Last updated: 11 November 2026
Quick answer: GDPR compliance services for MSPs are recurring privacy services, such as gap assessments, records of processing, data subject request handling, breach support, vendor reviews and external DPO cover, delivered to clients alongside IT and security. To offer them credibly, an MSP must first meet its own processor duties under GDPR Article 28.
Most MSP clients already rely on their provider for backups, access control and incident response. Those are all GDPR topics. The gap is usually the paperwork and governance that turn good IT practice into provable compliance.
This guide explains where an MSP sits under GDPR, which services it can package, where the legal boundaries are, and how to run a privacy practice across many clients without drowning in spreadsheets.
What are GDPR compliance services for MSPs?
They are services that help clients meet the accountability principle in Article 5(2) of the GDPR: being responsible for, and able to demonstrate, compliance. For an MSP, that means combining technical controls you already run with the records, assessments and processes regulators ask for.
Typical service lines include:
- GDPR gap assessments and remediation roadmaps.
- Building and maintaining the record of processing activities (ROPA) under Article 30.
- Privacy policies, notices and retention schedules.
- Handling data subject requests within the one-month deadline in Article 12(3).
- Breach assessment and support for the 72-hour notification under Article 33.
- Supporting DPIAs for new systems and projects.
- Vendor and processor due diligence.
- Acting as external DPO where the client needs one (Article 37(6)).
Demand is steady because enforcement is. GDPR fines reach EUR 20 million or 4% of worldwide annual turnover for infringements of the core principles and data subject rights (Article 83(5)), and EUR 10 million or 2% for controller and processor obligations such as security and breach notification (Article 83(4)).
Is the MSP a processor, a controller or both?
Usually both, for different data. When you manage a client’s systems and can access the personal data in them, you are normally a processor acting on the client’s instructions. For your own staff, sales contacts and billing data, you are a controller.
The EDPB’s Guidelines 07/2020 on controller and processor explain that the distinction depends on who decides the purposes and essential means of processing, not on what the contract says. Article 28(10) adds a warning: a processor that starts deciding purposes and means on its own is treated as a controller for that processing.
Common mistake: Using client monitoring or ticket data to train internal tools or for marketing without a clear basis. That can turn the MSP into a controller for that processing, with all the obligations that follow.
What must an MSP get right for itself first?
Clients and their auditors will check your own house before they buy privacy services from you. As a processor, your core obligations are:
- A compliant processing agreement (Article 28(3)). It must cover documented instructions, confidentiality, security, sub-processors, assistance with data subject rights and DPIAs, deletion or return of data at the end of the service, and audit rights. The Commission has published standard contractual clauses for controllers and processors (Implementing Decision (EU) 2021/915) that you can use as a baseline.
- Sub-processor control (Article 28(2) and (4)). Get prior written authorisation for the tools and data centres you use, flow down the same obligations and tell clients about changes.
- Processor records (Article 30(2)). Keep a record of processing carried out on behalf of each controller, including transfers outside the EEA.
- Security of processing (Article 32). Implement and document appropriate technical and organisational measures.
- Breach notice to the client (Article 33(2)). Notify the controller without undue delay after becoming aware of a personal data breach, so the client can meet its own 72-hour deadline.
In practice: Publish a sub-processor list, a security summary and your standard DPA on your website. It shortens every sales cycle and doubles as a template for the service you will sell.
How can an MSP package GDPR services?
Tiering keeps scope clear and makes the service easier to sell. The table shows one way to structure it; adjust the content to your clients and skills.
| Tier | Typical deliverables | Main GDPR articles |
|---|---|---|
| Foundation | Gap assessment, ROPA, core policies and notices, retention schedule, staff training | 5, 12-14, 30, 32, 39(1)(b) |
| Operational | Data subject request handling, breach triage and notification support, vendor reviews, DPIA support | 12, 15-22, 28, 33-36 |
| Advisory or vDPO | Designated external DPO, board reporting, regulator liaison, annual compliance review | 37-39 |
How to price without guesswork
Most MSPs use one of three models: a monthly retainer per client tier, a per-employee or per-entity fee, or project fees for one-off work such as an initial gap assessment. Whichever you choose, tie the fee to defined deliverables and response times, and price extra work such as a large access request or a major breach separately.
Where the vDPO tier fits
Article 37(6) allows the DPO to be an external provider under a service contract, with the same independence and resources as an internal DPO. Regulators check this: the EDPB’s coordinated enforcement action on DPOs, involving 25 supervisory authorities, found cases of insufficient resources and lack of independence. Staff the tier with qualified people and give them direct access to client management.
If you want to see how one platform can run these tiers for every client, book a partner demo and we will walk through a multi-client set-up.
What are the legal and liability boundaries?
An MSP can run a privacy programme, but it cannot take over the client’s legal responsibility. Under Articles 5(2) and 24, the controller remains accountable, so your contract should say clearly who decides and who executes.
- Legal advice: unless you are a law firm, frame outputs as compliance support and refer contentious questions, such as litigation or complex transfers, to counsel.
- Conflicts: if you act as DPO and also run the client’s IT, the DPO will be reviewing your own work. Assess this case by case, and consider separating the DPO role from the delivery team.
- Insurance: check that professional indemnity and cyber cover extend to privacy advisory work.
- Evidence ownership: keep records in a place the client can access and export, so they are not locked in if the contract ends.
Common mistake: Promising “GDPR compliance” as an outcome. No provider can guarantee it. Sell defined activities, deliverables and service levels instead.
How do you deliver GDPR services across many clients?
The economics of an MSP privacy practice depend on reuse. Fifty clients with fifty separate spreadsheets do not scale; one method, one set of templates and one system of record do.
Standardise the work
- Use the same questionnaire to build every client’s ROPA, then tailor it.
- Keep policy templates in one library and version them per client.
- Run the same breach playbook with client-specific contacts and regulators.
- Track every data subject request against its deadline, including the possible two-month extension under Article 12(3).
Reuse security work
Many GDPR Article 32 controls are the same controls clients need for NIS2 or ISO 27001. Map them once and reuse the evidence. Managed service providers are themselves a regulated sector under NIS2, so your own security programme can feed directly into the GDPR evidence clients ask for.
Watch where regulators are looking
Supervisory authorities coordinate their priorities. The EDPB’s 2025 coordinated action focused on the right to erasure, with 30 authorities and the EDPS taking part. Deletion across backups, SaaS tools and archives is exactly the kind of work an MSP is well placed to help with.
A launch checklist for your GDPR service
- Update your own DPA, sub-processor list and Article 30(2) records.
- Define two or three service tiers with named deliverables and SLAs.
- Decide who in your team is qualified to act as DPO, and document their expertise.
- Prepare templates: ROPA questionnaire, DPIA, request log, breach log, policy set.
- Agree escalation routes to legal counsel for issues outside your remit.
- Choose one platform to hold records for every client, with client access.
- Pilot with two or three existing clients, then refine scope and pricing.
For more detail on combining privacy and security offerings, see our articles on running vCISO and vDPO services from one console and common GDPR compliance mistakes.
Key takeaways
- An MSP is usually a processor for client data and a controller for its own; get your Article 28 house in order first.
- Package GDPR work in clear tiers: foundation, operational, and advisory or vDPO.
- Sell defined deliverables and service levels, never guaranteed compliance.
- Reuse security controls and evidence across GDPR, NIS2 and ISO 27001.
- A single multi-client system of record is what makes the practice profitable.
Frequently asked questions
Can an MSP act as a client’s Data Protection Officer?
Yes. GDPR Article 37(6) allows the DPO to fulfil the tasks under a service contract. The MSP must provide someone with expert knowledge of data protection law and practice, respect the DPO’s independence and avoid conflicts of interest. If the MSP also runs the client’s IT, assess whether the DPO would be reviewing the MSP’s own decisions.
Do MSPs need a data processing agreement with every client?
Yes, wherever the MSP processes personal data on the client’s behalf, which covers most managed IT services. Article 28(3) requires a contract or other legal act setting out instructions, confidentiality, security, sub-processor rules, assistance duties, deletion or return of data and audit rights. The Commission’s 2021 standard clauses are a practical starting point.
What GDPR services are easiest for an MSP to start with?
Services closest to existing IT work are the easiest: security of processing documentation under Article 32, breach triage and notification support, backup and deletion processes, and vendor reviews. Building the record of processing activities is a natural next step because the MSP already knows the systems, data flows and suppliers involved.
Is an MSP liable if a client breaches GDPR?
The client, as controller, remains accountable for its own compliance. An MSP acting as processor can be liable for breaching its own processor obligations or acting outside the client’s lawful instructions, and Article 82 allows data subjects to claim compensation from processors in those cases. Clear contracts and documented instructions limit disputes.
Turning privacy into a recurring service line
GDPR compliance services let MSPs add recurring value to work they already do, provided the scope, contracts and evidence are right. Start with your own processor obligations, package services in clear tiers and run every client on one method.
Enactia, the GRC platform for vCISO and vDPO services, is multi-tenant and white-label, with all modules and unlimited users for a flat fee per active client organisation. Explore Enactia for MSPs, contact us or book a partner demo.
This article is for general information and is not legal advice.
