Data Protection Officer CV Example & Template
A complete two-page CV for a data protection officer with five years in privacy, first in a law firm and now in a 1,200-person health charity. It is followed by what hiring managers check first. Reuse the structure, swap in your own sector and figures, and be exact about which law and which qualification you mean.
Last reviewed October 2026
Example Data Protection Officer CV
Helen Marsh
Data Protection Officer, UK GDPR and health data, CIPP/E
Birmingham, UK
Profile
Data protection officer with five years in privacy and compliance, now responsible for UK GDPR across a health charity with 1,200 staff and volunteers. I run DPIAs, manage breach response and subject access requests, and train staff in plain language. I report to the board's audit committee. Looking for a DPO or head of privacy role in healthcare, education or the public sector.
Experience
Data Protection Officer
Feb 2023 – Present
Midlands Health Alliance (charity) · Birmingham
- Report to the audit committee each quarter on risk, incidents and requests; set up the first register of processing activities covering 64 activities across 11 teams.
- Completed 27 DPIAs for new systems, including a patient messaging platform and a volunteer app, and agreed mitigations with project owners before launch.
- Run the personal data breach process: 38 incidents logged in 2025, 3 reported to the ICO, every one assessed and recorded within 72 hours of becoming aware.
- Cut average subject access request handling time from 41 days to 22 by adding a triage template and a redaction workflow for the legal team.
Privacy and Compliance Officer
Jan 2021 – Jan 2023
Hartley Dunmore Solicitors · Birmingham
- Advised 40 corporate clients on UK GDPR compliance, covering lawful basis, retention, controller and processor contracts and international transfers.
- Reviewed and negotiated 120 data processing agreements for the firm and its clients, using a standard clause set that shortened turnaround to 5 working days.
- Delivered privacy training to 300 staff across four offices; follow-up quiz scores rose from 64% to 91%.
- Handled the firm's own data subject requests and two reportable breaches, working with the managing partner on communication to clients.
Compliance Assistant
Aug 2019 – Dec 2020
Regency Mutual Society · Coventry
- Maintained the data retention schedule and checked deletion for 9 business systems against it each quarter.
- Logged and tracked subject access requests and complaints, meeting the one-month deadline on 96% of requests.
- Drafted privacy notices and cookie wording for the website with the marketing team.
Education
LLM Information Law and Policy (part-time)
2020 – 2022
University of Birmingham
Dissertation on legitimate interests assessments in charity fundraising.
LLB (Hons) Law, 2:1
2016 – 2019
University of Leicester
Skills
UK GDPR and Data Protection Act 2018 · DPIAs and legitimate interests assessments · Personal data breach management · Subject access requests · Records of processing activities · Data processing agreements · International transfers · Privacy by design · Staff training and awareness · Supplier and vendor privacy due diligence · Board and committee reporting
Certifications
- Certified Information Privacy Professional/Europe (CIPP/E), IAPP, 2022
Why this Data Protection Officer CV works: what shortlisters check first
The right law, named exactly
Say whether you work under UK GDPR and the Data Protection Act 2018, EU GDPR, or both, and name other regimes you handle, such as the Privacy and Electronic Communications Regulations. Employers hiring a DPO in the UK want UK law named, not a vague mention of GDPR. If you work across regions, say which ones.
Professional expertise, not a title only
The ICO says a DPO should be chosen for experience and expert knowledge of data protection law, at a level that matches the risk of the processing. Show it with DPIAs completed, breach cases handled, contracts reviewed and requests answered, plus any qualification such as the IAPP's CIPP/E, which covers European data protection law.
Independence and a line to senior management
A DPO is expected to act independently, have adequate resources and report to the highest management level, and must not hold a role that decides why and how personal data is used. State who you report to, how often, and any case where your advice shaped a decision. This tells a shortlister you understand the post.
Numbers from the privacy function
Number of DPIAs, breaches logged and reported, subject access request timings, training completion, processing records and contracts reviewed. These are already tracked in most privacy teams. Add the sector, since healthcare, education, financial services and tech each carry different risks and different regulators.
Practical skill with the business
A DPO who only says no is not hired twice. Show cases where you helped a team launch with safeguards: a DPIA that changed a design, a processor contract that was renegotiated, a short training course that cut mistakes. Hiring managers read this as the ability to work with product, legal and IT.
Key skills recruiters look for
How to write each section of a Data Protection Officer CV
Profile
State the law you work under, your sector, size of organisation and who you report to. Add one proof point, such as number of DPIAs or time to answer requests. Avoid 'passionate about privacy'. Make it clear whether you are an internal DPO, an external one or a privacy lead who is not a formal DPO.
Experience
Give each bullet an action, a volume and an outcome: DPIAs completed and what changed, breaches handled and reporting decisions, requests answered and how fast. If you were the formal DPO, say so and name the reporting line. If you advised a DPO, describe your share of the work honestly.
Qualifications
List your degree and any information law or privacy qualification, then certifications with the year, for example CIPP/E, and the issuing body. Say which are current. Do not list a certification you have let lapse without saying so, and avoid claiming a professional status that does not exist.
Skills
Name the practical tools and processes: DPIA, LIA, ROPA, DPA review, breach register, SAR workflow, transfer risk assessment. Add any privacy platform you use, such as OneTrust, if it is true. Use the terms the job advert uses, as recruiters filter on them.
Cover letter
Say which sector you know, which regulator you have dealt with and how you work with senior management. One short example of a decision you influenced is worth more than a paragraph on your values. Mention whether you can act as DPO for several entities if the role asks for it.
More example bullet points
Strong Data Protection Officer CVs lead with measurable impact. Here are examples of the kind of bullets that make recruiters stop scrolling:
Designed and deployed GDPR compliance program across 8 EU entities, passing German DPA audit with zero findings within 14 months
Responded to and resolved 95% of data subject access requests within statutory deadline over 2 years, across a user base of 2M+
Reduced third-party data risk exposure by 70% through vendor DPA review program covering 120 processors
Relevant certifications
Common Data Protection Officer CV mistakes
- Writing 'GDPR' without saying whether you mean UK GDPR, EU GDPR or both.
- Listing a DPO title with no DPIAs, breaches or requests to show what you did.
- Claiming independence while also owning a function that decides how data is used, such as marketing or IT.
- Putting a lapsed certification on the CV without saying it has lapsed.
- Describing training as 'raised awareness' with no number of people or measured result.
Free, no signup
Check your Data Protection Officer CV for ATS problems →
How to tailor your Data Protection Officer CV for each application
Every Data Protection Officer job posting is different. The skills they prioritize, the seniority they expect, the setting — all of it shapes what your CV should emphasize. A CV that gets an interview at one employer can miss at another, even for the same job title.
The fastest way to tailor your CV is to paste the job description into NextCV. The AI reads the posting, maps it to your experience, and rewrites your bullets to match what the employer is scanning for. 1 free preview, no signup required — you only pay when you want a clean PDF download. Sign up free for 3 more.
Data Protection Officer CV FAQ
Do you need a qualification to be a data protection officer?
The law does not set a specific qualification. The ICO says a DPO should have experience and expert knowledge of data protection law, matched to the complexity and risk of the organisation's processing. Many employers look for a law or information law degree, or a certification like CIPP/E.
What is CIPP/E and should it be on my CV?
CIPP/E is the IAPP's Certified Information Privacy Professional/Europe designation, showing knowledge of European data protection law. List it with the year and issuing body if you hold it. It is widely requested in DPO adverts alongside practical experience.
When must an organisation have a DPO under UK GDPR?
The ICO says you must appoint one if you are a public authority, or if your core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special category or criminal offence data. Others may appoint one voluntarily.
How long should a DPO CV be?
Two pages. Put the profile, law and sector, certifications and your current role's key figures on page one. Older roles can be brief. If you also hold board-level responsibility or work as an external DPO for several clients, say so near the top.
Can I move into data protection from another field?
Yes, from legal, compliance, IT security, records management or risk roles. Show tasks that overlap, such as contract review, audits or incident response, add a recognised privacy certification, and start with a privacy officer or analyst role before a formal DPO post.