Add-on service
DPO & compliance concierge
Most small businesses cannot justify a full-time data protection officer, but they do need someone to ask. The concierge gives you a named compliance contact, working through your register and answering questions in writing within one working day.
Best for: Businesses with 10–500 staff that have no in-house DPO or compliance lead, or one who is stretched across other duties.
What's included
- A named compliance contact who knows your register and sector
- Written answers to your questions within one working day
- Quarterly review of your AI tool register with written findings
- Review and mark-up of your AI usage policy and risk assessments
- Help drafting responses to client security and AI questionnaires
- A short written note after each review you can keep as evidence of oversight
- Escalation route: we tell you clearly when something needs a solicitor
What 'async' means in practice
You send questions by email or from the dashboard whenever they come up. We reply in writing, normally the same or next working day, with an answer you can forward internally. There are no scheduled calls to organise and no hourly billing to watch — questions are unmetered within fair use, which in practice means a few a week rather than a few an hour.
The quarterly register review
Every quarter we go through your AI tool register properly: new tools that have appeared, tools whose vendors have changed terms, classifications that no longer look right, and gaps between what your policy says and what your register shows. You get a written findings note with a short list of actions, which is exactly the kind of evidence a regulator looks for when asking whether oversight is real or theoretical.
- New and changed tools since the last review
- Classification changes and why they moved
- Documentation gaps with suggested wording
- A dated record of the review for your compliance file
What the concierge is — and is not
The £199/month concierge is an advisory service, not a statutory DPO appointment under UK GDPR Article 37 — a designated DPO must be independent, report to the highest management level and cannot be directed on how to do the job, none of which fits an unmetered advisory subscription. If your processing requires a formally designated DPO, we will tell you honestly, and we offer a separate appointed DPO service from £450/month with the independence, board reporting and ICO registration support the role legally requires. The concierge is also not legal advice: for enforcement action, contractual disputes or anything contentious, we point you to a solicitor and help you brief them so you spend less on legal fees, not more.
Common questions
Can this satisfy our statutory DPO requirement?
Not by itself — the concierge is advisory-only and a statutory DPO must act independently. Most SMEs do not need a designated DPO, but where the requirement applies we offer a separate appointed DPO service from £450/month with the independence and reporting duties the role involves. We will tell you honestly which situation you are in.
Do we need a Pro subscription as well?
The concierge works best alongside Pro, because the reviews run against your live register and alerts. It can be bought on its own if you keep your register elsewhere.
Not sure which you need?
Run the free AI register first — it takes about ten minutes and usually makes the answer obvious. Or tell us what you're dealing with and we'll point you at the right thing.
Not legal advice. Trestano provides governance tooling, documentation and practical guidance. It isn't a substitute for advice from a qualified solicitor or your own compliance team.