Data Protection Officer (DPO)

Title	Data Protection Officer (DPO)
Department	Privacy / Legal / Compliance
Reports to	[Board / General Counsel / Chief Privacy Officer]
Location	[Remote / Hybrid / On-site]
Employment type	Full-time
Salary	[Salary range. Postings with a range perform significantly better, and several states require one.]

Position overview

The Data Protection Officer (DPO) provides independent oversight of [Company]'s data protection compliance. As defined under GDPR Articles 37 to 39, the DPO monitors compliance, advises the organization, and serves as the contact point for supervisory authorities and data subjects.

The DPO partners with legal, privacy, security, IT, and business units to embed data protection by design, advise on data protection impact assessments, and support the exercise of data subject rights, while maintaining the independence the role requires.

As privacy regulation expands globally, the DPO serves as the organization's trusted authority on data protection compliance and the responsible handling of personal data.

Key responsibilities

Compliance monitoring

• Monitor compliance with the GDPR and applicable data protection laws.
• Advise the organization on its data protection obligations.
• Assess processing activities and records of processing.
• Report on the state of data protection to leadership and the Board.
• Maintain independence in performing the DPO role.

Advisory and DPIAs

Provide advice on data protection impact assessments and high-risk processing, including:

• When a DPIA is required and how to conduct it
• Assessment of risks to data subjects
• Mitigations and safeguards for high-risk processing
• Consultation with supervisory authorities where needed

Data subject rights

• Support handling of access, erasure, and other rights requests.
• Advise on lawful bases and consent management.
• Oversee response processes and timelines.
• Track and report on rights request volumes and outcomes.

Data protection by design

Advise on embedding data protection by design and by default into systems, products, and processes, including data minimization, purpose limitation, retention, and security safeguards.

Supervisory authority liaison

Serve as the contact point for supervisory authorities, cooperate on investigations and consultations, and act as the contact for data subjects on matters related to processing of their personal data.

Records and accountability

• Support records of processing activities (ROPA).
• Advise on data processing agreements and transfers.
• Assess vendors and processors for data protection compliance.
• Maintain documentation demonstrating accountability.

Awareness and training

Raise awareness of data protection across the organization through training, guidance, and staff education, and monitor the effectiveness of data protection controls.

Required qualifications

• Bachelor's degree in Law, Information Systems, Privacy, or a related discipline. Advanced degree a plus.
• 8 to 12+ years of experience in data protection, privacy, legal, or compliance.
• Expert knowledge of the GDPR and applicable data protection law.
• Experience advising on DPIAs and high-risk processing.
• Ability to operate independently and report to the highest level of management.
• Experience liaising with regulators or supervisory authorities preferred.

Preferred certifications

One or more of: CIPP/E, CIPM, CIPT, or ISO 27701 Lead Implementer or Lead Auditor.

Technical knowledge

GDPR and data protection law, data protection impact assessments, data subject rights, lawful bases and consent, records of processing activities, international data transfers, data processing agreements, privacy by design, ISO 27701, and vendor and processor assessment.

Essential competencies

Independence and objectivity, sound judgment, regulatory interpretation, stakeholder advisory, discretion and confidentiality, clear communication, and the ability to influence without authority.

Success measures: first 12 months

• Assess the maturity of the data protection program.
• Establish or refresh DPIA and high-risk processing procedures.
• Strengthen data subject rights handling and timelines.
• Support and validate records of processing activities.
• Advise on data protection by design in key initiatives.
• Establish the supervisory authority liaison process.
• Deliver data protection awareness and training.
• Build data protection reporting to leadership and the Board.

About [Company]

[Two or three sentences about your organization, the maturity of your program, and what the first year looks like. Candidates in this field respond to honesty about whether they are joining a build or an established function.]