Data Protection Officer jobs: skills, pay and how to get hired

What a data protection officer does

A data protection officer, or DPO, checks that an organisation handles personal data lawfully, advises managers and staff before they start something new, trains them, answers people who ask about their data and works with the regulator when something goes wrong. The DPO advises and monitors; the decisions stay with management, which is why the role must be independent and free of conflicts of interest.

The job sits between three others. The lawyer drafts and argues the legal position, the compliance officer covers the wider rulebook of a firm, and the security team, including the security analyst, protects systems and answers incidents. In German ads the title is Datenschutzbeauftragter, and many DPOs work as external officers for several smaller firms. The steps from data protection coordinator to chief privacy officer are in the career paths of this role.

The rules differ by place, and the job follows them. In the EU the GDPR sets the tasks of a DPO and when one must be named; the German BDSG adds its own duty to appoint one; the UK GDPR and the Data Protection Act 2018 apply in the UK; the Swiss revFADP applies in Switzerland; India's DPDP Act applies in India; and in the US, state laws such as California's CCPA, as amended by the CPRA, sit beside rules for single sectors. Each country section below says more. This page describes the job and is not legal advice.

The skills the ads ask for

We read a sample of the ads every day and count the skills they name. On a computer, hover a skill in the text to see its share; on a phone, the table has the same figures.

The legal core leads: the EU's GDPRKnow the principles, lawful bases, rights and duties well enough to apply them to a real process. and the national laws next to it, the complianceTurn rules into processes people follow, with evidence that they do. work of turning them into processes, and data protection impact assessmentsRun an impact assessment for risky processing: the purpose, the risks to people and the measures that lower them. for risky processing. Contract workRead and negotiate data processing agreements and the data clauses of other contracts. comes in with every service provider that handles data, and employment lawKnow where employee data meets employment rules, from hiring to monitoring and exit. wherever staff data is concerned.

The technical side is about knowing enough to ask the right questions: ISO 27001Read an information security management system and see where privacy duties meet it. and securityUnderstand security controls and incidents well enough to judge the risk to personal data. basics, who owns which dataKnow who owns which data, where it lives and how long it stays., risk ratingsRate risks to people's data by likelihood and impact and agree what to do about each. and controlsBuild checks into processes and test that they work, as an auditor would. that can be tested. Many DPOs keep their records in a privacy toolKeep the records of processing, assessments and requests in a privacy tool or a well-kept register., such as OneTrust, TrustArc or Securiti, and many in a well-kept spreadsheet; ads name them side by side. Data spread across Microsoft 365Find personal data in shared drives, mail and collaboration tools, and set sensible retention there. is a common topic, and communicationExplain a rule in plain words to a developer, a marketer and a board member in turn. in plain words matters as much as the law. Group policies are often written in EnglishThe language of most international privacy guidance, contracts and group policies., and most ads in German-speaking countries ask for GermanAsked for in most German ads, where staff, works councils and authorities speak German. for the talks with staff.

Certifications come up in many ads and are named side by side: CIPP/E and CIPM from the IAPP, an international association of privacy professionals, and in Germany courses that end with a TÜV or DEKRA certificate as Datenschutzbeauftragter. No law asks for one of them in particular; the rules ask for expert knowledge, and employers read a certificate as one sign of it next to the cases you handled.

Where the jobs are, country by country

Each country below has its own figures: which cities have the most jobs in our list, whether the number is going up or down, how often ads offer remote or hybrid work, the titles used in the country, and pay ranges from published research, in the local currency.

A new process, step by step

1. Hear about it early: a team plans a new app, a new supplier or a new use of customer data and asks the DPO before it starts.
2. Map the data: what is collected, from whom, why, where it goes and how long it stays.
3. Find the lawful basis and the risks: the legal ground for each use and an impact assessment if the risk to people is high.
4. Agree the measures: less data, shorter retention, access limits, a contract with the supplier, and clear notices to the people concerned.
5. Record and check: the entry in the records of processing, and a later check that the measures are in place.

Most of the work is advice like this, plus requests from people who want to see or delete their data, training, and the rare breach that has to be judged and perhaps reported within a short deadline. A good DPO is consulted early because teams find the advice useful, not because they fear it.

Your CV for a data protection officer job

A data protection officer's CV is read twice: by hiring software that matches the ad's words, and by a head of legal or compliance who wants to know which organisations you covered, which laws you worked under and what changed because of your advice. Give both: the keywords and the evidence.

Use the keywords the ads use

• Name the work as the ad does: "GDPR" for the EU rules, "DPIA", "records of processing", "data subject requests", "data processing agreements" and the national law of the country. The skills table above shows which keywords the ads use most.
• Say what you covered: the sector, the size of the organisation and whether you were an internal or an external officer.
• Write a certification or course you are still taking as "in progress" with the planned month, so nobody reads it as finished.
• Keep a line on your base, such as a law degree, an IT background or audit work, because it shapes the questions you will get.

Prove each skill

A privacy line proves itself with a change: a register that became complete, requests answered on time, a risky project made safe before launch, a breach handled within the deadline.

Keep confidential matters out: no names of affected people or clients, no details of open investigations.

How we read our data

• The jobs: the data protection officer jobs in our job search (data protection officers, DPOs, privacy officers and privacy managers, and the German titles Datenschutzbeauftragter, Datenschutzkoordinator and Datenschutzmanager), matched by their titles the way the search matches them. Our list is not the whole market, so we give shares and rankings, never counts.
• The skills: every day we read a sample of these ads and count the skills in them with a fixed word list. Only the counts are kept, never the text of an ad.
• Pay: from published salary research, each source named with its date, as a range from entry level to senior. Our ads are not used for it.
• Dates: every figure is worked out again each day and shows the day it was worked out.

More on the data protection officer role