor agreements — with your hosting party, email tool, CRM and ad platforms.
• Marketing and measurement — consent, cookies, conversion tracking and what you may and may not share with ad platforms.
• Data subject rights — how you handle an access or deletion request within the deadline.

This touches our work directly: if consent and measurement are wrong, your data is wrong. We help with the technical and marketing side and leave the legal assessment to the privacy specialist.

DPO: independent supervision

A DPO (Data Protection Officer) supervises how personal data is handled, advises, is the contact point for data subjects and the supervisory authority, and reports independently to the board.

Public bodies and organisations that process special categories of personal data at scale or systematically monitor people must appoint a DPO. Many other organisations appoint one voluntarily, for example because customers or insurers ask for it.

Watch the separation of roles. A DPO supervises; someone who runs the systems or the marketing cannot do that independently over their own work. See also the term DPO.

DPO-as-a-Service: outsourcing the role

DPO-as-a-Service (in Dutch also FG-as-a-Service) means an external specialist fills the Data Protection Officer role, usually on a subscription basis. You get a fixed number of hours per month, a contact point for questions and incidents, and periodic reporting.

That suits organisations that need or want the role but have no full position for it. What to agree in such a subscription:

• Availability and response time, including in case of a data breach.
• Which work is included: supervision, advice, keeping the register, incident guidance, awareness.
• What counts as extra work, at what rate.
• How independence is arranged and who receives the reporting.

How much attention it takes depends on what you process and how quickly someone has to be reachable. See also DPO-as-a-Service in the glossary.

What is the difference between these roles?

Role	Does	Duration
Compliance consultant	Map requirements, set up, make demonstrable	Project
Privacy consultant	Set up processing, documents and practice	Project
DPO	Independent supervision and advice	Ongoing
DPO-as-a-Service	The same DPO role, external and on subscription	Ongoing

In short: a consultant sets things up, a DPO supervises. The first is temporary work, the second a permanent role.

Where we help ourselves

Within our own core we touch this subject weekly. Concretely we do:

• Consent and measurement — cookie banner, consent mode, conversion tracking and data minimisation in analytics and advertising.
• Data in systems — what you store in CRM, email tooling and business intelligence, and what you should not store.
• AI applications — which data you do and do not put into a model or tool, and how to set that up. See AI and data.
• Technology and access — hosting, backups, recoverability, permissions and accounts in your name.

For the legal assessment, the formal DPO role or certification programmes we bring in a specialist from our network. That way it is always clear who is responsible for what.

Frequently asked questions

Is a privacy consultant the same as a DPO?

No. A privacy consultant helps set up and clean up; a DPO then supervises independently. Having the same person do both can create a conflict.

Are we required to appoint a DPO?

That depends on what you process and at what scale. Public bodies, organisations processing special categories of personal data at scale and organisations that systematically monitor people are required to. Have this assessed by a privacy specialist — we are not a legal advisor.

How many hours does DPO-as-a-Service take?

That depends on what you process, at what scale and how quickly someone has to be reachable. We work that out in the conversation, together with the specialist.

Can you supply a compliance or privacy consultant?

Yes, from our network. We stay your point of contact and take on the digital and marketing side ourselves; the substantive advice comes from the specialist.

A compliance or privacy question in your digital project?

Tell us what is going on. We will honestly say what we take on and where you need a specialist.

Get in touch or book a free strategy session.