The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Privacy Specialist / Junior Counsel (In-house)
3-5 yearsSkills to master
- Mastering DSAR fulfilment, conducting initial PIA reviews, maintaining RoPA, reviewing standard contracts, and providing basic privacy advice.
You're ready to move on when
- Consistently delivering accurate and timely responses to data subject requests.
- Successfully completing all assigned PIA reviews with minimal supervision.
- Proactively identifying and escalating privacy risks within routine tasks.
- Demonstrating strong foundational knowledge of GDPR and DPA 2018.
- 2
Associate / Senior Associate (Private Practice Law Firm)
4-6 yearsSkills to master
- Developing expertise in specific areas of privacy law, drafting and negotiating complex privacy clauses, advising multiple clients on diverse privacy challenges, and managing client relationships.
You're ready to move on when
- Successfully leading client engagements on privacy matters.
- Consistently receiving positive client feedback on advice and deliverables.
- Demonstrating the ability to manage multiple complex privacy projects simultaneously.
- Developing a specialism in a particular area of privacy (e.g., adtech, health data).
- 3
Data Protection Officer (DPO) for a smaller organisation
3-5 yearsSkills to master
- Taking full ownership of a privacy programme, managing all aspects of compliance, engaging with senior leadership, and acting as the primary point of contact for regulators.
You're ready to move on when
- Successfully establishing and maintaining a privacy compliance framework.
- Effectively advising senior management on privacy risks and strategy.
- Managing regulatory interactions and inquiries independently.
- Demonstrating strong project management and organisational skills.