Privacy law now sets engineering requirements, and organisations need two kinds of people to meet them: privacy engineers who build data protection into systems, and data protection officers (DPOs) who advise on and monitor compliance independently. The roles overlap in vocabulary but differ in mandate, reporting line and day-to-day work. This guide explains what each role does, the skills and tools behind it, realistic routes in from security, engineering, legal and GRC backgrounds, the certifications that help, and how careers progress. It is written for security practitioners considering a move into privacy and for managers building a privacy function. Certification facts were checked on the certifying bodies' own pages on 26 October 2026; no salary figures are given because no official source was used for them.
Key takeaways
- Two roles, two mandates. A privacy engineer designs and builds controls such as minimisation, pseudonymisation, retention and consent enforcement; a DPO is a statutory adviser and monitor under GDPR Articles 37 to 39 who must be independent of the decisions they oversee.
- Security people have a head start. Access control, logging, encryption, data classification and incident response are already half of privacy engineering; the gap is usually law, data flow mapping and privacy risk thinking.
- The DPO role is defined in law. Under the GDPR the DPO must have expert knowledge of data protection law and practice, report to the highest management level, receive resources, and must not be dismissed or penalised for performing their tasks.
- Certifications map cleanly to the split. The IAPP CIPP family proves legal knowledge, CIPM programme management, CIPT and ISACA CDPSE technical privacy; none is a legal requirement for either role.
- Conflict of interest limits combined roles. A CISO, head of IT or head of engineering who decides how personal data is processed is usually a poor choice as DPO, which shapes how you plan a move between the two tracks.
What the role does
Privacy engineer
Privacy engineers turn legal and policy requirements into system behaviour. The IAPP's description of its technologist credential captures the scope: building data protection into products and services at every stage of development, applying minimisation, limited access and encryption, and auditing infrastructure with development, legal and marketing teams. Typical work:
- Design reviews: reviewing new features and data flows against data protection by design and by default (GDPR Art. 25). See the Privacy by Design Guide for Engineering Teams.
- Data inventory: building and automating records of where personal data lives, often driven from data catalogues, discovery scanning and classification labels. See the Data Classification Guide.
- Privacy-enhancing technologies: tokenisation, pseudonymisation, aggregation, differential privacy and secure enclaves where analytics or AI needs data. See the Privacy-Enhancing Technologies Guide.
- Rights and retention automation: pipelines that find, export and delete a person's data across systems, and retention jobs that enforce schedules. See the DSAR Guide and the Data Retention and Secure Deletion Guide.
- Consent and preference enforcement: making sure a recorded choice actually changes what downstream systems do. See the Identity Data Privacy and Consent Guide.
Data protection officer
Under GDPR Article 39 the DPO's minimum tasks are to inform and advise the controller or processor and its employees of their obligations, monitor compliance (including assignment of responsibilities, awareness raising, training and audits), advise on data protection impact assessments and monitor their performance, cooperate with the supervisory authority, and act as its contact point. Article 37 makes designation mandatory for public authorities and for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special category or criminal offence data. Many organisations outside those triggers appoint one voluntarily or use a privacy lead with a different title.
| Aspect | Privacy engineer | DPO |
|---|---|---|
| Mandate | Build and operate controls | Advise, monitor, act as regulator contact (GDPR Art. 39) |
| Basis | Job design; no statutory definition | GDPR Arts. 37 to 39 and national equivalents |
| Reporting line | Engineering, security or privacy office | Highest management level (Art. 38(3)) |
| Independence | Part of delivery teams | Must not receive instructions on the exercise of tasks; protected from dismissal for performing them |
| Typical outputs | Design patterns, code, pipelines, technical DPIA input | Advice, DPIA opinions, audit findings, regulator correspondence, board reporting |
| Can be external | Contractors common | Yes: staff member or service contract (Art. 37(6)); a group may share one DPO |
Core skills and tools
| Skill area | Privacy engineer depth | DPO depth | Where a security practitioner usually stands |
|---|---|---|---|
| Data protection law (GDPR, UK GDPR, US state laws, sector laws) | Working knowledge of principles and rights | Expert, including case law and regulator guidance | Gap: start with one jurisdiction |
| Data flow mapping and records of processing | Expert, often automated | Strong: reviews and challenges | Partial, from asset inventory work |
| Privacy risk assessment and DPIAs | Technical input and mitigation design | Leads or advises, gives formal opinion | Transferable from security risk assessment |
| Access control, logging, encryption, key management | Expert | Conceptual | Strong |
| Pseudonymisation, anonymisation and PETs | Expert | Knows when each is legally sufficient | Gap |
| Software engineering and data platforms (SQL, Python, cloud data services) | Expert | Not required | Varies |
| Breach assessment and notification | Supports scoping | Leads notifiability decision with counsel | Strong on the incident side |
| Stakeholder influence and writing | High | Very high: board and regulator | Varies |
Tools you will meet: privacy management platforms for records of processing, DPIAs and request handling (see the Privacy Management Platform Buyer's Guide); data discovery and classification scanners; consent management platforms; data catalogues and lineage tools; and the identity stack, because who can access personal data, including service accounts and API keys that read customer data stores, is a privacy question as much as a security one.
Where identity fits: access to personal data is granted to people and to machines. A privacy engineer who can read an access review, trace which service accounts, OAuth integrations and API keys can query a customer table, and enforce least privilege on them closes a gap many privacy programmes leave open. A DPO who asks for that evidence during audits gets a far more accurate picture of who really processes the data. See the Access Reviews Guide.
Frameworks to know: the NIST Privacy Framework version 1.0 (version 1.1 is still a draft) and its companion Privacy Workforce Taxonomy; ISO/IEC 27701 for a privacy information management system (see the ISO/IEC 27701 Privacy Information Management Guide); NIST SP 800-53 Rev. 5 controls such as PM-18 (Privacy Program Plan), PM-19 (Privacy Program Leadership Role), PT-2 (Authority to Process Personally Identifiable Information), PT-3 (Processing Purposes) and RA-8 (Privacy Impact Assessments); and NIST CSF 2.0 GV.OC-03, which places privacy obligations inside the governance function.
Routes into the role
| Starting point | Natural target | What to add |
|---|---|---|
| Security engineer or IAM engineer | Privacy engineer | One privacy law, DPIA practice, PETs; a technical privacy credential |
| Software or data engineer | Privacy engineer | Privacy principles, threat and harm modelling, rights automation |
| GRC analyst or auditor | Privacy analyst, then DPO | Legal depth (a CIPP), DPIA and records of processing ownership |
| Lawyer or paralegal | DPO or privacy counsel | Technical literacy: data flows, security controls, incident handling |
| Incident responder | Privacy incident lead, then DPO office | Notification law across jurisdictions |
- Pick the track first: builder (privacy engineer) or adviser and monitor (DPO). The choice drives which certifications and projects matter.
- Volunteer for privacy work in your current job: contribute technical sections to DPIAs, fix a retention gap, or automate part of subject request handling. This gives evidence before a title change.
- Learn one jurisdiction properly: read the primary text, not only summaries. See the GDPR Compliance Guide for Security Teams or the US State Privacy Laws Guide.
- Certify to signal the move: a CIPP for law, CIPT or CDPSE for engineering, CIPM for programme work.
- Build a portfolio: anonymised DPIA write-ups, a data map, or a design pattern you introduced, with outcomes such as fields removed or retention shortened.
- Move internally where possible: privacy offices often recruit from security and engineering teams who already know the systems.
Certifications that help
| Credential | Body | Tests | Best for |
|---|---|---|---|
| CIPP/E, CIPP/US, CIPP/C, CIPP/A | IAPP | Jurisdiction-specific privacy law | DPO track; engineers needing legal grounding |
| CIPM | IAPP | Running a privacy programme | DPO and privacy managers |
| CIPT | IAPP | Technical privacy: building data protection into products and services | Privacy engineers |
| CDPSE | ISACA | Privacy governance, risk management and compliance, data life cycle, privacy engineering; experience application required | Privacy engineers and architects |
| AIGP | IAPP | AI governance | Privacy staff covering AI systems |
As checked on 26 October 2026: IAPP core exams have no general eligibility requirements, are scored 100 to 500 with 300 to pass, and each certification needs 20 continuing privacy education credits per two-year term plus a maintenance fee (USD 250, covered by membership). ISACA lists CDPSE at USD 575 for members and USD 760 for non-members. Prices change, so confirm on the official pages. The IAPP's Fellow of Information Privacy (FIP) combines a CIPP with CIPM, CIPT or AIGP and three years of substantially privacy-focused work. See the CIPP/E and CIPP/US Certification Guide, the CIPP/C and CIPP/A Certification Guide, the CIPM and CIPT Certification Guide and the CDPSE Certification Guide.
Progression
- Engineering ladder: privacy engineer, senior privacy engineer, privacy architect or staff engineer owning platform-wide patterns (deletion services, consent infrastructure, PETs), then head of privacy engineering.
- Advisory ladder: privacy analyst, privacy manager, DPO or deputy DPO, then group DPO or chief privacy officer with board reporting.
- Crossovers: privacy engineers move into security architecture or AI governance; DPOs move into broader GRC leadership. See the Security Architect Career Guide and the GRC Analyst Career Guide.
- Measures of progress: breadth of jurisdictions you can advise on; DPIAs led to sign-off; share of data stores covered by automated discovery; mean time to complete subject requests; retention jobs enforced by code rather than policy.
Common failure patterns in the move: security staff who treat privacy as confidentiality only and miss purpose limitation and minimisation; DPOs appointed from a role that sets the processing they must monitor, creating the conflict of interest Article 38(6) warns against; engineers who learn the law from vendor blogs rather than the regulation; and privacy programmes that ignore non-human access, such as service accounts and integrations that copy customer data into analytics or AI tools.
Practitioner checklist
- Decide whether you want to build controls (privacy engineer) or advise and monitor (DPO).
- Read GDPR Articles 5, 25, 32, 35 and 37 to 39 in full, or your jurisdiction's equivalents.
- Contribute the technical section of at least one DPIA in your current role.
- Map one real data flow end to end, including the service accounts and API keys that touch it.
- Choose one law credential (a CIPP) and one track credential (CIPT or CDPSE for engineering, CIPM for programme work).
- Learn the NIST Privacy Framework and its workforce taxonomy as a skills map.
- If aiming for DPO, check your current role for conflicts of interest before applying internally.
- Keep a portfolio of outcomes: fields removed, retention shortened, requests automated.
Standards and references
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- NIST: Privacy Framework
- IAPP: CIPT certification
- ISACA: CDPSE certification
- IAPP: Certification Candidate Handbook
- IAPP: Continuing Privacy Education Policy
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · Privacy Programme Guide for Security Teams · Privacy by Design Guide for Engineering Teams · CIPP/C and CIPP/A Certification Guide · Cybersecurity Learning Roadmap Guide