FractionalQuestSign inBook a call

Permanent data protection officer · hiring brief

Hire a Data Protection Officer

Hire a Data Protection Officer: confirm whether UK GDPR requires you to appoint a DPO, protect the role’s independence, and choose an employed, part-time or contracted DPO who reports to the highest level of management.

Brief us on this role →See data protection officer roles

Reviewed by Fractional Quest · updated 1 November 2026 · 4 sources linked below

  • 3–5on every shortlist
  • 5stages of vetting
  • IR35set out on every brief
Hire a Data Protection Officer: a technology leader sketching a system architecture on a whiteboard (illustration)

On the board · last 90 days

Which roles are on the board now?

Permanent data protection officer roles first, then the seat in any engagement and the wider function when the board runs short.

Roles

See every role on the board →

Every fractional role in the UK is on the fractional jobs board.

In the press

The brief

Hire a Data Protection Officer: what must the role own?

Whether you must appoint (public authority, large-scale monitoring or special category data) or are choosing to.

  • 01RequirementWhether you must appoint (public authority, large-scale monitoring or special category data) or are choosing to.
  • 02IndependenceNo conflicting role, such as head of IT or marketing deciding processing.
  • 03ReportingA line to the board or senior management.
  • 04ResourcesTime, budget and access the DPO needs.

Role reference: ICO: data protection officers. The ICO sets out when a DPO is required, their tasks and why they must be independent; read it before you hire a data protection officer.

DPO

Hire a data protection officer: must you, and how?

Some organisations must appoint a DPO; others choose to.

The ICO guidance says public authorities and organisations whose core activities involve large-scale monitoring or large-scale special category data must appoint one. Others may appoint voluntarily.

A DPO can be employed, part-time or contracted, and can be shared across a group. What matters is independence, expertise and a line to the top.

The working pattern

What changes when the data protection officer is permanent?

A data protection officer informs and advises the organisation, monitors compliance and is the contact point for the ICO. Under UK GDPR the DPO must be independent and must not decide the purposes of processing.

The illustrative brief: a health-tech company processing patient data at scale. The company processes health data at scale and has no DPO; the CTO handles privacy questions.

The appointment owns: It appoints a contracted DPO on agreed days, reporting to the board.

Another owner retains: The CTO keeps system design; the DPO advises and monitors, not decides.

The case is illustrative; it does not describe a Fractional Quest placement.

From brief to start

How do you hire a Data Protection Officer, step by step?

Hire a Data Protection Officer, in practice: the first three steps are ours; the last four are what has to be true before the first day. We don’t promise a shortlist by a date.

  1. Day 0
    01
    The 15-minute call
    What the data protection officer must own, the working pattern, the start date and the budget.
    You and us
  2. Week 1
    02
    Scope agreed in writing
    The outcome the seat exists for, the days, and how the engagement will run for IR35.
    Us
  3. Weeks 1–3
    03
    Search, references, shortlist
    We approach people who aren’t looking, verify tenure, take references ourselves and return three to five.
    Us
  4. Week 4
    04
    Appointment
    Record the appointment and publish the DPO’s contact details.
    You
  5. Before day one · 2
    05
    Register
    Records of processing, DPIAs and breach log.
    You
  6. Before day one · 3
    06
    Board
    A reporting slot with senior management.
    You
  7. Before day one · 4
    07
    ICO
    Notify the ICO of the DPO’s details.
    You

Assessment

How should you assess each candidate?

Hire a Data Protection Officer on evidence: put the same work in front of each candidate before comparing answers.

  1. Comparable work
    Ask for a DPIA or breach they advised on, and the outcome.
  2. Authority
    Test advice the business may not want, and how they would escalate it.
  3. Team
    Ask how they trained staff who handle personal data.
  4. Handover
    Ask what records they left for a successor.

Acas recommends a consistent, fair selection process: choosing who to interview.

Vetting

What happens before anyone reaches your shortlist?

Five stages before a candidate reaches a shortlist of three to five.

  1. Pedigree screen
    Tenure
    We verify prior tenure in the seat, at the scale and stage you need. No consultant presenting as an executive.
  2. Mandate fit
    Fit
    Fit to your stage, sector and the problem the seat exists to solve, not a CV keyword.
  3. Reference deep-dive
    Verify
    We take references ourselves, from recent clients and boards: what they delivered, not what they titled it.
  4. Shortlist
    Shortlist
    Three to five candidates, each with day rate, availability and IR35 position set out.
  5. Kick-off
    Start
    Scope, first-month outcomes and the contract agreed before day one.

The full process is on how we vet.

Questions

Hire a Data Protection Officer: questions, answered

Usually not, if they decide how personal data is processed: the ICO says a DPO must not have a conflict of interest. Take advice on your structure.

Read next

Related hiring and role pages

Sources

Where does every reference on this page come from?

  • ico.org.uk
  • HMRC
  • legislation.gov.uk
  1. 1
    ICO: data protection officers ico.org.uk
  2. 2
    Understanding off-payroll working (IR35) HMRC
    Status depends on how the engagement runs; medium and large clients make the determination.
  3. 3
    Check employment status for tax (CEST) HMRC
    HMRC’s own status check for each engagement.
  4. 4
    Employment Agencies Act 1973 legislation.gov.uk
    The law a recruitment agency works under; no fee to a work-seeker.

For hiring managers

Bring the brief. We bring the shortlist.

Sign up now →Book a call

  1. A shortlist of 3–5, each with day rate, availability and IR35 position
  2. Fractional, interim, part-time, temporary or permanent — and non-executive directors
  3. Every candidate through our five-stage vetting
  4. Your briefs and their candidates, in one room