Privacy and DPO careers: stable demand, or a saturated market?

In the same London interview cohort, 128 of the 174 respondents sitting in in-house privacy, DPO or information-governance desks over a 24-month window told Sartori the designated-officer title is easy to find and the privacy-counsel seat is not. Of those 174, 61 were the designated DPO or a deputy. Forty-four of those 61 said their next move would not be another designated-officer title but an in-house privacy-counsel or Head of Privacy seat reporting to a general counsel or chief legal officer.

Sartori maps about 30,000 lawyers in London. Coverage is not the constraint. The constraint is that the 2018 appointment duty and the 2026 workstack no longer describe the same job. UK GDPR Article 37, in the revised text in force as at 9 September 2026, still requires the controller and the processor to designate a DPO where processing is by a public authority, or core activities require large-scale regular and systematic monitoring, or core activities are large-scale special-category or criminal-conviction data. A group may share one officer. The officer may be a staff member or fulfill the tasks on a service contract. Contact details must go to the Commissioner. None of that is a census of lawyer-grade seats a head of legal can open.

The ICO's DPO guidance, content dated 18 September 2023 and still posted in 2026, is blunt about the label: there must be an individual designated as the DPO even if a team supports the function, and other specialists are not referred to as your DPO. That is why the title feels saturated. Every public authority already made the appointment. Transport for London publishes a designated officer who manages a Privacy and Data Protection team covering the authority and subsidiaries including the underground operator, a Crossrail operator, a pension fund and a transport museum. The Greater London Authority shares one officer across the GLA, Assembly Members and the Greater London Returning Officer. Those are filled public-body desks, not open lawyer careers.

Law-enforcement competent authorities sit on a second statutory gate. Data Protection Act 2018 section 69, in force since 25 May 2018, requires a controller processing under the law-enforcement regime to designate a DPO unless it is a court acting judicially. Linklaters' Data Protected in the United Kingdom, last updated June 2026, restates that the Act does not impose additional appointment duties save for that law-enforcement regime. Police forces and the Crown Prosecution Service are public-body buyers, not a second private-practice product.

The title is common. The file is not. An information-governance manager at a London public authority told us the designated-officer post is occupied and has been since 2018; what they cannot hire on a Grade 7 package is a solicitor-grade in-house privacy counsel who will run the June 2026 complaints channel and still take the ICO's call. That is the saturation split in one sentence. NADPO describes its membership as information-governance practitioners from public, private and voluntary sectors, including administrators and lawyers, with no qualification required to join. The public-body DPO is often that practitioner, sitting with FOI rather than with a chief legal officer. The lawyer career sits one desk over.

ICO data-protection complaints were 33,753 in 2022/23, 39,721 in 2023/24 and 42,315 in 2024/25, the Information Commissioner's Annual Report for the year ended 31 March 2025 records. Article 15 subject-access work accounts for most of that caseload. Only 30.0 percent of complaints were assessed and responded to within 90 days against an 80 percent target. That series is a demand proxy for controller SAR and complaint handling — core designated-officer work — not a job-ad count. Q4 2025/26 then accelerated: the ICO's Performance and Impact Report for that quarter, dated 16 June 2026 in the file name, recorded the highest quarterly intake ever. Personal-data-breach notifications in the same quarter were 3,725, against 3,112 a year earlier. Full-year 2025/26 breach-report receipts increased by 40 percent.

DUAA is the live driver, not a sunset. ICO news on 19 June 2025 listed the Royal Assent changes: a data-protection complaints procedure; a new lawful basis for specified public-interest disclosures; ICO powers to compel interviews and request technical reports; PECR fines up to £17.5 million or 4 percent of global turnover. ICO's 5 February 2026 commencement statement brought most remaining data-protection provisions into force that day, holding the complaints procedure to 19 June 2026. SI 2026/82 is the commencement instrument. From 5 February 2026, interview notices under DUAA section 100 can require an individual employed by or concerned in the management of a suspected controller to attend and answer questions, with urgent notices after 24 hours. Privilege is carved out. False statements are an offense. That is mid-to-senior privacy-counsel work inside a general counsel team, and contentious data-protection work in the ranked firms those teams instruct.

PECR is no longer a £500,000 problem. ICO's Schedules summary, published 19 June 2025, states that Schedule 13 allows monetary penalties up to a maximum of £17.5 million for certain failures, removes the substantial-damage-and-distress threshold, and adds assessment notices, compelled witnesses and technical reports under PECR. Cookie exceptions in Schedule 12 cover statistical-use cookies, appearance and function preferences, emergency location and strictly necessary cookies; consent still applies to marketing cookies. For a head of legal in retail, publishing, betting or adtech, PECR stops being a junior compliance task and becomes counsel-grade ownership.

Children's privacy moved from policy writing to investigation counsel. ICO issued a £247,590 penalty to MediaLab.AI (Imgur) on 4 February 2026 and a £14,472,500 penalty to Reddit, Inc. on 23 February 2026, with an appeal to the First-tier Tribunal noted on 1 April 2026. Failings included no robust age assurance and no children's DPIA before January 2025. The 2024/25 annual report recorded two UK GDPR penalty notices totaling £3,826,320. The Reddit ticket is larger than that entire prior-year total. Ofcom's children's duties under the Online Safety Act require highly effective age assurance for specified user-to-user services. The Ofcom/ICO joint statement of 25 March 2026 agrees that self-declaration alone is not effective, and that if you cannot be sure of age commensurate with risk you apply Children's code standards to all users. Lewis Silkin, on 17 April 2026, reported Ofcom's first Online Safety Act financial penalty of £1 million on an adult-website provider. London privacy counsel now sits with trust-and-safety counsel on the same age-gate file.

AI is a second seat, not a replacement title. ICO consulted on draft automated decision-making guidance from 31 March to 29 May 2026, aimed at data protection officers, compliance professionals and technical leads. Bird & Bird's note on that package records the DUAA reframing of ADM from a prohibition-with-exceptions to a right of challenge with safeguards, and restates ICO's Recruitment Rewired finding that over 70 percent of organizations anticipate increasing AI and automation in recruitment over five years. ICO's technology guidance plan lists ADM final guidance for winter 2026, foundation-models guidance for summer 2026, and an agentic-AI consultation due September 2026. Taylor Wessing, on 19 August 2026, noted Commission and AI Office GPAI enforcement powers since 2 August 2026. UK-headquartered groups that place general-purpose models on the Union market need privacy and AI counsel in London coordinating with EU counsel. That overlaps the designated officer's DPIA file. It does not retire it.

The divergence thesis failed on a dated decision. Commission Implementing Decision (EU) 2025/2574 of 19 December 2025, published in the Official Journal on 23 December 2025, concluded that the UK continues to ensure an adequate level of protection after DUAA. Secondary restatements put the sunset at 27 December 2031. London in-house privacy counsel keep EU-transfer, SCC/IDTA and BCR files. There is no mass decommissioning of UK designated officers. Sartori's quarterly survey since 2019 finds London in-house privacy leads naming the DUAA complaints channel as the 2026 work that changed the seat, not a new wave of first-time DPO appointments.

Article 37(5) designates on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfill Article 39 tasks. The ICO says it does not specify the precise credentials; knowledge should be proportionate to the type of processing; sector knowledge is an advantage. Ninety-six of the 174 in-house privacy, DPO and information-governance respondents in the same London interview cohort held or were pursuing CIPP/E. That is a market signal, not a statutory gate. CIPM covers privacy-program administration. AIGP is the AI-governance overlay the 2025-26 IAPP report priced. FIP requires a CIPP plus CIPM, CIPT or AIGP, three years in which data privacy is at least 50 percent of job responsibilities, three peer references and a personal statement.

BCS Practitioner Certificate in Data Protection is the UK-centric applied exam: written to the Data Protection Act, syllabus v9.8 launched at the end of February 2025 and the only version bookable from 17 April 2025, 90-minute closed-book 40-question paper, pass mark 65 percent, UK exam price £230 including a £35 remote-proctoring fee, VAT extra. The qualification is not Ofqual-regulated. Classroom courses typically run three to five days. The syllabus learning outcomes include the designation, position and tasks of a data protection officer. Foundation Certificate maps to the Level 4 Data Protection and Information Governance Practitioner apprenticeship. That stack is how a non-solicitor information-governance lead evidences expert knowledge. It is not how an in-house privacy counsel evidences a practising certificate.

Two anonymized composites from the London associate book show the split in operating time. A London-headquartered user-to-user platform opened an in-house privacy-counsel seat after the December 2025 children's-code update, reporting to the general counsel, with age-assurance DPIA ownership and ICO-letter response. The search closed in eight weeks, inside the 6-to-12-week band; the candidate signed in 12 working days. No counter-offer landed. A London public authority opened a designated-officer replacement at Grade 7, combined with FOI. Two shortlisted lawyers withdrew for in-house privacy-counsel seats at product companies. The file restarted. That restart is one of the five privacy-desk searches in the 12-mandate subset that had to go back to the brief. The lesson is not that public-body DPO work is unserious. It is that the title and the pay spine have to be sold honestly, or the people who can hold the 2026 file leave the process.

A third composite: an FCA-authorized retail bank asked for one person as designated officer and privacy counsel. Independence and FCG 5 split the brief into a Risk designation that stayed put and a Legal privacy-counsel hire that closed. The head of legal already quoted above was not shopping a title. They were shopping PECR at GDPR-scale and ADM documentation a chief legal officer can defend. Candidates who want the in-house lawyer career should read what actually changes on an in-house move and, if the search is confidential, why a network is usually not enough for an in-house approach. Companies running the other side of the desk use in-house counsel recruiting. Nearly 1.5 million lawyer profiles are mapped globally; quarterly surveys have run since 2019. The London instrument on this page remains the one cohort.