Corporate · Privacy and data

Data protection officer search

DPO recruitment under the GDPR and the UK GDPR is a designation with an independence rule. A US chief privacy officer title does not supply that rule.

Brief a search How we run a search

01 Direct answer

Data protection officer search fills the statutory seat. A privacy counsel recruiter brief does not.

Lorenzo Sartori — Founder, Sartori & Partners Published September 30, 2026 — DPO recruitment is a data protection officer search under GDPR Articles 37 to 39, not a US chief privacy officer title.

DPO recruitment, also called a data protection officer search, is what a privacy counsel recruiter runs when GDPR and UK GDPR Articles 37 to 39 require a designation, not a US chief privacy officer. Sartori & Partners has completed 36 compliance and regulatory leadership placements since 2017, including DPO and CPO seats: 19 days to shortlist and 9 weeks median to an accepted offer. An Euronext-listed insurer in Brussels hired privacy and AI-governance counsel in 8 weeks. IAPP's 17 September 2025 infographic: North America median base $190,000, Europe $112,000, average CPO base $280,000.

A company under the GDPR or the UK GDPR does not design this seat the way it designs a chief privacy officer. Article 37 states when a controller or a processor must designate a data protection officer. Article 38 fixes the position: resources, no instructions on the tasks, no dismissal or penalty for performing them, a report to the highest management level, and no conflicting duties. Article 39 fixes the tasks. Putting a US title on the same person does not switch those articles off.

The mandate is the designation, or the head of privacy when the board uses that title for the same statutory job. A chief privacy officer the company invents, with no Article 52 constraint, is a different search. So is privacy counsel who reports to the general counsel, practices law for the company, and is not the designated officer. Name the product before the shortlist is built. The officer seat is chief privacy officer search. The decision of which product to open is the guide on when to hire privacy and AI-governance counsel.

Officer DPO and CPO seats sit inside 36 compliance and regulatory leadership placements since 2017. Privacy counsel who are not designated sit inside 87 senior and specialist placements. Both use the privacy and AI-governance clock: 19 days to a shortlist, 9 weeks median to an accepted offer, 2017-2026. Parents: compliance recruitment and in-house counsel recruiting. Sector: cybersecurity and data privacy.

The seat: Statutory DPO under GDPR and UK GDPR Articles 37-39. Not a US chief privacy officer the company designs.
Clock: Privacy and AI-governance searches: 19 days to shortlist, 9 weeks median to an accepted offer, 2017-2026.
Where it sits: Officer DPO and CPO seats are inside 36 compliance and regulatory leadership placements since 2017. Non-officer privacy counsel are inside the 96.
Independence: No instructions on Article 39 tasks. No dismissal or penalty for performing them. No duty that determines purposes and means.
Degree: Article 37(5): expert knowledge of data-protection law and practices. A law degree is not required.
Pay context: IAPP infographic, 17 September 2025: Europe median base $112,000; North America median base $190,000. CPO average base $280,000 is not a DPO bid.

02 Independence

Article 38 is the rule. A reporting line in a job description is not a substitute.

Article 38(3) forbids instructions on the Article 39 tasks, forbids dismissal or penalty for performing them, and requires a report to the highest management level. Article 38(6) allows other tasks only if they do not conflict. Article 37(7) requires the contact details to be published and sent to the supervisory authority.

WP 243 rev.01, endorsed by the European Data Protection Board, states the conflict test: the officer cannot hold a position that determines the purposes and means of processing. The rule of thumb names the chief executive, chief operating, chief financial and chief medical officers, and the heads of marketing, human resources and IT, plus any lower role that determines purposes and means. The test is case by case. An advisory title does not cure a decision-making duty.

A general counsel, a CISO, or a head of IT is often the wrong designation even when they know the systems. The ICO's UK example is a head of marketing who chooses the campaign, the channel and the personal data. A CISO who determines the purposes and means of monitoring is in the head-of-IT family of the same rule. Week 1 writes down the decisions the person is forbidden to take. A CISO title is not an automatic bar, and it is not automatically clean.

Failure to meet the designation and independence duties sits in the lower fine tier, not the higher one. Article 83(4) caps infringements of Articles 25 to 39, which include Articles 37 to 39, at EUR 10 million or 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. The DPO is not personally liable for the controller's compliance. The ICO says that in terms. The company remains the addressee. Hiring a person and then instructing them on Article 39 tasks is the company's breach, not a drafting slip.

What the designation actually fixes. Statute on each row. Company preference does not overwrite the row.
Rule	What it requires	What we lock in week 1
Art. 37(1)	Public authority (courts in their judicial capacity excepted), or core activities that are large-scale regular and systematic monitoring, or large-scale special-category or criminal-data processing	Mandatory, voluntary, or not required. A voluntary DPO still carries Article 38
Art. 37(5)	Expert knowledge of data-protection law and practices, and the ability to do Article 39. A law degree is not required	Evidence of authority contact and DPIA advice
Art. 37(2) and (6)	One DPO may cover a group if easily accessible from each establishment. Staff or a service contract	Employee, external, or group
Art. 38(3)	No instructions on the tasks. No dismissal or penalty for performing them. Report to the highest management level	Who may not instruct, and who hears the report
Art. 38(6)	Other tasks only if they do not conflict	Duties that determine purposes and means come off the job
Art. 39	Inform and advise, monitor compliance, advise on DPIAs, cooperate with the authority, be the contact point	Without these tasks, the hire is privacy counsel

One person may also be a US chief privacy officer. Article 38 does not lapse because that title is on the door.

Source: Regulation (EU) 2016/679, Articles 37-39 and 83(4); Article 29 Working Party, Guidelines on DPOs, WP 243 rev.01.

03 Three regimes

The EU, the UK and the United States do not hire the same officer.

Designation tests a general counsel, a CISO and a board can apply without blending three regimes into one requisition.
Question	EU GDPR	UK GDPR	United States
Must you designate?	Art. 37(1): public authority, or core activities that are large-scale regular and systematic monitoring, or large-scale special-category or criminal-data processing	Same three triggers. ICO guidance still states the duty. Courts acting in a judicial capacity are excepted	No federal DPO statute. Comprehensive state laws do not copy Article 38
Extra national trigger	Member State law can add one. Germany, BDSG section 38: non-public bodies at 20 persons constantly engaged in automated processing, and some processing regardless of headcount	Data Protection Act 2018, section 7, defines public authority and public body for the UK GDPR. The 20-person German rule is not UK law	State thresholds are consumer-count and revenue tests for the privacy law, not a headcount test for an officer
Independence	Art. 38. Instructions on the tasks are forbidden	ICO: independent, resourced, not penalized, report to the highest management level. Same duties if the appointment is voluntary	Independence is a governance choice on a CPO. It is not a statutory shield
2026 overlay	EU AI Act duties can sit beside the DPO. They do not turn the DPO into head of AI governance	Data (Use and Access) Act 2025: all data-protection provisions in force on the ICO's 19 June 2026 update. Complaints must be acknowledged within 30 days	Indiana, Kentucky and Rhode Island comprehensive laws, and California ADMT, risk-assessment and cybersecurity-audit rules, applicable 1 January 2026
Who we search	Sitting DPOs, designable privacy counsel, external and group DPOs	Same pool, plus the complaints process the 2026 duty now requires the organization to run	CPO or privacy counsel, unless EU or UK establishment or targeting creates a real designation duty

A dual-use company, US employer and EU or UK users, often needs both a US officer or counsel and a person who can actually be designated. They are the same person only if Article 38 still holds.

Source: Regulation (EU) 2016/679; Data Protection Act 2018, section 7; ICO DPO and DUAA guidance, updated 19 June 2026; BDSG section 38; IAPP, 5 January 2026.

Germany widens who must appoint. BDSG section 38(1) applies to non-public bodies, on top of Article 37(1)(b) and (c). They designate a data protection officer if, as a rule, at least 20 persons are constantly engaged in automated processing of personal data, and also, regardless of headcount, if processing requires a DPIA under Article 35 or personal data are processed commercially for transfer, anonymized transfer, or market or opinion research. The same headcount in London or California may not trigger a designation.

The United Kingdom kept the duty. The Data (Use and Access) Act 2025 amends the UK GDPR and does not replace it. On the ICO's 19 June 2026 update, all of its data-protection provisions are in force, including a complaints duty: acknowledge within 30 days. The ICO's DPO page still states independence and is marked under review. The United States does not copy Article 38. The IAPP's 5 January 2026 report counted 19 enacted comprehensive state laws. Indiana, Kentucky, Rhode Island, and California's automated-decision, risk-assessment and cybersecurity-audit regulations became applicable on 1 January 2026. A US company that offers goods or services to people in the EU or the UK, or monitors them, still faces the designation test.

04 Candidate pool

The pool is sitting DPOs, counsel who can be designated, and external DPOs. It is not every privacy lawyer.

Sitting DPOs

Already designated. The dossier asks who they reported to, whether they were instructed on Article 39 tasks, and which authority they have actually dealt with. A title without that record is a counsel profile.

Counsel who can be designated

Privacy counsel and compliance leads whose other duties do not determine purposes and means. Article 37(5) does not require a JD. A general counsel who still decides processing usually cannot add the title and keep both jobs.

External and group DPOs

Article 37(6) allows a service contract. Article 37(2) allows one DPO for a group of undertakings if the person is easily accessible from each establishment. A shared DPO who cannot be reached fails the article.

There is no public census of designated officers that we treat as the size of this market, and we do not publish one. The map Sartori searches for lawyers is 1,480,000+ lawyers. The DPO pool is wider than that map, because the statute does not require a law degree, and narrower than the privacy profession, because Article 38(6) removes people who determine purposes and means. Certification is a screen inside the pool. It is not Article 37(5).

The IAPP Salary and Jobs Report 2025-26, fielded in March and April 2025, drew more than 1,600 respondents from over 60 countries. At least 77 percent held one IAPP certification, and 39 percent held more than one. That survey is not a census of designations. Scoring only law-firm rank misses non-lawyers Article 37(5) allows and keeps candidates whom Article 38(6) excludes.

Language follows the authority, not the headquarters city. The published privacy mandate was bilingual: an Euronext-listed insurer in Brussels, GDPR plus model-risk, shortlist in 19 days, accepted offer in 8 weeks. It was privacy and AI-governance counsel, inside the 96, not a statutory DPO inside the 41. Where the standing seat is AI governance, the mandate is AI governance counsel.

05 Pay by market

Price the market the person sits in. Do not price a European DPO off a chief privacy officer average.

IAPP figures below are self-reported. Survey fielded March-April 2025. They are not an offer and not a statutory scale.

Salary bands by market for privacy, AI governance and cybersecurity roles. Medians are base salary unless the row says average or total compensation. Quartiles are the Q1-Q3 ranges printed on the infographic.
Cut	Figure	What it is	Source date
Europe median base	$112,000 (Q1 $74,000, Q3 $138,000)	Base. The UK is not split out. Use this row for a UK DPO	IAPP infographic, 17 September 2025
North America median base	$190,000 (Q1 $123,000, Q3 $221,000)	Base across privacy, AI governance and cybersecurity	IAPP infographic, 17 September 2025
Asia median base	$115,000 (Q1 $35,000, Q3 $150,000)	Base, same chart	IAPP infographic, 17 September 2025
Oceania median base	$125,000 (Q1 $89,000, Q3 $156,000)	Base, same chart	IAPP infographic, 17 September 2025
Other markets median base	$76,000 (Q1 $33,000, Q3 $100,000)	Base, same chart	IAPP infographic, 17 September 2025
Global median base	$139,000 (Q1 $94,000, Q3 $192,000)	Base, all regions on the chart	IAPP infographic, 17 September 2025
Global average total compensation	$200,000	Average, not a median. Privacy, AI governance and cybersecurity. Base plus bonus and other cash	IAPP infographic, 17 September 2025
CPO average base	$280,000	Average base for chief privacy officers. Not a DPO median and not a European figure	IAPP infographic, 17 September 2025
AI-governance legal and compliance	$190,000 average base	A global average. The same dollar figure as the North America median, and a different cut	IAPP infographic, 17 September 2025
Privacy only	Half earn less than $123,000	Single-domain privacy. The report says earn, not base	IAPP report, 3 August 2025
Privacy and AI governance	Half earn more than $169,700	Dual-domain	IAPP report, 3 August 2025
AI governance only	Half earn less than $151,800	Single-domain AI governance	IAPP report, 3 August 2025
Technology, legal and compliance	$205,000 median	Highest median in that technology-sector cut, relative to other respondents	IAPP report, 3 August 2025
Technology, technical AI governance	$221,000 median	Highest median in that technology-sector cut, relative to other respondents	IAPP report, 3 August 2025

Almost 7 in 10 respondents received a bonus (72 percent in North America, 67 percent in Europe). Average bonus on the infographic is 17 percent of base. AIGP-certified respondents earn 26 percent more than respondents with no certification.

Source: IAPP Salary and Jobs Report 2025-26, published 3 August 2025, and the At-a-Glance infographic, published 17 September 2025. More than 1,600 respondents, over 60 countries, March-April 2025.

06 Clock and terms

DPO and head-of-privacy searches run on the privacy clock. The fee is retained.

The privacy and AI-governance clock is 19 days to shortlist and 9 weeks median to an accepted offer, 2017-2026. The general counsel clock is different: 24 days and 11 weeks across 52 GC and CLO placements. Scoring a DPO search as a GC search misses the conflict test. Officer DPO and CPO seats are part of the 36 compliance and regulatory leadership placements since 2017. There is no separate published DPO headcount.

The search is retained only, with no contingency fee. The fee is 25 to 30 percent of first-year total compensation. Thirty percent of that fee is the retainer, kept if the client cancels. Replacement is 12 months on general counsel, chief legal officer, or chief compliance officer terms, and 6 months on other in-house searches, including a specialist privacy seat that is not on those officer terms. Offer acceptance is 96 percent. Retention is 97 percent at 12 months and 91 percent at 24 months. Those rates are firm-wide, not a DPO subset.

Interim cover, when the designation cannot wait for the permanent search, sits in a separate book: 60+ interim and fractional engagements since 2017, median 7 days from first call to start. The privacy and AI intercept day-rate is $1,600-$2,800. An interim officer still has to satisfy Article 38 if the title used is DPO. A day-rate does not waive the conflict rule, and it does not waive publication of the contact details under Article 37(7).

Outreach is blind both ways, and no CV goes out without written consent. After acceptance the designation is published, the authority is notified, and we check at 90 days. Placed lawyers are not approached while they stay, and a client's legal department is off limits for 24 months after a mandate.

19 days: Privacy and AI-governance time to shortlist, including DPO and head-of-privacy searches.; Sartori & Partners, 2017-2026
9 weeks: Median brief to accepted offer on that clock.; Sartori & Partners, 2017-2026
36: Compliance and regulatory leadership placements since 2017. DPO and CPO officer seats sit in this set.; Sartori & Partners

07 Published privacy mandate

Euronext-listed insurer, Brussels. Privacy and AI-governance counsel. Eight weeks. Not relabeled as a DPO.

Insurance · Euronext-listed · Brussels

Privacy and AI-governance counsel

Situation: GDPR program plus model-risk on the same desk. The company needed a bilingual shortlist that could sit with the supervisor and with the model-risk committee.
Approach: Mapped sitting privacy counsel in EU insurance who had owned a model-risk overlay. Scored as specialist counsel, not as a translated US chief privacy officer brief.
Outcome: Bilingual shortlist on the 19-day privacy clock. Accepted offer in 8 weeks. Specialist counsel, inside the 87, not an officer seat inside the 41.

Timeline: 19 days to shortlist. 8 weeks to accepted offer.

Use this mandate as evidence of the privacy clock. Do not read it as a statutory DPO designation. Where the open question is still whether to hire a DPO, a CPO, or AI-governance counsel, start with when to hire privacy and AI-governance counsel.

Chief privacy officer search

The US officer seat the company designs. Article 38 does not come with the title.

CPO search

When to hire

DPO, CPO, privacy counsel, or an AI-governance seat. Pick the product before the brief.

Read the guide

Privacy attorney pay, 2026

US firm lockstep against in-house counsel. A different series from the IAPP DPO bands above.

Salary bands

Data protection officer search — questions

What is DPO recruitment?

A data protection officer search fills the person GDPR and UK GDPR Articles 37 to 39 require. It is not a chief privacy officer the company designs, and not privacy counsel who report to the general counsel without a designation. Those seats are chief privacy officer search and when to hire privacy and AI-governance counsel.

Does a data protection officer have to be a lawyer?

No. Article 37(5) requires expert knowledge of data-protection law and practices and the ability to carry out Article 39. It does not require a law degree. We place lawyer and non-lawyer DPOs. The test is authority contact, DPIA advice, and no conflict under Article 52(6).

Can the general counsel or the CISO be the DPO?

Only if they do not determine the purposes and means of processing. Article 38(6) allows other tasks and forbids a conflict. WP 243 rev.01 names the chief executive, chief operating, chief financial and chief medical officers, and the heads of marketing, HR and IT. A CISO who decides why monitoring runs is in that group. We lock the forbidden duties in week 1.

How is a DPO different from a chief privacy officer?

A GDPR or UK GDPR DPO is a statutory designation. A US chief privacy officer is an officer the company designs. One person can hold both titles. Article 38 does not stop because the board uses the US title. The officer seat is chief privacy officer search.

Do US companies have to appoint a DPO?

No federal US statute requires one, and the state comprehensive laws do not copy Article 38. The IAPP's 5 January 2026 report counted 19 enacted comprehensive state laws. Indiana, Kentucky and Rhode Island, and California's automated-decision, risk-assessment and cybersecurity-audit regulations, became applicable on 1 January 2026. A US company with EU or UK users can still have a designation duty under those regimes.

How long does a data protection officer search take?

DPO and head-of-privacy searches use the privacy and AI-governance clock: 19 days to shortlist and 9 weeks median to an accepted offer, 2017-2026. Officer seats sit inside 36 compliance and regulatory leadership placements since 2017. An Euronext-listed insurer in Brussels hired privacy and AI-governance counsel, not a statutory DPO, in 8 weeks. That mandate is inside the 87 specialist counsel placements.

What should a company budget for a DPO in the US, the UK and the EU?

IAPP's 17 September 2025 infographic, survey fielded March-April 2025: Europe median base $112,000, which is also the UK row because the UK is not split out; North America median base $190,000; global median base $139,000. The $280,000 figure is average CPO base, not a DPO bid. US attorney pay is a different series on data privacy attorney salary 2026.

What does a privacy counsel recruiter brief cover if we do not need a DPO?

Privacy counsel who are not designated sit in the 87 senior and specialist placements since 2017, on the same 19-day and 9-week clock. A head of AI governance is AI governance counsel. If Article 37 does not require a designation, record that. Do not title the hire DPO and then instruct them on Article 39 tasks.

Sources

Statute, regulators, and the IAPP salary survey cited above.

Sources

10 references

Regulation (EU) 2016/679 (GDPR), Articles 37-39 and 83 eur-lex.europa.eu ↗
Article 29 Working Party, Guidelines on Data Protection Officers (WP 243 rev.01) ec.europa.eu ↗
Data Protection Act 2018, section 7 (public authority and public body) legislation.gov.uk ↗
ICO, Data protection officers (UK GDPR) ico.org.uk ↗
ICO, Data (Use and Access) Act 2025 — what it means for organisations (updated 19 June 2026) ico.org.uk ↗
German Federal Data Protection Act (BDSG), section 38 gesetze-im-internet.de ↗
IAPP, Salary and Jobs Report 2025-26 (3 August 2025) iapp.org ↗
IAPP, At-a-Glance Salary and Jobs Report 2025-26 (17 September 2025) iapp.org ↗
IAPP, US state privacy requirements coming online as 2026 begins (5 January 2026) iapp.org ↗
Sartori & Partners research programme sartoriglobal.com ↗

Data protection officer

Brief the designation, or brief a different seat.

Article 38 independence, or say so if this is a US officer with no designation. EU, UK and US pay kept apart. No obligation.

Brief a search How we run a search

[email protected]