Corporate · Privacy and data

Chief Privacy Officer and Data Protection Officer search

A US chief privacy officer is an officer the company designs. A GDPR data protection officer is a statutory role with independence the company does not get to redesign.

Brief a search How we run a search

Lorenzo Sartori — Founder, Sartori & Partners Updated September 30, 2026 — Chief privacy officer search versus a GDPR data protection officer under Articles 37, 38 and 39.

A chief privacy officer search hires the officer who owns the privacy programme. A GDPR data protection officer is a separate seat under Articles 37, 38 and 39 (2016). Sartori & Partners, founded in 2017, maps 1,480,000+ lawyers. A May–June 2026 snapshot counts 1,136 law-firm compliance and regulatory specialists in the Washington DC metro. Among the six published corporate case studies, the privacy file is a first general counsel for a venture-backed SaaS company in California: shortlist on day 24, accepted offer in week 10, still in post at 24 months (September 2026).

01 Direct answer

A chief privacy officer search hires the officer who owns privacy. A data protection officer search designates the person GDPR Articles 37 to 39 require.

Chief Privacy Officer is a company-designed officer, most often in the United States, who owns the privacy programme and the regulator relationship. A Data Protection Officer is a statutory designation under GDPR Articles 37 (when a controller must designate), 38 (position, including independence) and 39 (tasks). One person may hold both titles. Article 38 does not yield because the US title is the one the board already knows.

The firm was founded in 2017. The research programme maps 1,480,000+ lawyers. The case studies publish a May–June 2026 snapshot of 1,136 law-firm compliance and regulatory specialists in the Washington DC metro, the largest single cluster in that map. That figure is the regulatory field in the firms, not a count of chief privacy officers placed.

The six published corporate case studies cover a first GC, a succession, a chief compliance officer search, a deputy GC, legal operations, and an interim GC. Privacy on a published file sits inside the California first-GC seat, described below. The statutory designation itself is on data protection officer search. Parent desks: compliance recruitment and in-house counsel recruiting.

Seats: US chief privacy officer, designed by the company. GDPR data protection officer, Articles 37-39 of Regulation (EU) 2016/679.
Map: 1,480,000+ lawyers on the research programme. 1,136 law-firm compliance and regulatory specialists in the Washington DC metro, May–June 2026.
Published privacy file: First general counsel, venture-backed SaaS, California: shortlist on day 24, accepted offer in week 10, still in post at 24 months. September 2026. Not a chief privacy officer search.
Reporting: CEO or a board committee when independence is the test. GC when privacy sits inside legal. Article 39 tasks cannot be instructed away.
Terms: Retained only. Fee 25-30% of total first-year compensation. Retainer 30% of the fee. 12-month replacement on GC/CLO/CCO terms; 6 months on other in-house searches.
Founded: Sartori & Partners, 2017. Company briefs start at the for-companies hub.

02 GDPR versus US officer

Articles 37 to 39 are statute. A chief privacy officer job description is not.

Chief privacy officer versus data protection officer, as we brief it. Statute on the DPO side. Company design on the CPO side.
Question	GDPR DPO	US chief privacy officer
Legal basis	GDPR Arts. 37-39, Regulation (EU) 2016/679	Company officer; state and sector privacy rules still apply
Must you designate?	Art. 37: public body, large-scale regular monitoring, or special-category processing as a core activity	No federal 'must designate.' State and sector rules still bind the programme
Independence	Art. 38: no instructions on Art. 39 tasks; not dismissed for performing them	Company-designed. Independence is a governance choice, not a statutory shield
Tasks	Art. 39: inform, monitor, advise on impact assessments, cooperate with the authority, be the contact point	Programme ownership, regulator, product, and any AI overlay the brief names
Reporting line we lock	Cannot be instructed on Art. 39 tasks. Often a board or CEO line, plus a working line to the GC	Often the GC. CEO or a committee when the board wants an officer line
Degree	Expert knowledge of data-protection law. Not a JD requirement	A JD is common. It is not required

One person may hold both titles. The Article 38 independence test does not lapse because the US title is on the door.

Source: Regulation (EU) 2016/679, Articles 37-39.

Sector landscape: cybersecurity and data privacy. ACC's 2025 Chief Legal Officer Survey names risk, compliance, data privacy and regulatory change as the issues chief legal officers rank first.

03 Reporting line

GC versus CEO is a design choice on a chief privacy officer. It is a statutory constraint on a data protection officer.

Report to the GC

Privacy sits inside legal. The chief privacy officer is an officer of the legal department. Common in US groups where the GC already owns the regulator map. Risk: Article 39 tasks cannot be instructed away if the same person is the data protection officer.

CEO

Report to the CEO or a committee

Independence is the test. Common where the audit committee or a privacy committee wants a line that does not run through the GC. We write that line in week 1, with the fee.

04 AI overlay

Privacy counsel who has never touched a model is not an AI-governance hire.

Companies ask for a chief privacy officer who “understands AI.” That sentence hides two seats. One is a chief privacy officer whose programme now covers training data, vendor models, and an EU AI Act overlay. The scorecard still tests privacy, and the AI work is named in week 1. The other is a standing head of AI governance, which is a different mandate on AI governance counsel.

We do not flatten either seat into legal operations, and we do not staff either as a chief compliance officer search. The September 2024 DOJ Evaluation of Corporate Compliance Programs is the lens for that officer, not for Articles 37 to 39. Buyer guide: when to hire privacy and AI-governance counsel.

05 Dated figures

The map, the May–June 2026 snapshot, and the clocks on the published files.

Each row is a figure already published on the research programme, the about page, or the case studies.

Dated figures used on this page. Each row is published on the research programme, the about page, or the case studies.
Measure	Figure	Window	Source
Lawyers mapped	1,480,000+	Research programme	Sartori research programme
Law-firm compliance and regulatory specialists, Washington DC metro	1,136	May–June 2026	Case studies hub
DC legal market	Second-largest in the country; ~80,000 lawyers in the region	Accessed June 2026	Georgetown Law
Privacy inside a published GC file, venture-backed SaaS, California	Shortlist on day 24; accepted offer in week 10; still in post at 24 months	September 2026	First-GC case study
Published chief compliance officer file, NYSE payments, New York	Shortlist in week 3; accepted offer in week 10	September 2026	CCO case study. A different seat
Retained fee	25-30% of total first-year compensation; retainer 30% of the fee	Current terms	Engagement terms
Replacement	12 months on retained GC, CLO and CCO searches; 6 months on other in-house searches	Current terms	Engagement terms

The 1,136 figure counts law-firm compliance and regulatory specialists. It is not a count of chief privacy officers. The California file is a first general counsel search in which privacy sat inside the seat.

Source: Research programme; case studies, May–June 2026 and September 2026; Georgetown Law, accessed June 2026; Regulation (EU) 2016/679.

1,480,000+: Lawyers on the research programme map.; Sartori research programme
1,136: Law-firm compliance and regulatory specialists, Washington DC metro.May–June 2026. Largest single cluster in that map.; Case studies
Day 24: Shortlist on the published California first-GC file, where privacy sat inside the seat.Accepted offer in week 10. Still in post at 24 months.; Case study, September 2026

06 Published files

Privacy on a published file sat inside a first general counsel seat. California. Day 24. Week 10.

Software · Venture-backed · California

First General Counsel, privacy inside the seatRead the case study

Situation: Revenue contracts, privacy reviews, and board packs were arriving faster than outside counsel could sit inside the business.
Approach: Mapped sitting deputy general counsel in California software. Briefed as a first general counsel who would own commercial work and a privacy programme, not as a standalone chief privacy officer.
Outcome: Shortlist on day 24. Accepted offer in week 10. Still in post at 24 months. At 90 days the hire had taken the first privacy programme to the board.

Timeline: Shortlist on day 24; accepted offer in week 10; still in post at 24 months.

AI governance counsel

When the standing seat is AI governance, not a chief privacy officer with an extra adjective.

AI governance search

Chief compliance officer search

NYSE-listed payments, New York: shortlist in week 3, accepted offer in week 10. The ECCP seat, not Articles 37-39.

Chief compliance officer search

For companies

The company hiring hub: GC, compliance, privacy, and legal operations.

Company hub

Chief Privacy Officer and DPO search — questions

What is the difference between a CPO and a DPO?

A chief privacy officer is an officer the company designs. A GDPR data protection officer is a statutory designation under Articles 37, 38 and 39 of Regulation (EU) 2016/679. Article 37 sets when a DPO must be designated, Article 38 the position including independence, and Article 39 the tasks. One person can hold both titles. Article 38 independence does not lapse because a US title is on the door.

Does a DPO have to be a lawyer?

No. GDPR requires professional qualifications and expert knowledge of data-protection law and practice, not a law degree. Article 39 is the test: dealing with the supervisory authority and with data subjects. We brief lawyer and non-lawyer data protection officers against that test.

Should the chief privacy officer report to the GC or the CEO?

Report to the CEO or a board committee when independence is the test. Report to the GC when privacy sits inside legal. A GDPR data protection officer cannot be instructed on the tasks in Article 39. We lock the line in week 1 so the shortlist is not a mix of both designs.

How does AI change a chief privacy officer search?

A chief privacy officer whose programme now covers training data, vendor models, and an EU AI Act overlay is still a privacy officer. A standing head of AI governance is a different mandate. See AI governance counsel and when to hire privacy and AI-governance counsel.

How long does a chief privacy officer search take?

We do not publish a chief privacy officer median. The privacy-related published file is a first general counsel for a venture-backed SaaS company in California: shortlist on day 24, accepted offer in week 10, still in post at 24 months (September 2026). The published chief compliance officer file, a different seat, is a NYSE-listed payments company in New York: shortlist in week 3, accepted offer in week 10.

What does a retained chief privacy officer search cost?

The fee is 25-30% of total first-year compensation, with a retainer of 30% of the fee paid at engagement. Retained GC, CLO and chief compliance officer searches carry a 12-month replacement. Other in-house searches carry 6 months. The letter states which window applies to this seat before anyone is called.

Do you also hire the surrounding privacy counsel?

Yes, as an in-house counsel search, distinct from the officer seat on this page. The statutory designation, the independence test, and the EU, UK and US seat design are on data protection officer search. Sector context: cybersecurity and data privacy. Parent desks: compliance recruitment and in-house counsel recruiting.

Sources

Figures on this page, and where they are published.

Sources

8 references

Privacy officer

Brief the chief privacy officer, or the data protection officer, as the seat it is.

Articles 37-39, or a US officer line, named in week 1. Fee 25-30% of total first-year compensation. The replacement window is in the letter before outreach.

Brief a search Talk to us

[email protected]