Monthly

Hire an external DPO, with AI oversight (data protection officer)

A DPO who also keeps an eye on your AI, without hiring anyone

An independent data protection officer with fixed hours and a fixed point of contact, who also keeps your AI register and reviews new AI applications.

Fixed monthly feematched to your organisation, agreed up front

12 months, then cancellable per quarter

Book a 30-minute call or take the free check first

Who it is for

Municipalities and other public authorities, and public organisations such as schools and healthcare institutions, which according to the Dutch DPA must always designate a DPO
Organisations that process sensitive data or monitor people on a large scale
Organisations that use AI and want one fixed point of contact for privacy and AI

Not for: Organisations looking for someone who both designs and reviews privacy: that conflicts with the DPO’s independence

What you get

Registration as DPO with the Dutch Data Protection Authority
Advice on DPIAs, data breaches and data subject requests
Keeping the AI register and reviewing every new AI application or supplier
An annual plan, quarterly report and annual report for the board
Fixed hours per month and a fixed point of contact

The law behind it

Every finding links to the explanation on this site, with the legal provision. You do not have to take my word for it.

What the GDPR says about the DPO

Per topic the rule from the GDPR, with the article. Click through for the full text and explanation.

When a DPO is mandatory

The controller and the processor designate a DPO where the processing is carried out by a public authority or body. Only courts acting in their judicial capacity are exempt. Article 37(1)(a) GDPR
Also where the core activities of the organisation consist of processing operations that require regular and systematic monitoring of data subjects on a large scale. Article 37(1)(b) GDPR
And where its core activities consist of processing on a large scale of special categories of personal data (Article 9) or of data relating to criminal convictions and offences (Article 10). The legal text says "and"; under the European guidelines on DPOs (WP243 rev.01, section 2.1.5) it is to be read as "or". Article 37(1)(c) GDPR
In other cases an organisation may designate a DPO, and must do so where Union or Member State law requires it. Under the European guidelines, an organisation that designates a DPO voluntarily is bound by the same rules as for a mandatory DPO. Article 37(4) GDPR

Designating the DPO, internal or external

The DPO may be a staff member, or fulfil the tasks on the basis of a service contract. An external DPO is therefore allowed. Article 37(6) GDPR
A group of undertakings may appoint a single DPO, provided the DPO is easily accessible from each establishment. Article 37(2) GDPR
Public authorities or bodies may designate a single DPO for several of them, taking account of their organisational structure and size. Article 37(3) GDPR
The DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks in Article 39. Article 37(5) GDPR
The organisation publishes the contact details of the DPO and communicates them to the supervisory authority. Article 37(7) GDPR

Position and independence

The organisation involves the DPO properly and in a timely manner in all issues which relate to the protection of personal data. Article 38(1) GDPR
It supports the DPO with access to personal data and processing operations and with the resources necessary to carry out the tasks and to maintain expert knowledge. Article 38(2) GDPR
The organisation ensures that the DPO does not receive any instructions regarding the exercise of the tasks, and does not dismiss or penalise the DPO for performing them. The DPO reports directly to the highest management level of the organisation. Article 38(3) GDPR
Data subjects may contact the DPO about all issues related to the processing of their personal data and the exercise of their rights. Article 38(4) GDPR
The DPO is bound by secrecy or confidentiality concerning the performance of the tasks, in accordance with Union or Member State law. Article 38(5) GDPR
The DPO may fulfil other tasks and duties. The organisation ensures that they do not result in a conflict of interests. Article 38(6) GDPR

The tasks of the DPO (at least)

Inform and advise the organisation and the employees who carry out processing of their obligations under the GDPR and other data protection provisions. Article 39(1)(a) GDPR
Monitor compliance with the GDPR, other data protection provisions and the organisation's policies on the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing, and the related audits. Article 39(1)(b) GDPR
Provide advice where requested on the data protection impact assessment (DPIA) and monitor its performance. Article 39(1)(c) GDPR
Cooperate with the supervisory authority. Article 39(1)(d) GDPR
Act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation in Article 36, and consult it, where appropriate, on any other matter. Article 39(1)(e) GDPR
In performing these tasks the DPO has due regard to the risk associated with processing operations, taking into account their nature, scope, context and purposes. Article 39(2) GDPR

Who does the work

Zahed Ashkara, freelance AI and privacy consultant and legal adviser for the GDPR and the EU AI Act. He does the work himself, exclusively as a freelancer.

Experience, certificates and languages of Zahed Ashkara

How it works

1
A 30-minute call
You explain where you stand. I tell you honestly whether and how I can help.
2
Proposal within three working days
Fixed scope, fixed price and a schedule, within three working days. No open end.
3
Delivery, signed
You receive the deliverable with my name under it, and thirty days for follow-up questions.

Price and terms

Fixed monthly feematched to your organisation, agreed up front

You receive a proposal with the role, the hours, the term and the rate or monthly fee up front. No surprises afterwards.

Praxikon is a trade name of Embed AI (Dutch Chamber of Commerce 90283597). Proposal, terms and invoice are in that name.

Questions

What does an external DPO cost?

A fixed monthly fee, depending on the size of your organisation and the number of hours. After a 30-minute call you receive a proposal within three working days, with the fee that applies for the whole term. The contracting party is Embed AI (Dutch Chamber of Commerce 90283597).

Do we need a DPO?

A public authority always, except courts acting in their judicial capacity. Another organisation if its core activity consists of regular and systematic monitoring of people on a large scale, or of large-scale processing of special category or criminal data (Article 37 GDPR). The decision tree at Article 37 helps you decide.

What does the AI oversight involve?

The AI Act has no mandatory officer like the DPO. You do need to know which AI you use, what your role is and which obligations come with it. I keep the register, review every new application and report every quarter.

Who does the work?

Zahed Ashkara, freelance AI and privacy consultant and legal adviser, does the work himself and puts his name under the deliverable. He works exclusively as a freelancer, not through secondment or employment.

When can the work start?

We agree the start date in the 30-minute call. Send the question or assignment description in advance, and you will know in that call whether and when it fits.

A 30-minute call

Tell me where you stand.

I tell you honestly whether I can help, and what it costs. Within three working days you have a proposal with a fixed price.

Pick a time

Prefer email? info@embedai.nl