Our GDPR data protection officers take on the DPO mandate under Art. 37 GDPR for Swiss and EU companies, with the required expertise and independence, before supervisory authorities in DE, AT, IT, ES, NL and other member states. As an outsourced DPO we work for a fixed fee and are available immediately.
Working for regulated industries and SMEs
Data protection and privacy are fundamental rights in the EU (Art. 7, 8 Charter), and have long been a business necessity.
Art. 37(1) GDPR makes the designation of a DPO mandatory in three situations:
In addition, there are national opening clauses. Example Germany: from 20 employees engaged in automated processing. We assess your obligation in the initial consultation.
Full-scope DPO mandate under Art. 39 GDPR, advising, monitoring, cooperating.
The effort varies considerably depending on company size, sector and IT complexity. Reference values:
With an external mandate, you pay only for the hours used, without recruiting, training, backup and social-insurance overhead.
Standard · SME
from CHF 600 / month
Fixed quarterly mandate: half a day per quarter plus availability. Additional tasks at an hourly or daily rate.
Premium
Annual quota custom
Flexible hourly quota from 30 h. Ideal for SMEs with 150–500 employees or DPIA needs.
Digital service agreement defining the scope of services as DPO under Art. 37 GDPR.
Workshop to get acquainted, align expectations, and define next steps.
Inventory of data-protection-relevant processes, systems and documents.
Action plan: privacy notices, ROPA, DPIAs, data processing agreements, internal policies.
Support through advice, training, audits and communication with authorities.
Dedicated point of contact, with ongoing monitoring and updating.
A DPO mandate under Art. 37 GDPR only holds up when expertise, independence and auditable evidence come together, and this is precisely where SIDD makes the difference.
Your DPO holds a doctorate in law, is CIPP/E-certified and admitted to the bar (New York, UK), backed by an in-house InfoSec team. This allows us to assess processing operations, data processing agreements and DPIAs not only on legal grounds but also on a technically robust basis, with no need to buy in external expertise.
Where Dr Staiger acts as an attorney, your information is covered by professional secrecy under Art. 321 SCC, in addition to the DPO's duty of confidentiality under Art. 38(5) GDPR. An in-house DPO cannot offer this twofold protection.
We hold DPO mandates in DE, AT, IT, ES, NL and other EU countries, including Swiss dual mandates under the revised FADP and the GDPR. A single point of contact for correspondence with the respective competent supervisory authorities, instead of a separate provider for each country.
We maintain the records of processing activities (ROPA) (Art. 30), DPIAs and measures in our own Priverion Platform. In the event of an authority request, the evidence is available as maintained, auditable tooling rather than a scattered collection of documents.
You appoint a certified role on a fixed mandate from CHF 600/month and pay for hours actually used, with no recruiting, training, backup or social-insurance overhead. If an individual DPO is unavailable, the team keeps the mandate continuously covered.
We have been handling DPO mandates since 2017, with a high renewal rate, a dedicated contact person and an initial response within 24 hours. We take over existing mandates from in-house roles or other providers during ongoing operations.
Instead of creating an in-house role, you outsource the data protection officer mandate to SIDD. As your outsourced DPO we take on the duties under Art. 37 to 39 GDPR for a fixed fee, with a named contact and immediate availability.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For the DPO mandate, concretely, LexCommand keeps research scoped to each member state so your Art. 30 register and every DPIA rest on the correct national version with a link to the primary source, and on a Swiss double mandate it surfaces the FADP and GDPR duties side by side.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
We handle DPO mandates in DE, AT, IT, ES, NL and other EU member states. For Swiss dual mandates, see DPO Switzerland.
Standard from CHF 600/month, Premium individually priced with an annual hour allowance. Group mandates on request.
Yes. We take over DPO mandates from in-house roles or other providers and continue ongoing operations.
Possibly. These are two distinct roles with different legal bases (Art. 27 vs. Art. 37 GDPR). See EU Representative.
The company remains responsible for the processing (Art. 5 GDPR). The DPO is not personally liable for data protection breaches, we minimise the risk through documented processes, training and an incident playbook.
Yes, Art. 321 SCC. In addition, the DPO is bound by the duty of confidentiality under Art. 38(5) GDPR.
We will calculate the right solution for you, or book a 15-minute initial call with Dr Staiger directly.