Nobody owns privacy full time, and our register was written once.
Fix: Our experts keep the register with your business owners, and a next review date brings each activity back when it is due.
See the registerDone for you
DPO as a service
Privacy needs an owner all year. Our Swiss experts can be your DPO.
DPO as a service: our Swiss experts run your record of processing, data subject requests and breach response in Acuna GRC, with you. Your people keep the decisions. An external DPO, with every record where you can see it.
1 · TICK YOUR PRIVACY LAWSPrivacy Laws
✓GDPRProposedSelected
✓Swiss FADPSelected
2 · KEEP THE REGISTERApply answers to PA
Activities that need an update41
✓PA-001 · PayrollApproved
✓PA-002 · RecruitmentApproved
3 · WATCH THE CLOCKSPrivacy Dashboard
Access request18 days left
Breach · authority deadline31 h 12 min left
✓DPA · Vireo HR SAActive
Does this sound like you?
When do you need an external DPO? When privacy has no owner with time for it.
The register ages, requests arrive by email and nobody is sure what to do if a breach happens. An external DPO gives privacy an owner without a new hire.
A request came in and nobody saw the 30 days pass.
Fix: Requests run on a 30-day due date with a clear badge, and one extension of up to 60 days is allowed.
See requests and breachesIf we had a breach tomorrow, would we know what to do?
Fix: A breach starts a live 72-hour clock, and the notices for the authority and, when the risk is High, for the people affected are generated.
See breach responseWhat it covers
What does a DPO as a service do? The privacy work, kept in one place.
Our experts can run the record of processing, DPIAs, processor agreements, requests and breaches in Data Privacy with you, and set up cookie consent with your web team. You see every record as it changes.
01 · Data Privacy
Who keeps the record of processing current?
Our experts keep the register with your business owners. Each activity has a reference such as PA-001, an owner who can answer a questionnaire link, a legal basis per applicable law and a next review date. Activities move through Draft, In Review, Approved and Needs Update.
See the privacy management software →02 · Data Privacy
When is a DPIA needed, and who runs it?
The built-in screener asks nine yes or no questions and says whether a DPIA is required or advisory. Our experts can run the DPIA with you from the same answers, and the TIA wizard covers transfers.
See DPIAs in Data Privacy →03 · TPRM
Which processors have a signed DPA?
Your processors are the third parties you already assess in TPRM. Each DPA is generated as a Word document, the signed copy is uploaded, and the supplier record shows a live DPA status.
See TPRM →04 · Data Privacy
Who answers requests and breaches in time?
Requests arrive through your Privacy Portal with a 30-day due date already set. A breach starts a live 72-hour clock, and the notices are generated as Word documents. Our experts can handle both with your team.
See requests and breaches →05 · Cookie Manager
Who sets up cookie consent?
Done with you: our experts set up the banner texts, categories and consent records with your web team, and your people publish each version. Every choice is kept as a consent record you can export.
See Cookie Manager →Aiko at your pace
Can AI help with the DPO work? Aiko suggests. A person approves.
Aiko suggests a category and purpose for an unknown cookie, and a person approves it. Ask it which requests are overdue or which breaches are still inside their notification window.
1Aiko proposes
Aiko suggestschat_prefBanner only · To review✓PreferencesKeeps the visitor’s chat widget settings✓A suggestion to check before you approve2You confirm
YouApprove into draft✓chat_pref · PreferencesCookies to review323You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Requests and breaches, from metadata
Aiko answers about processing activities, DSARs, breaches, DPIAs, DPAs and TIAs and their deadlines, without reading a requester’s name, email or message.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Who takes the DPO role? Our Swiss experts, on demand.
Extra hands to stay compliant all year: our experts run the register, requests and breach response with you, in Acuna GRC. Your people keep the decisions.
Legal and compliance expert
Laura Menetrey
Data protection law
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youDPO as a service
Our experts run it. You review.
DPO as a service, done for you
- Keep the record of processing and its reviews current
- Handle requests and breach response with your team
- Run DPIAs and processor agreements
Integrations
Can Acuna GRC keep our systems and people current? Yes, with 100+ connectors.
Connectors pull data from the identity, HR, cloud and service tools you already run, on a schedule, so the people and systems behind your processing activities stay current for your DPO.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra Directory
Entra ID
Okta
Google Workspace
Microsoft 365
Personio
AWS
Azure
Google Cloud
Jira
ServiceNow- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Where in Acuna GRC does the DPO work happen? Data Privacy, with the core around it.
The register, DPIAs, requests and breaches run in Data Privacy. TPRM brings your processors, Cookie Manager the consent records, and the core keeps findings and risks.
Add-on modules
DPO as a service connects to
- Data PrivacyRegister, requests, breaches
- Cookie ManagerConsent records
- TPRM (Supplier Shield)Processors and DPA status
- OperatePrivacy risks
- AssureFindings become issues
- AI GovernanceDPIA next to the AI impact assessment
- AikoAsk which requests are overdue
FAQ
What else do companies ask about an external DPO?
What is an external DPO?
A data protection officer you do not employ: a specialist who takes on the role from outside the company. In German-speaking Switzerland and Germany you will also read externer Datenschutzberater or externer Datenschutzbeauftragter.
Is a DPO mandatory?
Under the GDPR (art. 37), a DPO is required for public authorities and for organizations whose core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data or data on criminal convictions. Under the Swiss FADP, private companies have no obligation to appoint one: appointing a data protection advisor is optional (art. 10). A company whose advisor meets the conditions of art. 10 can consult the advisor instead of the FDPIC after a DPIA that shows a high risk (art. 23).
We already have a DPO. Is this for us?
Then Done with you fits: our experts give your DPO extra hands, in the same Acuna GRC workspace. Acuna GRC for DPOs
Who keeps the decisions?
Your people. Our experts run the register, requests and breach response with you, and your team decides.
Do the GDPR and the Swiss FADP need two registers?
No. Tick both laws in Comply, and one processing activity carries a legal basis for each. Swiss FADP compliance software
Can our DPO also be our CISO?
The GDPR lets a DPO take on other tasks only if they cause no conflict of interests (art. 38(6)). A role that decides how personal data is processed, as a CISO often does, can create one, so check it before you combine the two. Our CISO as a service is a separate service. CISO as a service
What does a DPO as a service cost?
It depends on your scope: the privacy laws that apply, the number of entities, how many processing activities and requests you handle and how much of the work our experts take on. Tell us your scope and we size the service with you.
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Need a DPO without hiring one? Start with one conversation.
Tell us which privacy laws apply and where your register stands. We show you how our experts would run the work in Acuna GRC, and what stays with your team.
Hosted in Switzerland, the EU or the US