Outsourced DPO Services
Write out what a Head of Privacy is supposed to do at a mid-market company, and the list runs long. Build the program. Clear the vendor agreement backlog. Run the rights request queue. Write the assessments. Train the staff. Watch the regulatory calendar. And if the company sells into Europe, be the named DPO.
That's several jobs in one description, and the posting rarely says which of them the company actually needs.
It helps to separate the work into three kinds. Execution is the drafting, the reviewing, and the queue. Judgment is deciding whether a new law applies, or whether a new feature crosses a line. Accountability is being the person a regulator or a customer looks for by name.
A hire brings all three, at one person's capacity. The posting tells you which one the company thinks it's buying. If it's mostly execution and monitoring, the job may be smaller than the salary band suggests. If it's accountability, the DPO rules apply.
A Head of Privacy and a DPO are not the same thing. "Head of Privacy" is an internal title; a DPO is a statutory role under GDPR. A company can have a Head of Privacy with no obligation to appoint a DPO at all, and it can appoint one voluntarily even where the law doesn't require it. Whether Article 37 actually requires one for your company is a legal question worth confirming with counsel rather than assuming either way.
If the hire will be the designated DPO, Article 38 shapes the job description. The DPO can't be instructed on how to perform the tasks, can't be dismissed or penalized for performing them, and reports directly to the highest level of management. Other duties are allowed only if they don't create a conflict of interest. The Court of Justice addressed this in the X-FAB case in February 2023, holding that a conflict can arise when a DPO's other duties put them in a position to determine the purposes and means of the processing they're supposed to be supervising. It's a case-specific test, not a fixed list of banned job titles.
The EDPB's 2023 coordinated enforcement action on DPOs, with 25 authorities and more than 17,000 responses, found a recurring set of problems: DPOs who hadn't been designated where the law required one, insufficient resources, insufficient expertise, tasks that weren't fully entrusted to the DPO, conflicts of interest, and DPOs who didn't report to management independently. Those are also the things a posting tends to leave unsettled. Who does the role report to, what budget does it control, and what else lands on it? That's worth running past your outside counsel before the posting goes live.
SHRM's 2026 benchmark puts median time-to-fill at 45 calendar days for executive positions and 39 for nonexecutive ones. That clock runs from opening the requisition to offer acceptance, so a start date follows after notice periods and onboarding. Specialized regulated roles tend to run longer because the candidate pool is smaller. That is our observation, not a benchmark.
Meanwhile the dates keep arriving. California's automated decision-making requirements apply from 1 January 2027 for businesses using that technology to make significant decisions, and risk assessments for processing already underway are due by 31 December 2027. Most of Connecticut's amended law has applied since 1 July, though some obligations, including certain profiling assessments, carry their own effective date. None of that pauses for a search.
Hiring an in-house privacy leader has costs beyond salary: cash compensation, benefits and payroll taxes, recruiting, onboarding, and, where needed, privacy operations tooling. The exact total depends on seniority, location, existing systems, and whether the company already has legal, security, and operations support in place.
As an illustrative first-year planning model, not a market benchmark:
| Cost item | Illustrative range |
|---|---|
| Base salary | $199,000 |
| Bonus | $20,000–$60,000 |
| Benefits and payroll taxes | $48,000–$75,000 |
| Incremental GRC/privacy tooling | $15,000–$40,000 |
| One-time recruiting fee | $20,000–$40,000 |
| Illustrative first-year total | $302,000–$414,000 |
1bigthink's DPO Service is currently priced at $5,000 to $9,000 a month, or $60,000 to $108,000 a year, under its standard scope. On these assumptions, the illustrative first-year difference runs $194,000 to $354,000. This is a planning comparison, not a claim that outsourced support is equivalent to every in-house leadership role, or that every company will incur the listed costs.
For broader context, the IAPP's 2025 to 2026 salary survey reports global average total financial compensation of about $200,000 across privacy, AI governance, and cybersecurity-related roles. That figure isn't specific to Head of Privacy or DPO roles, and it excludes employee benefits.
The question isn't the title. It's whether there's a full-time load of work. One 1bigthink client's operations lead told us: "I don't think there's quite enough work for a full-time role." That is one company's view of its own workload, not a benchmark for others in a similar position. Another 1bigthink client never seriously considered a full-time hire either, for the same reason: the work wasn't intensive enough for a company its size.
You don't have to close the posting to test the alternative. 1bigthink's DPO Service runs as Build then Run, with the same monthly fee throughout, and starts with the highest-risk parts of your program. It carries a three-month initial commitment, then goes month to month. That means it can cover the seat while a search runs, and it commits you to a quarter at most.
If you find the right person, hire them. If the load turns out to be smaller than the posting implied, you'll know that too.
It depends on seniority, location, benefits, existing tools, recruiting method, and whether the company already has legal, security, and operations support. As an illustrative first-year model, base salary, bonus, benefits and payroll taxes, recruiting fees, and incremental tooling can total $302,000 to $414,000. 1bigthink's DPO Service is priced at $60,000 to $108,000 a year. On those assumptions, the first-year difference runs $194,000 to $354,000, not a guaranteed savings figure. The IAPP's 2025 to 2026 survey separately puts global average total compensation across privacy, AI governance, and cybersecurity roles at about $200,000, excluding benefits.
SHRM's 2026 benchmark shows a median of 45 calendar days to fill executive positions, measured from opening the requisition to offer acceptance, not first day. Specialized regulated roles tend to take longer, though there's no privacy-specific benchmark for that.
No. GDPR requires a DPO only in defined cases under Article 37: public authorities and bodies, except courts acting in their judicial capacity; controllers or processors whose core activities involve regular and systematic monitoring of individuals on a large scale; and those whose core activities involve large-scale processing of special category data or data relating to criminal convictions and offences. If your Head of Privacy is designated as DPO, Article 38 independence rules apply: no instructions on the tasks, a reporting line to top management, and no conflicting duties.
Yes. GDPR allows the DPO to be an employee or to work under a service contract. Either way, the company has to keep the DPO properly involved and resourced, give them access to the information they need, avoid creating conflicts, and keep them reachable for regulators and individuals.
