Corporate · Privacy and data
A US CPO is an officer the company designs. A GDPR DPO is a statutory role with independence the company does not get to redesign.
Chief Privacy Officer is a company-designed officer, most often in the United States, who owns the privacy programme, the regulator relationship, and increasingly the AI overlay. A Data Protection Officer is a statutory designation under GDPR Articles 37 (when you must designate), 38 (position, including independence) and 39 (tasks). You may put both titles on one person. You may not collapse Article 38 independence because the US title is more familiar to the board.
Privacy and AI-governance searches run on a 19-day shortlist and a 9-week median to accepted offer. Officer-level CPO and DPO seats also sit inside the 41 compliance and regulatory leadership placements when they are officers. Specialist privacy counsel sits inside the 96 senior in-house counsel placements. Parent desks: compliance recruitment and in-house counsel recruiting.
| Question | GDPR DPO | US CPO |
|---|---|---|
| Legal basis | GDPR Arts. 37-39 | Company officer; CCPA/CPRA and sector overlay |
| Must you designate? | Art. 37: public body, large-scale regular monitoring, or special-category processing as core | No statutory 'must' at federal level; state and sector rules still bite |
| Independence | Art. 38(3): no instructions on Art. 39 tasks; cannot be dismissed for performing them | Company-designed; independence is a governance choice, not a statutory shield |
| Tasks | Art. 39: inform, monitor, advise DPIAs, cooperate with the authority, be the contact point | Programme ownership, regulator, product, increasingly AI |
| Reporting line we lock | Cannot be instructed on Art. 39 tasks; often a board or CEO line plus a working line to the GC | Often GC; CEO or committee when the board wants officer-grade independence |
| Degree | Expert knowledge of data-protection law; not a JD requirement | JD common, not required |
One person may hold both titles. The Article 38 independence test does not lapse because the US title is on the door.
Source: Regulation (EU) 2016/679, Arts. 37-39; Sartori briefing practice, 2026.
Sector landscape: cybersecurity and data privacy.
Privacy sits inside legal. The CPO is an officer of the legal department. Common in US groups where the GC already owns the regulator map. Risk: the DPO tasks in Article 39 cannot be instructed away if the same person is the DPO.
Independence is the test. Common where the audit committee or a privacy committee wants a line that does not run through the GC. ACC 2026: 40 percent of CLOs have majority oversight of privacy — which is not the same as owning the DPO.
Companies now ask for a CPO "who understands AI". That can mean three different seats. One: a CPO whose programme now covers training data, vendor models and an EU AI Act overlay — still a privacy officer, assessed on the privacy/AI clock (19 days / 9 weeks). Two: a privacy counsel intercept at a day-rate of $1,600-$2,800 while the officer search runs. Three: a standing Head of AI Governance, which is a different mandate on AI governance counsel.
The Brussels insurer brief was the first of those three: GDPR plus model-risk, bilingual shortlist, 8 weeks to accepted offer. We did not flatten it into legal operations, and we did not staff it as a CCO. Buyer guide: when to hire privacy and AI-governance counsel.
The $151,800 AI-governance-only figure is a self-reported base median. It is not a CPO bid.
| Measure | Figure | Base | Source |
|---|---|---|---|
| Privacy / AI-governance shortlist | 19 days | Sartori closed searches | Sartori, 2017-2026 |
| Privacy / AI-governance median offer | 9 weeks | Sartori closed searches | Sartori, 2017-2026 |
| Brussels insurer (GDPR + model-risk) | 8 weeks to accepted offer | One specialist mandate | Sartori vignette, of 96 specialist counsel |
| AI-governance-only median base | $151,800 (half sit below) | IAPP job family, self-reported base | IAPP Salary and Jobs Report 2025-26 |
| Privacy / AI intercept (day-rate) | $1,600-$2,800 | Sartori fractional/interim banding | Sartori, 2026 |
Officer CPO cash follows the company's officer band, not the IAPP AI-governance-only base median. Do not blend.
Source: IAPP Salary and Jobs Report 2025-26; Sartori & Partners FACTS ledger, 10 September 2026.
Timeline: 8 weeks to accepted offer.
Client references
First legal hire. They stopped us copying a listed-company GC job description. The counsel we hired still does commercial and privacy.
A US CPO is an officer the company designs; a GDPR DPO is a statutory role with independence under Articles 37 to 39. Article 37 sets when a DPO must be designated; 38 the position, including independence; 39 the tasks. You can hire one person into both, but the independence test does not go away because the US title is on the door.
No. GDPR requires professional qualifications and expert knowledge of data-protection law, not a law degree. We place lawyer and non-lawyer DPOs. The test is whether they can deal with the supervisory authority and with data subjects, which is Article 39, not a JD.
Report to the CEO or a board committee when independence is the test; report to the GC when privacy sits inside legal. A US CPO often reports to the GC. A GDPR DPO cannot be instructed on the tasks in Article 39. We lock the line in week 1 so the shortlist is not a mix of both designs.
Where the company ships or procures AI systems, the CPO brief now includes model-risk, training data and EU AI Act overlay. That overlay is a different product when it is a standing Head of AI Governance. See AI governance counsel and when to hire privacy and AI-governance counsel.
Privacy and AI-governance searches shortlist in 19 days, with a median accepted offer in 9 weeks. A privacy and AI-governance counsel search for an EU insurer in Brussels: GDPR plus model-risk, bilingual shortlist, 8 weeks to accepted offer. That is the specialist clock, not the GC clock.
IAPP's Salary and Jobs Report 2025-26 puts half of AI-governance-only respondents below $151,800 base, which we use as market context, not a bid. Officer CPO cash follows the company's officer bands, not that job-family median. We do not blend the two.
Yes. Specialist privacy and AI-governance counsel sit inside the 96 senior in-house counsel placements, on the specialist clock. CPO and DPO officer seats sit inside the 41 compliance and regulatory leadership placements when they are officers, or on the specialist clock when they are counsel. Sector: cybersecurity and data privacy.
Privacy officer
Articles 37-39 independence, or a US officer line. AI overlay named, not implied. No obligation.
