When an enterprise customer asks who your Data Protection Officer is, they want a name, a contact route and someone who answers. A Goldline vDPO is appointed under a service contract, as Article 37(6) of the UK GDPR allows, and works the role at the hours a startup actually needs.
Loading the calendar
Open the booking pageThe UK GDPR requires a DPO in three cases: a public authority, large-scale regular and systematic monitoring of people, or large-scale processing of special category or criminal offence data. Most SaaS and AI startups meet none of them.
The question still arrives. An enterprise customer sends a data processing agreement before a trial, a supplier questionnaire asks whether you have appointed a DPO, and someone has to answer the privacy half of a security review. Since 19 June 2026 every controller has also had to help people make data protection complaints, acknowledge them within 30 days and respond without undue delay.
If you appoint a DPO voluntarily, the role carries the full statutory position and tasks. We take that on under contract, so it is done properly rather than given to whoever has time.
A named DPO, with contact details published and notified to the Information Commission
Month-one setup: records of processing reviewed, privacy notice checked, complaints process and form in place, breach procedure written
A playbook for the data processing agreements your customers send: what you can usually accept, what to raise, and when it goes to your solicitor, so nobody signs up to more than the business can deliver
The privacy half of customer questionnaires and data processing agreement reviews
Advice on, and monitoring of, your DPIAs as statute requires
Breach triage, so the 72-hour reporting decision is made on time and recorded
A contact point for individuals and for the Information Commission
A short quarterly note to your board
12-month term
For 5 to 50 people, B2B software, no large-scale special category data.
12-month term
For 50 to 250 people, AI in the product, or customers in the EU.
Extra hours £150 + VAT, agreed in writing before work starts. After 12 months, rolling with 30 days' notice.
Not for public authorities, or for companies whose core activity is large-scale processing of health, biometric or children's data, where the role needs more time than these tiers hold. We will say so on the diagnostic.
Not legal advice. We work alongside your solicitor on contract drafting and anything that needs a lawyer.
Only if one of the three Article 37 tests applies: a public authority, large-scale regular and systematic monitoring, or large-scale special category or criminal offence data. Many companies appoint one because customers ask, and the role then carries the same statutory duties as a mandatory one.
Yes. Article 37(6) allows the role to be filled under a service contract. An external DPO has the same position and tasks as an internal one: involved in good time, given the resources the role needs, reporting to your most senior management and not instructed on how to carry out the tasks.
Drafting bespoke contracts or legal opinions, page-by-page redaction of subject access requests, representation before a court or tribunal, and on-site attendance. Subject access work beyond the Scale allowance is billed at the extra-hours rate, agreed first.
Article 38(6) says a DPO's other tasks must not create a conflict of interest, so we keep two roles apart in writing. As your DPO we monitor, advise and report to your most senior management, and nobody instructs us on how we do that. As your adviser we help your team build things, such as the DPA playbook or the complaints process. Before appointment we record a conflict check and agree which role covers which piece of work, so the DPO never ends up monitoring a decision it made for you.
They overlap on supplier assessment, access, incident handling and risk records. Where you have both, the evidence is kept once and used for both.
No. An EU representative has to be established in the EEA, and Goldline is not. If you need one, we will introduce you to a provider that is.
Twelve months, then rolling with 30 days' notice. A named DPO needs continuity: your customers and the Information Commission will hold the contact details we publish.
From £4,000, plus VAT
Explore the assessment£7,000 fixed, plus VAT
Explore the ISO 27001 SprintISO 27701 added to your ISO 27001: £5,500 + VAT
Explore ISO 27701A 45 minute call establishes whether you need a DPO at all, what your customers are asking for, and which tier fits. If the honest answer is that you don't need one yet, we will say so.
We use cookies to measure the site and improve it.
We use cookies and similar technologies to measure how this site is used and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible and Microsoft Clarity, which records session replays. Read our Cookies policy.