Outsourced DPO data protection officer as a service
An outsourced DPO means hiring an external data protection officer. Berghem takes on the role required by Brazil's LGPD, acts as the channel with the ANPD and data subjects, guides your teams and coordinates incident response — without the cost of building the role in-house.
What is an outsourced DPO?
An outsourced DPO is the appointment of an external, specialised data protection officer to perform the role the LGPD assigns to the controller. Instead of hiring and maintaining the position internally, the organisation hands the operational responsibility to a multidisciplinary team — legal, technical and information security — that owns privacy full time, without the fixed cost of a senior professional on the payroll.
The DPO (“encarregado” under the LGPD) is, by legal definition, the point of contact between the organisation, data subjects and Brazil's National Data Protection Authority (ANPD). LGPD Article 41 requires the controller to appoint this officer, and the law allows the role to be filled by an individual or a company, internal or external. Berghem takes on the role independently and connects it to your LGPD compliance programme, ensuring continuity, met deadlines and auditable evidence for every request.
What's included
What does an outsourced DPO do day to day?
The external officer operates as an internal one would — but with a team behind them. They receive and answer data-subject requests, guide business areas, keep records and represent the company before the ANPD.
Data-subject channel
Intake, triage and response to data-subject requests — confirmation of processing, access, correction, anonymisation, portability and deletion — within legal deadlines, with documented records of every request handled.
Liaison with the ANPD
Official point of contact with the National Data Protection Authority: responds to requests, leads the dialogue during enforcement actions and coordinates breach notification when the regulation requires it.
Governance and evidence
Support for the Data Protection Impact Assessment, records of processing operations and internal policies — the documentation that proves compliance to an auditor, a client or after an incident.
Guidance and training
Continuous guidance to business areas, review of processing clauses in contracts with processors and vendors, and team training to reduce the risk of data exposure at the source.
Does every company need a data protection officer?
The LGPD requires the controller to appoint an officer (Article 41). The ANPD has regulated the role proportionally to company size, but the data-subject channel and the liaison with the authority remain mandatory for virtually any organisation processing personal data in Brazil.
Companies without a dedicated team
Small and mid-sized companies that process personal data but lack dedicated legal and security structure — the outsourced model delivers the full role without creating a senior position on the payroll.
Sectors under specific rules
Financial services, healthcare, education and digital retail stack the LGPD with sector regulation and higher enforcement exposure — settings where an experienced officer reduces regulatory and reputational risk.
International operations
Organisations that process data of subjects in the European Union must also observe the GDPR, whose Articles 37 to 39 govern the appointment and duties of the DPO — covered alongside the LGPD.
How does Berghem deliver the outsourced DPO?
We combine the officer role with an information security and incident-response team. You get an appointed DPO, response SLAs, periodic reports and direct integration with pentest and compliance — not just a stand-alone legal consultant.
One officer, one team
You get a named, publicly disclosed DPO backed by a legal, technical and security team — continuity a single in-house professional rarely maintains through leave, departures or demand spikes.
Privacy tied to security
The officer role integrates with penetration testing, compliance and incident response: when a technical risk becomes a data risk, the decision to notify the ANPD comes from people who understand the evidence, not a checklist.
Proportional, not fixed cost
The investment scales with the volume of data subjects, the number of processing operations, the regulatory sector and the current maturity of the programme — a proportional cost, not a senior salary on your payroll.
Frequently asked questions
What is the difference between a DPO and an encarregado?
Is it legal to outsource the data protection officer?
How much does an outsourced DPO cost?
Does the outsourced DPO handle security incidents?
Do I need a DPO if I also follow the GDPR?
Need a data protection officer?
In a 30-minute conversation we assess your data-processing landscape and design the ideal outsourced-DPO model — from the data-subject channel to the liaison with the ANPD.
Contact Us