Cardiff is home to the Senedd, Welsh Government, NHS Wales bodies and national institutions, with the ICO's Wales office also in the city. For public bodies here, the DPO role has a language dimension that doesn't exist in England.
We provide outsourced DPOs to Welsh organisations, remotely and on a fixed monthly fee, with Welsh-language requirements built into how the service is delivered.
The Welsh Language Standards
Public bodies subject to the Welsh Language Standards must treat Welsh no less favourably than English. For the DPO function, that affects privacy notices, correspondence with data subjects and responses to people exercising their rights.
In practice, the DPO arrangement needs a route for Welsh-language correspondence that doesn't slow responses down — especially where statutory deadlines apply, such as the 72-hour breach reporting window.
Community councils are exempt
The Data Protection Act 2018 excludes community councils in Wales from the definition of public authority for these purposes. Town and community councils still have to comply with UK GDPR, but they don't have to appoint a DPO. Many benefit from occasional expert advice instead.
NHS Wales and health boards
Wales' seven local health boards and NHS trusts are public authorities with mandatory DPOs, as are GP practices providing NHS services. Practices commonly share a DPO, which UK GDPR permits for public authorities.
Sectors we support in Wales
Welsh public bodies
Councils and national bodies with Welsh Language Standards obligations.
NHS Wales
Health boards, trusts and GP practices.
Town and community councils
Exempt from the DPO requirement, but still subject to UK GDPR.
Employers across South Wales
Private organisations seeking voluntary DPO advice.
How our outsourced DPO service works
- A free 30-minute consultation to understand your organisation, your processing and whether a DPO is mandatory for you.
- A clear proposal with a single fixed monthly fee, based on your size and complexity. No hidden costs.
- Your named DPO in place within 48 hours, with the ICO notified of their contact details.
- Ongoing support: monthly reporting, policy oversight, breach readiness and direct access to your DPO.
Every engagement runs on rolling monthly terms, with no long-term contract.
DPO consultancy without an appointment
Not every organisation needs a formal DPO. If the mandatory triggers don't apply to you, our DPO consultancy gives you the same expertise on the specific areas you need — a compliance gap analysis, DPIAs for new projects, policy reviews, breach response support or staff training — without the statutory obligations that come with appointing a DPO.
Town and community councils in Wales — exempt from appointing a DPO — commonly use our consultancy for policies, subject access handling and councillor training.
Need a DPO in Wales?
Book a free 30-minute consultation. We'll tell you whether a DPO is mandatory for you and what the right arrangement looks like. No obligation.
Book Your Free DPO Consultation →or call 01244 261 379Frequently asked questions
Do Welsh public bodies need their DPO to work in Welsh?
Where a body is subject to the Welsh Language Standards, its communications with the public — including privacy notices and data protection correspondence — must meet them. The DPO arrangement needs to support that.
Does a town or community council in Wales need a DPO?
No. Community councils in Wales are excluded from the public authority definition for these purposes, although they still have to comply with UK GDPR.
Do GP practices in Wales need a DPO?
Yes. Practices providing NHS services are public authorities and must appoint a DPO, which can be shared between practices.