Data protection officer recruitment: how to hire a DPO

When you need a data protection officer, and what the seat is

Article 37 of the UK GDPR makes the appointment mandatory in three cases: you are a public authority or body (courts and tribunals acting judicially excepted); your core activities involve regular and systematic monitoring of people on a large scale; or your core activities involve large-scale processing of special category data or criminal offence data. It applies to processors as well as controllers. The ICO’s guidance on data protection officers explains each test, including what counts as a core activity and as large scale.

If none of those applies you may still appoint a DPO voluntarily, on the same terms, or decide not to and record why. Either way you still need enough people and resources to meet your data protection obligations. Many organisations that are not required to have a DPO appoint a data protection lead instead, under another title.

What the seat is

The DPO informs and advises the organisation, monitors compliance, advises on data protection impact assessments and is the contact point for the ICO and for people whose data you hold. The DPO reports directly to the highest management level, must be involved early in every data protection issue, and cannot be told how to do the job. See what a data protection officer does for the full role.

Those conditions, set out in Article 38, shape the hire. A DPO may hold other duties only if they do not conflict, so the person who decides how personal data is used (a head of marketing, IT or data) is usually the wrong candidate. Write the reporting line and the independence into the role before you advertise it.

Internal, outsourced or fractional DPO: which to hire

Article 37 lets the DPO be a member of staff or work under a service contract, and the ICO confirms that an outsourced data protection officer should have the same position, tasks and duties as an internal one. A group of companies may share one DPO if the DPO is easily accessible from each establishment; public bodies may share one too, taking account of their structure and size.

An internal appointment can be an existing employee, if their other duties do not conflict. The ICO’s example of a fit is a public authority’s freedom of information officer or records manager; its example of a conflict is a head of marketing who decides which customers to target. Whichever route you choose, write into the engagement how the DPO is brought into new projects and DPIAs before decisions are made.

For a named individual for part of the week, see fractional DPO jobs and how to hire one. If the wider need is legal cover (contracts, disputes, employment), a fractional general counsel is the better seat; for security operations, see fractional CISO.

The ICO data protection fee is not a recruitment fee

Organisations that use personal information, including sole traders, must pay the ICO’s data protection fee under the Data Protection (Charges and Information) Regulations 2018 unless they are exempt. It is a charge paid to the regulator, not to a recruiter or to the DPO, and appointing a DPO neither replaces it nor depends on it.

Keep the two separate in the budget. The fee is set by the ICO; a DPO’s pay or day rate depends on the scale and risk of the processing, the sector and how many days the seat needs. Where an outsourced or fractional DPO works through their own company, the off-payroll working rules (IR35) may apply: status depends on how the engagement runs, and a medium or large client makes the determination. Our IR35 guide sets out the tests.