The cost of a Data Protection Officer is the question that decides the internal-vs-external choice for most SMEs - and the headline numbers aren't close. A qualified internal hire runs €60,000-90,000 a year before training and cover; an external DPO delivers the same legal function for €150-1,500 a month. This guide breaks down what drives each figure, what's actually included, and how to run the comparison for your company. For the full picture, see the external DPO pillar.
- Internal DPO ≈ €60,000-90,000/year; external ≈ €150-1,500/month; ETHYX from €299/month.
- The internal figure hides costs: training, cover during leave, turnover, and conflict-of-interest risk.
- Compare on total cost and continuity, not just the monthly line item.
What Does a DPO Cost?
What are the realistic numbers?
These are practical market ranges, not regulatory benchmarks:
| Model | Typical cost | What's included |
|---|---|---|
| Basic external DPO | €150-500/month | Formal appointment, contact point, annual check |
| Full-service external DPO | €500-1,500/month | Documentation review, training support, incident handling |
| Internal DPO (full-time) | €60,000-90,000/year | Full-time capacity, but conflict risk and single point of failure |
| ETHYX model | from €299/month | External DPO + GDPR platform + EU AI Act coverage |
Why the Internal Figure Is Higher Than It Looks
What's hidden in a salary?
A DPO salary is only the visible part. Add recruitment and certification, training to keep current, cover during holidays and sick leave, and the cost of turnover if they leave. There's also a structural cost that doesn't show on a payslip: in an SME it's hard to give an internal DPO the independence GDPR requires (Art. 38) without a conflict of interest, because the obvious candidates - Head of IT, COO, HR - all have operational roles the DPO is meant to oversee.
How to Run the Comparison
What should I actually compare?
Compare total annual cost, not the monthly headline: an external engagement at €300-500/month is €3,600-6,000 a year against €60,000-90,000 for an internal hire. Then weigh continuity (an external provider doesn't take leave or resign mid-incident) and scope (does the price include documentation review and AI Act coverage, or just a nameplate?). Our external DPO guide sets out the same cost blocks in full, so you can run the numbers for your own headcount.
the ETHYX model bundles the external DPO, the platform and EU AI Act coverage from €299/month - replacing two or three separate providers with one predictable cost.