| Title | Data Protection Officer |
|---|---|
| Reports to | Highest management level: [Board / CEO / equivalent] |
| Employment type | Full-time |
| Salary | [Good-faith range or commercial terms] |
Position overview
[Organization] is appointing a Data Protection Officer to perform the advisory, monitoring and liaison tasks established by applicable data-protection law. The DPO will report directly to the highest management level, receive timely access to matters involving personal data and perform DPO duties independently.
The organization remains accountable for compliance and for decisions about the purposes and means of processing. The DPO advises, monitors and escalates; the DPO does not assume management's legal responsibility.
Key responsibilities
- Inform and advise the organization and its employees about data-protection obligations.
- Monitor compliance with applicable law, policies, assigned responsibilities, training and audits.
- Advise on data protection impact assessments and monitor their performance.
- Cooperate with supervisory authorities and act as their contact point.
- Serve as an accessible contact point for individuals on data-protection matters.
- Report significant concerns to the highest management level.
- Monitor privacy risk, incidents, complaints, remediation and program effectiveness.
- Maintain awareness of processing operations, information systems and regulatory change.
Required qualifications
- Expert knowledge of data-protection law and practice appropriate to the organization's processing, sector and risk.
- Substantial experience advising on or monitoring privacy programs.
- Ability to exercise independent judgment and communicate concerns to senior leadership.
- Experience with DPIAs, audits, incidents, complaints and regulatory engagement.
- Working understanding of information systems, security, data governance and the organization's operations.
- Professional discretion, integrity and credibility.
Preferred certifications
CIPP/E and/or CIPM, while recognizing that the GDPR does not mandate a particular certification.
Preferred experience
- Prior DPO, Deputy DPO, senior privacy counsel, audit or privacy-leadership experience.
- Experience in [industry] and across [relevant jurisdictions].
- Relevant language skills.
Technical knowledge
GDPR, UK GDPR, CCPA / CPRA, ISO/IEC 27701, privacy impact assessments, data mapping, records of processing.
Essential competencies
Analysis, documentation, judgment, cross-functional collaboration, and clear communication of privacy risk.
Success in the first year
- Confirm the appointment's scope, resources, reporting and conflict safeguards.
- Establish direct access to the highest management level and a regular reporting cadence.
- Assess program effectiveness and prioritize material gaps.
- Review the DPIA, incident, complaint, training and monitoring arrangements.
- Build effective working relationships with management and supervisory authorities while preserving independence.
About [Company]
[Two or three sentences about your organization, the maturity of your program, and what the first year looks like. Candidates in this field respond to honesty about whether they are joining a build or an established function.]
Post this role on GRC Careers
Reach professionals who specialize in statutory data protection oversight rather than hoping they find you in a general feed. A person reviews every posting before it goes live, usually within one business day.
See how others are hiring
Review open Privacy jobs to benchmark scope, level, and posted pay before you publish yours.
Stay close to the market
Job alerts
Get new Privacy jobs sent to you as they post.
Newsletter
Hiring trends, salary signals, and new templates from GRC Careers.
Frequently asked questions
What does a Data Protection Officer do?
Under Article 39 of the GDPR, the DPO informs and advises the organization and its staff about their data-protection obligations, monitors compliance (including responsibilities, training and audits), advises on data protection impact assessments, cooperates with the supervisory authority and acts as its contact point.
When is an organization required to appoint a DPO?
Article 37 of the GDPR requires one where processing is carried out by a public authority or body (except courts acting judicially), where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large-scale processing of special categories of data or criminal-offense data. Member State law can add further cases.
Who does a Data Protection Officer report to?
Article 38 of the GDPR requires the DPO to report directly to the highest management level, to receive no instructions on how to carry out DPO tasks, and not to be dismissed or penalized for performing them.
Does a DPO need a certification?
No specific certification is required. Article 37 says the DPO is chosen for professional qualities and expert knowledge of data-protection law and practice. CIPP/E and CIPM are common ways to show that knowledge.
Can the DPO be an outside contractor?
Yes. Article 37 allows the DPO to be a staff member or to perform the tasks under a service contract. Any other duties the DPO holds must not create a conflict of interest (Article 38).