Data protection project with an interim specialist: a typical assignment scenario

Short answer: In a data protection project, an interim data protection specialist takes on clearly defined workstreams, such as the record of processing activities, contracts with service providers or data protection impact assessments, and works under the company's direction. The company remains the controller under data protection law. Selected profiles are usually available within 48 hours; the client and Alpinum agree the start date together.

Typical assignment scenario: This guide shows how a data protection project with an interim specialist typically runs. It does not describe a single client engagement and names no clients, metrics or results. It is written for general counsel, heads of compliance and data protection leads in Switzerland and Germany.

The situation: the project is approved, the capacity is missing

A data protection project usually has a concrete trigger: an internal audit with findings, new software, an acquisition or expansion into another country. Legal or compliance knows what needs to be done but has no time for it alongside business as usual. The need is too short or too uncertain for a permanent hire.

The brief: typical workstreams in a data protection project

An interim specialist takes on the workstreams the company defines. The table shows common workstreams and the legal bases in Switzerland and Germany.

The obligations in detail are compared in our guide GDPR vs Swiss FADP (FADP: the revised Swiss Federal Act on Data Protection, DSG).

Approach and team: how the assignment usually runs

1. Define the scope: workstreams, deadlines, contacts and approval routes on a single page.
2. Choose the profile: experienced or senior depending on complexity, with experience in the relevant law and industry. The company receives two to four suitable profiles.
3. Model and workload: staff leasing (Swiss Personalverleih, German Arbeitnehmerüberlassung) if the specialist works within the team; freelancing for a defined mandate. The workload ranges from 20 to 100 percent.
4. Baseline: interviews with the business, IT and procurement; review existing documents.
5. Delivery: work through the workstreams, submit drafts for approval, report weekly.
6. Handover: hand over templates, processes and open points to the in-house team so the standard is maintained.

Which roles a larger project needs is explained in detail in our guide on legal support for data protection projects.

The data protection function: what an interim specialist can take on

In Germany, a data protection officer may fulfil the tasks on the basis of a service contract (Art. 37(6) GDPR) and does not take instructions in performing them (Art. 38(3) GDPR). In Switzerland, appointing a data protection advisor is voluntary (Art. 10 FADP). The company clarifies in advance how the role is filled, including position, expertise and potential conflicts of interest. How to bridge a vacancy in this role is shown in our guide on the data protection officer vacancy.

The outcome: how companies measure the project

What a project achieves depends on the starting point and scope; results of individual assignments are not reported here. Progress can be measured by completed workstreams, the share of service provider contracts reviewed, completed impact assessments and closed audit findings. Documented results from real assignments are in our case studies, for example on parental leave cover in a legal department.

What other companies can take from this

• Define workstreams and approval routes before the start.
• Involve the business early; without its input, every record stays incomplete.
• Plan the handover so templates and processes are maintained after the project.

Limits and risks

• Accountability: the company remains the controller and approves the results. Alpinum provides professionals and does not offer managed services with responsibility for outcomes.
• Conflicts of interest: whoever builds processes should not later be the only one monitoring them as data protection officer.
• No legal advice: Alpinum is not a law firm.

Frequently asked questions about data protection projects with an interim specialist

When does an interim data protection specialist make sense?

When a data protection project has clearly defined workstreams that the in-house team cannot handle alongside business as usual, and the need is too short or too uncertain for a permanent hire. Typical triggers are audit findings, new systems, acquisitions or entry into another country. The specialist delivers the workstreams and then hands them over to the team.

What seniority does a data protection project need?

Baselines and records of processing are often covered well by experienced profiles with three to six years of experience. Impact assessments for new technologies, sensitive data flows or the data protection function itself call for senior profiles with seven years or more. Experienced is the most common interim level. The choice depends on risk and deadline.

Can an interim specialist act as data protection officer?

In Germany, a data protection officer may fulfil the tasks on the basis of a service contract (Art. 37(6) GDPR). In Switzerland, the data protection advisor is voluntary (Art. 10 FADP), and according to the Federal Council's dispatch can also be a third party. Check position, expertise and conflicts of interest in advance, especially if the same person previously built processes in the project.

Is it the same in Switzerland and Germany?

The workstreams are similar, but the legal bases differ: Switzerland applies the FADP, Germany the GDPR together with the Federal Data Protection Act (BDSG). Companies with sites in both countries therefore usually plan the project jointly and record the differences in a table. Alpinum provides specialists for both markets.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in Switzerland and Germany and provides data protection specialists from a single mandate to a full project team. Tell us about the trigger, workstreams and timeframe of your project.

• Data protection & AI governance: specialists for data protection projects
• Legal support for data protection projects: tasks, roles and phases
• Practice & case studies: all guides and case studies on interim assignments
• EU Data Act: what legal teams must implement on contracts and data access
• Discuss your needs

Last updated: 10 November 2026.