External data protection officer
We take on the role from outside your payroll: an attorney from the firm leading it, the enquiries channel in TuAvocado’s name, and data compliance run month by month — without opening a headcount position.
An attorney from the firm holds the role, with the TuAvocado team behind every deliverable.
From the scope to the monthly run
Three steps. The first one costs you nothing and you run it right here.
Step 1 of 3. Starting diagnosis
We look at what data the company handles, for what purposes, and what the site publishes today. It is the starting point and it costs nothing.
No sign-up, no card
Step 2 of 3. Scope and handover
We agree on what is in scope and take over what already exists: published policies, the database inventory, vendor contracts, and the channel requests arrive through.
Done once
Step 3 of 3. Monthly run
From there the firm holds the role: handling enquiries and complaints, keeping the database registry current, reviewing new processing activities, and training the team.
Renewed month by month
Start by knowing what you handle
The same tool as on the home page, no sign-up and no card. The result appears right here.
Fill in the form on the left to display the real-time risk analysis.
What we do for you each month, and what it costs you
What we do each month, how it differs from handing the role to someone on your team, and what you pay for it.
In-house or external
Two ways to cover the same role. Who your company answers to is written by the principal attorney: that is legal judgment and we do not improvise it.
| Criterion | In-house | External · TuAvocado |
|---|---|---|
| Who holds the role | Someone on the team who also has another job. | An attorney from the firm, with the TuAvocado team behind them. |
| Who the company answers to | [ PENDING — legal text to be drafted ] | |
| How it is contracted | As a payroll position. | As a monthly subscription, with no headcount to open. |
What your data officer does
Included in the subscriptionHandles data subject enquiries and complaints
The channel sits in the firm’s name and an attorney prepares the answers.
Keeps the database registry current
Updates the filing when what the company handles — or who handles it for them — changes.
Coordinates the response to incidents
Sets what gets done, who communicates, and what gets documented when something goes wrong.
Reviews new processing activities
Before the product team ships a feature that collects data nobody planned for.
Trains the team
Sessions for the team and onboarding material for new joiners.
How long a reply takes is not on this list: the principal attorney writes it, and you will find it further down, under “When your data officer acts”.
If your databases are not registered yet, you hire that filing separately: RNBD registration
When your data officer acts
The two timelines that shape this role are written by the principal attorney. Until they are, we would rather leave them blank than pass off an estimate of ours.
- Time to answer a data subject’s enquirySet by the regulation
[ PENDING — legal text to be drafted ]
- Time to answer a data subject’s complaintSet by the regulation
[ PENDING — legal text to be drafted ]
What people ask us most
About the risk analysis
General information about how our services work. This is not a legal opinion and does not replace advice from a lawyer on your specific case.
4 questions on this topicThey open in the support panel, without leaving this page.
See the questionsIs your question missing?
Not sure whether you need one?
Fifteen minutes with an attorney, at no cost: we look at what data your company handles today and what it would take to keep it running month after month.