Data Protection Officer interview questions, with worked answers

How to use these questions

Most rounds are case questions: a team wants to do something with personal data, and you advise. Answer out loud, in the order a regulator would ask: what data, on what ground, with what risk, with which measures. Name the law of the place the job is in, and say when you would ask a lawyer to confirm a point.

What a data protection officer is expected to know

• The law: the EU's GDPRKnow the principles, lawful bases, rights and duties well enough to apply them to a real process. or the law of the place, and next to it employment lawKnow where employee data meets employment rules, from hiring to monitoring and exit. for staff data and contract workRead and negotiate data processing agreements and the data clauses of other contracts. with suppliers.
• The method: impact assessmentsRun an impact assessment for risky processing: the purpose, the risks to people and the measures that lower them., records of processing and complianceTurn rules into processes people follow, with evidence that they do. processes that leave evidence.
• The risk: risk ratingsRate risks to people's data by likelihood and impact and agree what to do about each., securityUnderstand security controls and incidents well enough to judge the risk to personal data. basics and ISO 27001Read an information security management system and see where privacy duties meet it., where privacy and security meet.
• The records: a privacy toolKeep the records of processing, assessments and requests in a privacy tool or a well-kept register. or a register that is complete and kept up to date.

The tools are named in ads side by side and none is a must everywhere: OneTrust, TrustArc or Securiti as privacy tools, Microsoft Purview for finding and labelling data in Microsoft 365, and Excel for the many registers that live in a spreadsheet. Interviewers care about what the records say, not where they are kept.

Lawful basis, rights and retention

Marketing wants to use customer data for a new campaign. How do you decide on the lawful basis?

What they check: that you match the purpose to a legal ground, not the other way round.

Short answer: "A lawful basis is the legal ground for using personal data. I ask what the campaign does with which data and what customers were told. Then I check whether consent is needed, for example for some email marketing, or whether legitimate interest can carry it, which needs a written balance between the firm's interest and the customer's."

The full answer: Under the EU rules and the UK's copy of them, the grounds are the same, but national laws on marketing calls and emails add their own conditions. Write the reasoning down, update the privacy notice if the purpose is new, and make opting out easy.

A weak answer: "We have their data, so we can use it." Follow-up: "The data was collected years ago for delivery only." Say what changes.

A customer sends a data subject access request. Walk me through how you handle it.

What they check: a calm process that meets the deadline and protects others.

Short answer: "A data subject is the person the data is about; an access request asks for a copy of their data and how it is used. I confirm who is asking, log the date, search every system that may hold their data, remove what concerns other people, and answer within the legal deadline, usually a month."

The full answer: A data subject access request often comes in a dispute, so treat it as a legal document. Agree in advance with customer service and IT where to search, and keep a record of what was sent.

A weak answer: "Customer service sends them their account page." Follow-up: "The request is part of a legal dispute with the firm." Say what changes.

How would you set retention periods for a firm that has never deleted anything?

What they check: a practical plan, not a perfect one.

Short answer: "I start with the data that carries the most risk, such as applicant files and customer records, set a period for each from the legal duties to keep records and the business need, and agree deletion with the owners. Then I build deletion into the systems, so it happens without anyone remembering."

The full answer: Tax and commercial laws set some periods; for the rest, the firm decides and writes down why. Check backups and shared drives too, where old copies hide.

A weak answer: "Keep everything, it might be useful." Follow-up: "Sales says deleting old leads will cost revenue." Say how you answer.

Impact assessments, suppliers and transfers

The firm wants to roll out an AI tool that reads customer emails. How would you run the DPIA?

What they check: that you can assess a new technology with the same method as any other.

Short answer: "A data protection impact assessment, or DPIA, describes the processing, checks that it is needed and proportionate, rates the risks to the people concerned and lists the measures. For an AI tool I ask what data it sees, whether the provider uses it for training, where it is processed, how errors are caught and how long anything is kept."

The full answer: Involve security, the business owner and the provider early. In the EU, the AI Act adds its own duties for some uses, so check which apply. A DPIA ends with a decision by management; the DPO advises on it.

A weak answer: "AI tools are new, so we wait." Follow-up: "The provider will not say whether it trains on your data." Say what you advise.

A new supplier will process our customer data. What do you need from them as a processor?

What they check: the controller and processor roles, and a real check of the supplier.

Short answer: "The controller decides why and how data is used; a processor handles it on the controller's behalf. I need a data processing agreement that binds them to our instructions, their security measures, a list of their own subcontractors and the right to check them."

The full answer: Ask how they handle a breach and how fast they tell us, where data is stored and how it is returned or deleted at the end. Scale the checks to the risk: a payroll provider gets more questions than a meeting room booking tool.

A weak answer: "They are a large firm, so it is fine." Follow-up: "Their standard contract refuses any audit." Say what you would negotiate.

Our support team is in India and the customers are in the EU. How do you allow the transfer?

What they check: the transfer rules and a risk view, not just a form.

Short answer: "Personal data may leave the EU only with a safeguard. Where no decision says the other country's protection is adequate, the usual tool is the standard contractual clauses, model terms the European Commission published, plus an assessment of the risks in that country and extra measures where needed."

The full answer: India's DPDP Act also applies to the team in India, so the contract should fit both. Limit what the team can see, log access and review it.

A weak answer: "It is the same company group, so no transfer happens." Follow-up: "The team needs full access to customer records." Say what you would ask for.

How do you build privacy by design into a new app before a line of it exists?

What they check: that you work with product and engineering, not after them.

Short answer: "Privacy by design means the protection is part of the plan from the start. I join the first planning meetings, ask what data each feature really needs, push for settings that share the least by default, and agree deletion and access rules before they build."

The full answer: Give the team a short checklist and a contact, so questions come early. Review again before launch, and keep the decisions in the records of processing.

A weak answer: "I review it after launch." Follow-up: "The product team wants to collect date of birth to be safe." Say what you ask.

Our website sets tracking cookies before anyone clicks. What do you advise?

What they check: the cookie rules and a fix the business can live with.

Short answer: "In the EU the ePrivacy rules, in Germany the TDDDG, ask for consent before non-essential cookies are set. I would have marketing and IT list every cookie, block the non-essential ones until the visitor agrees, and make refusing as easy as accepting."

The full answer: Test the banner yourself in a fresh browser. Agree with marketing which tools they truly need, and record the consent so it can be shown later.

A weak answer: "Everyone does it." Follow-up: "Marketing says the numbers will drop." Say how you discuss it.

Breaches and the regulator

On Friday evening, a laptop with an unencrypted customer list is stolen. What happens next?

What they check: speed, judgement and the deadlines.

Short answer: "I start the clock, find out what data was on it and about how many people, and judge the risk to them. Under the EU and UK rules a breach that risks people's rights goes to the supervisory authority within 72 hours, and to the people themselves when the risk is high. I record the facts and my reasoning either way."

The full answer: Work with security to wipe the device remotely if possible, and with management and communications on what to tell people. Afterwards, fix the cause, such as missing encryption, and check the same gap elsewhere.

A weak answer: "We wait until Monday to see if it turns up." Follow-up: "The manager asks you not to report it." Say what you do.

Security reports a breach of a server that may hold personal data. How do you work with the security team?

What they check: a shared process where each side knows its part.

Short answer: "Security finds, contains and investigates; I judge what it means for the people whose data was on the server and whether a report is due. We agree one incident record, meet at fixed times while it runs, and I ask the questions a regulator will ask: which data, how many people, since when, and is it still exposed."

The full answer: Agree this before any incident, in the incident plan, with names and phone numbers. After it, review together what slowed the work and fix it.

A weak answer: "Security tells me when they are done." Follow-up: "The investigation will take a week, but the deadline is in three days." Say what you report.

The supervisory authority writes to say a customer has complained. How do you respond?

What they check: cooperation, facts and a clear line of responsibility.

Short answer: "The supervisory authority is the regulator for data protection. I confirm the deadline, collect the facts from the teams involved, check what we did against our records, and answer fully and on time. Where we made a mistake, I say so and show what we changed."

The full answer: Keep management informed, bring in the lawyer if the matter could lead to a fine, and treat the complaint as a chance to fix a process. A good working relationship with the regulator helps the firm.

A weak answer: "We let the lawyers handle all contact with the authority." Follow-up: "The facts show the team ignored your earlier advice." Say how you report it.

Employee data, training and audits

Management wants to monitor employee data on laptops. What do you advise, and what about the works council?

What they check: employee data handled with care and the people who must be involved.

Short answer: "I ask what problem the monitoring solves and whether a milder measure would do. Monitoring staff needs a clear purpose, limits, a notice to staff and often an impact assessment. In Germany the works council has a say in technical tools that can watch performance, so it must be involved before any start."

The full answer: Agree retention and who may see the results, rule out secret monitoring, and put the terms in a works agreement where a works council exists. HR and the lawyer join early.

A weak answer: "The laptops belong to the firm, so anything goes." Follow-up: "The works council refuses." Say what happens next.

How would you design privacy training that staff remember?

What they check: training that changes behaviour, not a box ticked.

Short answer: "Short, by role and with real cases from our own firm: what customer service may say on the phone, what HR may keep, what developers must ask before using live data. I add a few questions at the end and repeat it each year."

The full answer: Measure the effect: fewer mistakes, more questions to the DPO, faster breach reports. Train managers separately, because staff follow them.

A weak answer: "Everyone reads the policy once a year." Follow-up: "Staff click through the course in two minutes." Say what you change.

How do you audit a department's handling of personal data?

What they check: a method that finds real gaps and keeps the relationship.

Short answer: "I agree the scope with the head of the department, compare their records of processing with what they actually do, sample files and access rights, and talk to the people doing the work. The report rates each finding, names an owner and a date, and I check later that it was fixed."

The full answer: Records of processing are the register of what data each process uses, why and for how long; an audit tests that register against reality. Use the same method each year so progress shows.

A weak answer: "I send a questionnaire and file the answers." Follow-up: "The head of the department disputes a finding." Say how you settle it.

Independence and senior rounds

How do you stay independent, and how would you spot a conflict of interest in your own role?

What they check: that you understand why the DPO is not a manager of the processing.

Short answer: "The DPO advises and monitors, reports to top management and must not be told how to do the job. A conflict of interest arises when the DPO also decides why and how data is used, for example as head of IT or marketing. I would say so openly and propose a split of the roles."

The full answer: Independence also means resources: time, budget and access to information. Write the role down, report regularly to the board, and keep a record when advice is not followed.

A weak answer: "I do what my manager decides." Follow-up: "The firm wants you to be DPO and head of compliance at once." Say what you would check.

As a senior data protection officer or head of privacy, how would you build a privacy programme across several countries?

What they check: a senior view: priorities, people and reporting.

Short answer: "I would set one group standard based on the strictest common duties, add national rules where they differ, and name a contact in each country. Then I would agree a plan for the biggest risks, report progress to the board each quarter, and measure it with a few figures such as requests on time and assessments done before launch."

The full answer: In the EU the GDPR is the base; the UK GDPR, the Swiss revFADP, India's DPDP Act and US state laws such as California's CCPA each add their own points. A data protection coordinator in each country can carry the daily work while the head of privacy owns the standard.

A weak answer: "One policy for everyone and done." Follow-up: "A country manager says the group standard is too much for a small office." Say how you decide.

Your CV for these questions

Each job on your CV invites the questions above: what you covered, the hard cases and what changed. Give those stories a line each, written so a head of privacy wants to hear more:

Check your CV against a data protection officer job you want with the free score; any area it finds thin is the one to rehearse first, with a real case told without names.