How to outsource a data protection officer — scope the mandate, test providers, define representative roles, onboarding rhythm and AI governance fit.