INTERIM COMPLIANCE · DATA PROTECTION · AI GOVERNANCE
Interim data protection officer and AI Act legal support
Alpinum Solutions provides companies in Switzerland, Germany and Austria with an interim data protection officer or data protection and AI governance professionals for projects – when the DPO role is vacant, GDPR work has built up, or you need AI Act legal support to implement the regulation. The professionals work through staff leasing or freelancing, part-time or full-time, as an individual or a team; your company sets scope, priorities and reporting lines.
This page is for management boards, heads of legal and heads of compliance, information security and IT leads, and data protection teams who need to bridge a gap or deliver a project against a deadline. It covers temporary appointments and projects, not a permanent external DPO mandate. IT contracts and technology law are covered by our IT, Technology & Data Privacy Law practice area. Alpinum does not give legal advice; we provide the professionals.
Typical assignments in data protection and AI governance
DPO role during a vacancy or absence
Your data protection officer has resigned, is on parental leave or on long-term sick leave. An interim professional takes on the role or the operational data protection work until the position is filled – often for several months, part-time or full-time depending on company size.
Backlog of access requests and records
Data subject requests, the record of processing activities and data processing agreements have piled up. A junior or experienced profile clears the backlog and sets up a deadline tracker, typically over a few weeks to a few months.
Follow-up after a data breach
After a breach, measures need implementing, notification processes tightening and staff training. An experienced professional coordinates the follow-up with IT security and communications, usually full-time for the first weeks.
Inventory and governance for AI applications
Business units use AI tools without anyone having the full picture. A team records the applications, assigns responsibilities and drafts policies and approval processes – as a project over several months, often part-time alongside day-to-day work.
Data protection organisation after an acquisition
After an acquisition or reorganisation, data protection processes, roles and documentation across several entities need to be merged. A senior profile plans and leads the integration, often for several months or longer.
Interim data protection officer: what applies in Germany and Switzerland
Legal basis and status
Whether an interim professional takes on the role itself or carries the operational data protection work depends on the country and your organisation. The points below are based on the official legal texts (retrieved 30 Oct 2026); they do not replace a legal assessment of your case.
Germany
A data protection officer may be an employee of the company or fulfil the tasks on the basis of a service contract (Art. 37(6) GDPR). When performing their tasks, they do not receive instructions (Art. 38(3) GDPR). Under Section 38(1) BDSG, a designation is generally required from 20 persons constantly engaged in the automated processing of personal data.
Switzerland
Private companies may voluntarily appoint a data protection advisor (Art. 10(1) FADP); according to the Federal Council's dispatch, this can also be a third party. The requirements are set out in Art. 10(3) FADP.
Austria
We do not describe a separate legal position for Austria here. Whether the role itself or only the operational work is transferred is a question for your legal department or law firm.
What this means for the assignment
Our professionals can generally take on the role of data protection officer under both staff leasing and freelancing – depending on your requirements and the rules in each country. Statutory independence is maintained.
Data protection and AI governance profiles – from junior to senior
Junior (0–2 years)
Handling access requests, maintaining the record of processing activities, checklist-based review of data processing agreements, preparing training material.
Experienced (3–6 years)
Data protection impact assessments, advising business units on new processing, incident handling, contributing to the AI inventory and policies.
Senior (7+ years)
Taking on the DPO role or leading the data protection team, building AI governance with roles and approval processes, reporting to management, managing external law firms.
Your control and the independence of the DPO role
You set scope, workload, project priorities and the reporting line. Under staff leasing, the right to give professional instructions generally lies with you and the professional works integrated into your organisation; under freelancing, they deliver the agreed mandate on their own responsibility. If the professional takes on the DPO role itself, they perform those tasks free of instructions – your control then covers the framework and resources, not the content of their assessments.
Engagement models for data protection professionals in Switzerland, Germany and Austria
Bridging the DPO role internally or joining the data protection team is often done through staff leasing; a defined project such as an AI inventory also suits freelancing. Workload ranges from 20 to 100 %, for one person or a team.
Switzerland
Staff leasing through Alpinum Solutions AG, which holds a cantonal licence and a SECO licence for staff leasing abroad, or freelancing.
Germany
Freelancing, or temporary agency work (Arbeitnehmerüberlassung) through Alpinum Solutions GmbH under the licence of the Federal Employment Agency's Hesse regional directorate. More on the country on our page interim legal counsel in Germany.
Austria
Data protection assignments in Austria run as freelancing or as staff leasing via Alpinum's German or Swiss company.
Limits
Alpinum is a staffing provider, not a law firm and not a provider of permanent external DPO mandates. Representation before supervisory authorities in proceedings and opinions on contested questions stay with your lawyers; the interim professional prepares and keeps data protection work running in-house.
Process: from an open DPO role to the right professional
01 · Clarify the situation
You describe whether the role itself or the operational work needs filling, which countries and entities are involved and which topics are urgent. This determines level, workload and model.
02 · Profile shortlist within 48 hours
We propose suitable profiles from our database of 7,500+ interviewed, professionally vetted legal & compliance professionals. You and Alpinum agree the start date together; no start date is guaranteed.
03 · Handover and onboarding
The professional receives the records, open requests, incident log and policies and meets management, IT security and business units. If they take on the role, you agree the designation and internal and external communication at the start.
04 · Ongoing assignment and handback
Regular check-ins keep priorities current. At the end, the professional hands over documentation, open items and deadlines to the successor; Alpinum handles contract, extension and administration.
What an interim data protection officer costs
Day rates by level (excluding VAT, as of 18 Oct 2026); Austria uses the German ranges:
- Junior (0–2 years): CHF 600–800 · EUR 480–720 staff leasing · EUR 720–960 freelancing
- Experienced (3–6 years): CHF 800–1,200 · EUR 720–960 staff leasing · EUR 960–1,360 freelancing
- Senior (7+ years): CHF 1,200–1,800+ · EUR 960–1,440+ staff leasing · EUR 1,360–2,000+ freelancing
For the DPO role in a mid-sized company, a part-time workload is often enough; breach follow-up or an AI inventory with a deadline usually needs a higher workload over a shorter period. More in our guide to cost models in interim legal & compliance.
Frequently asked questions about interim data protection officers and AI governance
Can an interim professional be formally designated as data protection officer?
In Germany, yes: the role can also be performed on the basis of a service contract (Art. 37(6) GDPR). In Switzerland, appointing a data protection advisor is voluntary and, according to the dispatch, also possible with a third party. We agree the right model with you before the assignment.
How does this differ from an external data protection officer?
An external DPO mandate is permanent. Our professionals bridge a gap or deliver a project while working inside your organisation; afterwards your internal solution takes over again.
What work does AI Act implementation involve?
Typically an inventory of the AI applications in use, clear responsibilities, internal policies and approval processes, training and documentation. Which obligations apply to your company is assessed by your legal department or law firm.
Does data protection stay independent during an interim assignment?
Yes. If the professional takes on the DPO role, they perform their tasks free of instructions (Art. 38(3) GDPR); statutory independence is maintained under both models.
Can one person cover both data protection and IT contracts?
Sometimes. If the focus is on contracts with IT providers and licences, an IT law profile fits better; for organisation, records and governance, a data protection profile.
Related services: interim privacy counsel for IT law and contracts · interim compliance officer · vacancy cover · all practice areas in the interim legal & compliance overview
Discuss your needs: interim support for data protection and AI governance
Tell us whether the DPO role or a project needs filling, in which countries and at what workload. You usually receive selected profiles within 48 hours.