Fractional Data Protection Officer
Who requires one
UK GDPR requires a DPO where an organisation is a public authority, where its core activities involve large-scale regular and systematic monitoring of individuals, or where its core activities involve large-scale processing of special category data — health, ethnicity, religion, sexual orientation, criminal data and similar. Many charities, membership bodies and health-adjacent organisations meet the third test. Others do not strictly meet any of them but hold data of sufficient sensitivity that appointing a DPO is the prudent course.
Scope
A named DPO, registered with the ICO as your organisation’s contact, independent of operational management as the legislation requires. Monitoring of compliance with UK GDPR and the Data Protection Act 2018, including periodic review of processing activities. Advice on and approval of Data Protection Impact Assessments. Point of contact for the ICO and for data subjects. Handling or supervision of subject access requests, erasure requests and complaints. Breach assessment within the statutory 72-hour window, and notification where required. Staff training, with attendance recorded. An annual data protection report to the board or trustees.
Delivery
Records of processing, DPIA register, breach log, SAR log, retention schedule, training records and policy library are maintained in the Xelvio Toolkit. Your DPO works from the same live record. The retainer includes a defined allocation of advisory hours per month; work beyond that is quoted in advance.
Terms
Monthly retainer, tiered by organisation size and data sensitivity. Twelve-month minimum, one month’s notice thereafter. Onboarding at a fixed fee, including a GDPR audit. [Insert tiers or “from £X per month”.]
Typical clients
Charities and community organisations holding sensitive personal data; membership and professional bodies; organisations operating reporting, helpline or casework services; healthcare-adjacent organisations outside the NHS; technology companies processing user data at scale.