A Belgian federal public service responsible for food-chain oversight is maintaining its statutory data protection officer (DPO) function. The role covers GDPR compliance, the register of processing activities, DPIAs, personal data breach response and secure data exchange between government organisations, with direct advisory access to senior management.
The mission
The DPO sits in a Brussels-based staff function within the federal administration in Belgium, reports to senior management and operates independently without a direct team. The remit covers GDPR Articles 5, 6, 24, 25, 30, 32, 33 to 36 and 37 to 39, including governance, accountability, audits, processor oversight and contact with the GBA. The DPO also participates in the monthly information security committee. The initial mandate is 3.5 months, with a possible extension following positive evaluation.
Day to day, you will identify and review processing activities across services, assessing purposes, legal bases, retention periods and data flows. You will guide new and changed processing through Data Protection Impact Assessments (DPIAs) and privacy-by-design and privacy-by-default principles. You will advise on contracts, incidents, digitalisation projects and secure data exchange, while documenting recommendations and reporting compliance risks and improvement actions. Your work translates regulatory requirements into procedures and decisions that operational and non-legal colleagues can apply.
Your responsibilities
- Establish and monitor a coherent data protection governance framework covering roles, policies, guidelines, procedures, controls and reporting.
- Maintain oversight of the register of processing activities, ensuring that services document purposes, legal bases, retention periods and data flows.
- Lead the review of DPIAs, track mitigating measures and advise on prior consultation with the supervisory authority where required.
- Direct the assessment and escalation of personal data breaches, including the 72-hour notification obligation and communication with affected individuals when necessary.
- Review processor agreements, data protection clauses and cooperation arrangements, while supporting audits, inspections and compliance controls.
- Develop awareness initiatives and provide a central contact point for employees, management and data subjects with privacy-related questions or incidents.
Your profile
Essential skills
- Bring at least 8 years of professional experience, including at least 5 years in personal data protection and 5 years leading the development and implementation of related policies, guidelines, procedures and control rules.
- Apply thorough knowledge of the GDPR, data protection principles and related legislation, including the requirements of Articles 5, 6, 24, 25, 30, 32, 33 to 36 and 37 to 39.
- Use risk analysis methodologies, including DPIA models, with 5 to 7 years of relevant experience.
- Demonstrate at least 4 years of technical knowledge of secure data exchange between government organisations.
- Analyse processor agreements, contractual clauses and cooperation agreements, and support data protection audits, inspections and controls.
- Work independently, protect confidential information, identify risks early and make clear recommendations during data breach decisions.
- Explain complex regulation to non-legal audiences and provide practical advice to management and operational services.
- Provide at least three references from external DPO assignments for large organisations.
Languages
- Dutch: C2 or equivalent if this is your fully mastered national language, otherwise B2 or higher for fluent professional comprehension and expression.
- French: C2 or equivalent if this is your fully mastered national language, otherwise B2 or higher for fluent professional comprehension and expression.