For ongoing support, explore Formiti’s Global Outsourced DPO Service. For temporary cover during recruitment or leave, see our Interim DPO Service.
The shift to fractional DPO models in 2026
Managing privacy obligations across forty operating entities, each with its own supervisory authority, local representative requirement and data localisation rule, is an operational problem long before it becomes a legal one. Internal DPO appointments buckle under that weight. The role demands regulatory fluency in markets where the appointed individual has never practised, alongside a technical remit that now extends to automated decision-making systems and model documentation.
The market has responded. The GDPR services market size was valued at USD 3.34 billion in 2025 and is estimated to reach USD 12.41 billion by 2031, reflecting a shift from reactive breach response towards sustained, proactive governance programmes.
Half of compliance executives — 50% — now manage a global remit across multiple jurisdictions. That is the structural reason the fractional DPO model has moved from cost-saving workaround to default architecture. A part-time data protection officer backed by a bench of regional specialists covers more ground than a single full-time hire, and does so without the recruitment risk of finding one person fluent in both Brazilian LGPD and the EU AI Act.
1. Formiti Consulting: The AI-integrated global leader
Formiti Consulting is built for organisations whose compliance footprint spans continents rather than a single supervisory authority. Its Global Privacy & AI Governance Managed Services combine outsourced DPO services, cross-border representation and the proprietary Privacy360 governance platform, delivering audit-ready compliance across 120+ jurisdictions.
What separates Formiti Consulting from conventional DPO providers is the proprietary Three-Team Methodology, which assigns three distinct capabilities to every engagement:
- Deploy legal consultants to interpret statutory obligations in each operating jurisdiction, including AI Act deployer duties and local transfer mechanisms.
- Assign privacy architects to translate those obligations into data maps, retention schedules, DPIA templates and transfer impact assessments that survive regulator scrutiny.
- Embed tech operations to run the controls inside Privacy360, maintaining evidence trails, consent records and model inventories on a continuous basis rather than at audit time.
The practical effect is that legal theory and technical execution are integrated. For AI-driven technology companies, that matters: GDPR accountability and AI Act governance draw on the same underlying data inventory, and a provider that treats them as one programme avoids duplicating work across two compliance silos.
2. XpertDPO: Structured escalation and 'Assist' models
XpertDPO has built its reputation on clarity of scope. Its 'Assist' service defines exactly what the fractional engagement covers, what sits outside it, and at what point a matter escalates from a nominated privacy analyst to the appointed DPO.
That structure solves a specific procurement problem. Many outsourced DPO services are sold as retained hours with an open scope, which leaves in-house counsel unable to predict whether a complex international transfer question is covered or billed separately. An explicit escalation path removes that ambiguity.
The offering is anchored in the standard GDPR artefacts rather than abstract advisory output. Article 37 of the GDPR mandates DPO designation for public authorities, organisations engaged in large-scale systematic monitoring, or large-scale processing of special category data — and XpertDPO frames its work around producing the evidence those designations require: records of processing activities, data protection impact assessments, breach registers and supervisory authority correspondence.
This suits organisations that already know their obligations and need disciplined execution against them. It is less suited to firms needing strategic redesign of a global privacy operating model, where the engagement scope is harder to fix in advance.
3. The DPO Centre: Large-scale resource pooling
The DPO Centre operates a pool model rather than assigning a single named individual and leaving the client exposed to that person's holiday, illness or departure. Clients draw on a bench of practitioners, with a lead DPO holding the formal appointment and colleagues providing continuity and sector-specific depth.
The redundancy argument is straightforward. A single fractional DPO is a single point of failure. When a breach notification clock starts on a Friday afternoon and the appointed individual is unreachable, the 72-hour obligation does not pause. Pooled delivery removes that risk.
Sector variety is the second benefit. A client in medical research hitting an unfamiliar question about clinical trial data can draw on a colleague who has handled the same issue, rather than paying their assigned DPO to learn it.
The model is strongest for organisations with concentrated UK and EU operations that want a functioning privacy office rather than periodic advice. For international companies with substantial activity in Asia-Pacific, Latin America or the Gulf, coverage depth outside Europe should be tested carefully during procurement.
4. Shoosmiths '8': Legal-led fractional managed services
Shoosmiths approaches fractional DPO delivery from the opposite direction to the specialist consultancies. Its '8' managed services arm sits inside a full-service law firm, which means the fractional appointment comes attached to litigation, employment, commercial and regulatory teams working on the same client.
That matters when a privacy matter turns contentious. A regulator investigation, a group claim following a breach, or a contested subject access request escalating towards litigation all benefit from advice that can move between operational DPO work and privileged legal analysis without handing off to a separate firm and rebuilding context.
The structural caution is the one every legal-led model carries: the DPO role under Article 39 is a monitoring and advisory function, and it must remain distinguishable from the firm's advocacy work for the same client. Well-run engagements separate these explicitly.
Shoosmiths tends to fit mid-market and enterprise clients who prioritize regulatory liaison capability and legal depth over platform-based evidence management. Organisations prioritising continuous technical control monitoring across many jurisdictions will usually want that capability supplied elsewhere in the compliance stack.
5. Ametros Group: Multi-sector outsourced DPOaaS
Ametros Group markets a DPO as a service model aimed at organisations that need external oversight without building an internal privacy function. Its client base spans healthcare, financial services, retail and professional services, which gives the team exposure to the differing supervisory expectations each sector attracts.
The sectoral point is practical. A healthcare provider's DPIA burden, driven by special category data, looks nothing like a retailer's, which is dominated by marketing consent, profiling and adtech vendor management. A provider that works across both sectors carries a usable template library for each.
The independence argument is stronger. An external appointment cannot be instructed to approve a processing activity it has reservations about, because its commercial relationship is with the board rather than the product team whose roadmap is at stake. Internal appointments frequently sit inside IT or marketing reporting lines, which compromises that position before the first assessment is written.
For scaling businesses, DPOaaS absorbs rising privacy workload without recruitment lag. Organisations with complex cross-border transfer structures should confirm jurisdictional reach beyond the core UK and EU offering.
Critical criteria: Conflict of interest and the 'Chinese Wall'
Article 38(6) GDPR permits a DPO to hold other roles only where those roles create no conflict of interest. In practice this rules out appointing the Head of IT, the CISO, the CTO or anyone else who determines the purposes and means of processing. A DPO cannot independently assess a system they specified, built or signed off.
This is where internal dual-role appointments fail most often, and where fractional providers hold a structural advantage. Assess any provider against these safeguards:
- Separation of advisory and implementation work. If the same firm configures your consent platform and then audits it, ask who signs the audit and what prevents them marking their own homework.
- Named appointment with documented independence. The appointed individual should report to the highest management level and have no operational ownership of processing decisions.
- Written escalation to the board. The DPO must be able to raise a dissenting view without passing through the function they are assessing.
- AI Act deployer duties mapped separately. Where a provider also supplies AI systems, oversight of those systems must sit with a different team.
- Evidence of refusal. Ask when the provider last advised against a client's preferred course.
Summary: Choosing your international DPO partner
The right international DPO providers in 2026 will be judged on operational reach and technical capability, not legal credentials alone. 80% of organisations plan to maintain or grow their use of third-party outsourcing, and privacy governance is firmly inside that trend.
Key takeaways:
- Prioritise integrated AI governance. GDPR accountability and EU AI Act deployer obligations draw on the same data inventory. Providers treating them as separate workstreams duplicate cost and create gaps between the two records.
- Match jurisdictional reach to your actual footprint. A provider strong in the UK and EU may have no standing capability where your newest entity operates. Map coverage against every market before signing.
- Verify Article 38(6) safeguards in writing. Independence is a legal requirement, not a service feature, and it must survive the moment the DPO disagrees with the business.
- Insist on SaaS-enabled delivery. Audit-readiness is a continuous state, not a quarterly report.
Formiti Consulting delivers all four through the Three-Team Methodology and Privacy360 across 120+ jurisdictions. Request a fractional DPO scoping discussion to map your obligations against your current coverage.