| Title | Chief Privacy Officer |
|---|---|
| Reports to | [CEO / General Counsel / Chief Risk Officer / other executive] |
| Location | [Remote / Hybrid / On-site and location] |
| Employment type | Full-time |
| Salary | [Good-faith salary range, incentive and material benefits] |
Position overview
[Company] is hiring a Chief Privacy Officer to set and lead our enterprise privacy strategy. The CPO will establish how the organization governs personal data across products, operations, workforce systems, vendors, analytics and artificial intelligence.
As the senior privacy executive, the CPO will advise leadership and the board, lead the privacy organization and align Legal, Security, Data, Product, Engineering, HR, Marketing, Procurement, Audit and AI Governance around clear accountability. The position requires deep privacy judgment and the ability to build an effective, appropriately resourced program.
Key responsibilities
- Set enterprise privacy strategy, governance, risk appetite and priorities.
- Maintain the privacy framework, policies, controls and operating model.
- Lead regulatory readiness across [jurisdictions and sectors].
- Oversee product privacy, assessments, rights, data inventories, vendors and incident coordination.
- Sponsor privacy engineering and privacy-enhancing capabilities.
- Govern privacy risk in analytics, automated decisions and AI systems.
- Define decision rights, escalation and risk-acceptance processes.
- Report material privacy risk and program performance to executives and the board.
- Engage regulators, customers and external stakeholders on significant matters.
- Lead the privacy team, budget, technology portfolio and outside advisers.
- Coordinate with the DPO while respecting the DPO's legally required independence, if applicable.
Required qualifications
- [Ten or more] years of progressive experience across privacy, legal, compliance, risk, security, data governance or related fields.
- Significant experience leading an enterprise or global privacy program.
- Demonstrated executive and board communication on material risk.
- Experience building teams, allocating resources and leading through regulatory change or incidents.
- Strong working knowledge of privacy laws relevant to [Company].
- Technical and business fluency sufficient to advise on products, data and AI.
- Record of influencing senior stakeholders and resolving difficult cross-functional decisions.
Preferred certifications
CIPP and CIPM; CIPT, CDPSE, AIGP or FIP where relevant. JD and active bar membership if the role will also perform legal duties.
Preferred experience
- Experience in [industry], [jurisdictions] and organizations of comparable scale.
- Prior regulator engagement, major incident leadership or transformation experience.
- Experience integrating privacy with security, data and AI governance.
Technical knowledge
GDPR, CCPA / CPRA, HIPAA, EU AI Act, privacy impact assessments, data mapping, records of processing.
Essential competencies
Analysis, documentation, judgment, cross-functional collaboration, and clear communication of privacy risk.
Success in the first year
- Leadership agrees on privacy risk, priorities, accountability and investment.
- The program has a credible roadmap and measures outcomes rather than activity alone.
- High-risk product, data and AI decisions receive timely executive attention.
- Material issues are transparent, owned and progressing toward resolution.
- The privacy organization has the talent, technology and authority to operate effectively.
- Board reporting is concise, decision-oriented and connected to enterprise risk.
About [Company]
[Two or three sentences about your organisation, the maturity of your program, and what the first year looks like. Candidates in this field respond to honesty about whether they are joining a build or an established function.]
Post this role on GRC Careers
Reach professionals who specialize in enterprise privacy leadership rather than hoping they find you in a general feed. A person reviews every posting before it goes live, usually within one business day.
See how others are hiring
Review open Privacy jobs to benchmark scope, level, and posted pay before you publish yours.
Stay close to the market
Job alerts
Get new Privacy jobs sent to you as they post.
Newsletter
Hiring trends, salary signals, and new templates from GRC Careers.
Frequently asked questions
What does a Chief Privacy Officer do?
The Chief Privacy Officer sets the organisation's privacy strategy, governance and priorities. They own the privacy framework and operating model, lead readiness for new laws, oversee product privacy, rights requests, data inventories, vendors and incident response, and govern privacy risk in analytics and AI.
Is a Chief Privacy Officer the same as a Data Protection Officer?
No. The Data Protection Officer is a role defined by Articles 37 to 39 of the GDPR, with set tasks, direct reporting to the highest management level and protection from instructions on those tasks. Some organisations give the CPO the DPO designation as well; if they do, the GDPR's independence and conflict-of-interest rules apply to that part of the job.
Does a Chief Privacy Officer need to be a lawyer?
Not necessarily. Many CPOs come from legal, compliance, risk or security backgrounds. A law degree and active bar membership matter if the CPO will also give legal advice; otherwise legal interpretation can come from privacy counsel.
Who does a Chief Privacy Officer report to?
Usually the CEO, the General Counsel, the Chief Risk Officer or another executive, and the role briefs the board on material privacy risk. Name the reporting line in the posting.