A data protection officer (DPO) supervises how an organisation handles personal data. A privacy officer does the day-to-day privacy work. If you run security or procurement at a public body, my advice is simple: don't give both jobs to one person, not even for an interim assignment.
It can look like a question for the privacy team alone. In practice, the way you split these roles decides how credible your oversight looks to the regulator and to your own board, so it is worth settling before the request for proposals goes out.
DPO vs privacy officer: what is the difference?
The DPO is a role defined by the GDPR. Any public authority that processes personal data has to appoint one, as the European Data Protection Board (EDPB) guidance spells out. The DPO monitors compliance, advises on data protection impact assessments (DPIAs), acts as the contact point for the supervisory authority and handles questions from individuals about their data.
"Privacy officer" has no legal definition. Organisations create the post themselves, and it is usually an execution role: maintaining the record of processing activities, drafting DPIAs with the business, reviewing data processing agreements, handling personal data breaches and building privacy into projects. The job title and scope vary from one employer to the next.
Put plainly, the privacy officer makes things compliant and the DPO checks whether they are.
How the GDPR protects the DPO's position
The DPO cannot be told how to carry out their tasks, and cannot be dismissed or penalised for performing them. They report directly to the highest level of management. In a Dutch municipality that means the top of the civil service or the executive.
A DPO may take on other duties as long as these do not create a conflict of interest. The EDPB's DPO checklist notes that conflicting roles are mainly management positions, and that the DPO must not be the one deciding the purposes and means of processing. The organisation also has to give the DPO enough time, training, equipment and budget, and involve them as early as possible in every data protection matter.
You are allowed to appoint an external DPO under a service contract, with an individual or a firm. Hiring an interim DPO is an ordinary, lawful arrangement.
Why I would keep the two roles apart
Picture an interim DPO who also writes the DPIA for a new case management system. Wearing the DPO hat, that same person then has to advise on the DPIA. They are marking their own homework. The GDPR does not put it in those words, but I read the conflict-of-interest rule broadly: if someone reviews their own work, there is no oversight.
The temptation is easy to understand. There is budget for one contractor, and a combined "DPO and privacy officer" brief looks efficient. What you end up with is someone who updates the processing register on Monday and tells senior management on Tuesday that the register is in good shape.
European regulators have been looking at exactly this. Throughout 2023, 25 supervisory authorities across the EEA ran a coordinated investigation into the role of the DPO. The report the EDPB adopted in January 2024 lists, among other things, insufficient resources for DPOs, insufficient expertise and training, risks of conflicts of interest and DPOs not reporting to the highest management level. A combined role tends to hit two of those at once, because operational work eats the time meant for supervision and the tasks pull against each other.
How to divide the work
The DPO role does not have to be full time. It does need proper hours and a direct line to the top. This is how I would split it:
- The DPO monitors compliance, advises on DPIAs, deals with the national supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens) and with individuals, and reports to senior management.
- The privacy officer or privacy consultant keeps the processing register, drafts DPIAs, sorts out data processing agreements and handles breaches.
- The CISO or security officer owns the security measures the privacy officer relies on.
When an incident is both a personal data breach and a security incident, the privacy officer and the CISO handle it together, and the DPO reviews afterwards whether it was dealt with properly. If the DPO is in the thick of the response, nobody is left to review it.
What this means for your tender
Dutch public sector assignments usually ask candidates for more than a CV. Expect a CV of no more than three pages, a short plan of approach, an explanation of how they meet the requirements and a cover letter. Outsiders find the plan of approach hard to write. A consultant already working inside the organisation knows exactly what the client expects, and that gives them a head start.
With a DPO tender the gap widens when the role is vaguely described. So set out in the brief what the DPO will and will not do, who they report to and whether a privacy officer will sit alongside them. A strong external candidate can then write a plan of approach with some substance to it.
One tip: ask candidates to explain in their plan how they will safeguard their independence. The answer shows how they see the job. Anyone who mostly describes hands-on privacy work is really applying to be your privacy officer.
Interim or permanent?
Interim works well for the DPO role when you need to bridge a gap or redesign the function. An external DPO belongs to no department and has no internal career at stake, which makes it easier to report uncomfortable findings upwards.
The privacy officer is a different matter. That work never stops, and it relies on knowing your own processes and systems. An interim privacy officer can clear a backlog in the register or in DPIAs, but plan for someone to take it over afterwards, either in-house or through secondment.
Looking for an interim DPO or a privacy officer? The profiles are on our page about privacy and DPO specialists, and our government sector page covers what public bodies are dealing with. We find freelance specialists through MVPeople, and if you want someone in your team for longer, secondment through MVProfessionals is an option. For how a Dutch public sector hiring request works in general, read this piece on hiring contractors for the Dutch government. Not sure how to split the roles? Call or email me.
