Privacy specialist and DPO on projects: profile and demand

Short answer: Privacy specialists and data protection officers (DPOs) work on projects either employed through staff leasing or as a freelance data protection officer, part-time or full-time. Companies need them for vacancies, data protection impact assessments, records of processing, data breaches and AI projects. In Germany, the GDPR expressly allows a DPO to work under a service contract (Art. 37(6) GDPR); in Switzerland, appointing a data protection advisor is voluntary (Art. 10 FADP).

This guide is for lawyers and privacy professionals in Switzerland and Germany who want to take on contract roles as a privacy specialist or work as an external DPO. It explains where demand comes from, what profile companies expect and how the two countries differ.

Where companies need privacy specialists on projects

Demand usually starts with a deadline or a backlog rather than with day-to-day work. Typical triggers are:

• Vacancy or absence: the DPO leaves, goes on parental leave or is unavailable, and the function has to keep running.
• Records and documentation: the record of processing activities is out of date or missing.
• Impact assessments: new systems, outsourcing or international transfers require several data protection impact assessments (DPIAs) at short notice.
• Backlogs: open access and erasure requests, data processing agreements or data breaches have to be worked through.
• AI and digital projects: regulatory change such as the EU AI Act or NIS2 creates projects where data protection and governance meet.

At Alpinum Solutions, data protection is a growth area alongside the core fields of interim legal and interim compliance. Assignments last from a few weeks to several months or longer, depending on the scope of the project.

Privacy specialist or DPO: two roles compared

The privacy specialist does the hands-on project work; the DPO holds a position protected by law. The table shows the differences.

Source: Alpinum Solutions, November 2026; GDPR and Swiss Federal Act on Data Protection (FADP).

What profile companies expect

Companies expect expert knowledge of data protection law and practical experience. In Germany, this is the legal basis for designating a DPO (Art. 37(5) GDPR).

• Legal framework: a sound command of the GDPR and the German BDSG or the Swiss FADP, depending on the country; Swiss companies with EU business often need both.
• Method: build records and DPIAs in a structured way, assess risks and document them clearly.
• Technical understanding: enough grasp of systems, data flows and cloud contracts to work as an equal with IT and procurement.
• Communication: train business units, brief management concisely and resolve conflicts objectively.
• Ready to start: on projects, impact is expected within days, not months.

How to present projects and results in your profile is covered in CV and profile for interim assignments.

Five steps to a privacy contract role

1. Choose your focus: the DPO function, project work or both, and in which industries.
2. Choose the model: employed through staff leasing or self-employed as a freelancer. The comparison is in freelancing or staff leasing employment.
3. Check your status: if you freelance, confirm that you are genuinely self-employed – in Germany under section 7 SGB IV and the status determination procedure, in Switzerland with the AHV compensation office.
4. Define workload and availability: workload ranges from 20 to 100 %, depending on need. Data breaches require clear availability, even part-time.
5. Register your availability: share your profile with your earliest start date. Alpinum Solutions usually presents two to four profiles per search.

If you want to combine several part-time roles, see interim as a part-time and portfolio career.

Switzerland and Germany: what differs

The main difference is whether appointing a DPO is mandatory.

• Germany: a DPO must be designated, among other cases, if as a rule at least 20 persons are permanently engaged in the automated processing of personal data (section 38(1) BDSG). The DPO may be an employee or work under a service contract (Art. 37(6) GDPR). This creates steady demand for interim solutions.
• Switzerland: private companies may appoint a data protection advisor but are not required to (Art. 10(1) FADP). If they consult the advisor on an impact assessment with high residual risk, they can skip consulting the Federal Data Protection and Information Commissioner (FDPIC), provided the conditions of Art. 10(3) FADP are met (Art. 23(4) FADP). Demand therefore comes more from projects than from a mandatory role.

DPOs can be engaged through staff leasing or freelancing, depending on the company's requirements and the rules in each country. The independence required by law is preserved in both models.

Limits and risks

• Dual role: if you draft a DPIA yourself and then monitor it as DPO, you are reviewing your own work. Clarify the roles before you start.
• Responsibility stays with the company: the DPO advises and monitors; the company remains responsible for complying with data protection law.
• Status risk when freelancing: if you work under instructions and are fully integrated, you may be treated as an employee.
• Liability and insurance: as a freelancer, clarify before your first assignment what liability you take on and how you are covered.

Frequently asked questions about privacy contract roles

Can I work as a freelance data protection officer?

Yes. In Germany, the GDPR expressly allows a DPO to fulfil the tasks on the basis of a service contract (Art. 37(6) GDPR). In Switzerland, the wording of the FADP does not rule out an external data protection advisor. Check your self-employed status and set out liability, availability and the term of the designation in your contract.

Do I need a DPO certification?

The law does not require a specific certificate. In Germany, what counts is professional quality and expert knowledge of data protection law and practice (Art. 37(5) GDPR). Courses and certificates can help to show your knowledge. For most companies, proven project experience with records, DPIAs and dealing with authorities carries more weight than a certificate.

Can I work as a part-time DPO?

Yes. Many roles are part-time, with workload between 20 and 100 % depending on need. What matters is that you can be reached for data breaches and regulator enquiries. Agree fixed days, response times and a deputy in writing before you accept the designation.

Are there privacy contract roles for junior profiles?

Yes, mainly in project work. Junior profiles with up to two years' experience help with records, data subject requests and contract reviews, usually led by an experienced specialist. The DPO function itself normally goes to experienced or senior profiles, because it requires independence and judgement in dealing with management.

Staff leasing or freelancing: which suits privacy work?

Staff leasing suits you if you want to stay employed and work closely with the team; the company gives professional instructions, except for the protected tasks of the DPO. Freelancing suits you if you want to run several roles on your own responsibility and carry the business risk. Both models are available part-time and full-time.

Next step

Alpinum Solutions, the leading provider of interim legal & compliance in the DACH region, fills privacy roles in Switzerland and Germany through staff leasing and freelancing, as part of 120+ assignments a year, each being temporary support for a client by one or more professionals. Share your profile if you are available for data protection projects.

• Open legal and compliance assignments and profile registration
• All guides for candidates
• Compliance career in Germany: temporary assignments as entry and switch
• Freelancing or staff leasing employment

Last updated: 11 November 2026.