DPO (K10094)

About the Position

DPO (K10094)

We are seeking a Chief Data Officer (CDO) with expertise in GDPR and data protection to join our federal government agency in Belgium.

Context and Role Overview

This is a critical role as the Data Protection Officer (DPO) is a legally mandated position within a federal government service. The DPO of the FAVV works within the staff service of the delegated director: IAQP. The DPO reports to the director of IAQP and the delegated director. The DPO operates independently and does not have a team.

The role of the DPO is legally described in articles 38 and 39 of the GDPR. The DPO's tasks include overseeing compliance with the GDPR. The DPO will assist the data controller or processor in ensuring internal compliance with the GDPR. This oversight may include:

• Collecting information to identify processing activities;
• Analyzing and checking the conformity of the organization's processing activities;
• Providing information, advice, and recommendations to the data controller or processor.

Responsibilities

Governance & Oversight

• Overseeing compliance with the GDPR, privacy legislation, and relevant regulations;
• Advising management and services on their data protection obligations;
• Contributing to the development, documentation, and follow-up of a coherent framework of roles, responsibilities, procedures, and reporting mechanisms for data protection within the FAVV;
• Reporting to the highest management level on the status, risks, and improvement points regarding data protection;
• Ensuring the independence of the DPO function and avoiding conflicts of interest.

Register of Processing Activities

• Overseeing the establishment, maintenance, and updating of the register of processing activities (Article 30 GDPR);
• Supporting internal services in identifying and documenting personal data processing;
• Evaluating processing purposes, legal bases, retention periods, and data flows.

Data Protection Impact Assessments (DPIA)

• Advising on the need to conduct DPIAs;
• Guiding and reviewing DPIAs for new or modified processing;
• Monitoring mitigating measures and following up on residual risks;
• Advising on prior consultation with the Data Protection Authority if required.

Policy Role & Strategic Advice

• Contributing to the development, evaluation, and updating of the FAVV's data protection policy;
• Advising on strategic choices, new initiatives, and digitalization projects from a data protection perspective;
• Integrating data protection into broader governance, compliance, and risk management frameworks;
• Identifying structural bottlenecks and formulating policy recommendations to management;
• Formulating policy recommendations in the field of personal data protection and coordinating the drafting and implementation of policy plans, guidelines, procedures, and control arrangements based on legislation, case law, and legal doctrine.

Data Breaches & Incidents

• Advising on the assessment and handling of personal data breaches;
• Overseeing compliance with legal notification obligations, including notification to the Data Protection Authority (DPA) within 72 hours in accordance with Article 33 GDPR;
• Advising on and following up on the notification to data subjects if required (Article 34 GDPR);
• Supporting the organization in setting up a permanence and escalation mechanism so that data breaches can be assessed and reported in a timely manner, even outside normal office hours;
• Evaluating the causes of data breaches and formulating recommendations for corrective and preventive measures.

Contracts & Processors

• Advising on processor agreements and data protection clauses;
• Overseeing compliance with GDPR requirements by processors and partners;
• Identifying privacy risks in outsourcing and cooperation arrangements;
• Acting as a contact point for the Data Protection Authority (DPA);
• Cooperating with other supervisory authorities if relevant;
• Member of the FAVV Information Security Committee (monthly meeting).

Awareness & Training

• Developing and supporting data protection awareness and training initiatives;
• Acting as a contact point for FAVV employees on questions about personal data ("helpdesk function");
• Contributing to a privacy-conscious organizational culture.

Helpdesk Function

• Acting as the central helpdesk within the FAVV for all questions, reports, and signals related to personal data;
• First point of contact for employees, management, and services for questions, new projects, or changes in processing;
• Receiving, registering, and coordinating reports of possible incidents or risks;
• Acting as a low-threshold contact point for data subjects regarding data protection.

Requirements

Must Have

• Essential GDPR-specific responsibilities:
  • Overseeing compliance with Articles 5, 6, 24, 25, 30, 32, 33–36, and 37–39 GDPR;
  • Advising on and following up on privacy-by-design and privacy-by-default principles;
  • Documenting advice and recommendations to ensure accountability;
  • Supporting data protection audits, inspections, and controls;
  • Preparing periodic reports on compliance, risks, and improvement actions.

Nice to Have

• Knowledge of NIS2, Cyfun;
• Experience working in a government service.

Experience and Expertise

• Proven in-depth knowledge of the GDPR, data protection principles, and related legislation. Sufficient legal affinity to analyze and advise on contractual clauses, processor agreements, and data protection cooperation agreements. At least 8 years of experience.
• At least 5 years of relevant experience in data protection.
• Experience with risk analysis methodologies (such as DPIA models): 5-7 years.
• Technical knowledge of secure data exchange between government organizations: 4 years.
• Steering the development and implementation of policies, guidelines, procedures, and control rules regarding the protection of personal data to ensure that the organization effectively protects the personal data of individuals: 5 years.
• You have at least three references from assignments as an external DPO at large organizations.

Key Behavioral Competencies

• Communication and Collaboration;
• Integrity (strict handling of secrets and sensitive information);
• Independent work (daring to intervene in incorrect decisions);
• Analytical ability (quickly identifying where the risks lie);
• Proactive and decisive (identifying problems before they go wrong, making clear choices in data breaches);
• Ability to make complex regulations accessible to non-legal target groups.

Language Skills

The FAVV is a federal government service where both Dutch and French are the working languages. The DPO must master at least one of these two languages perfectly and be able to understand and express themselves fluently in the other national language.

Duration of the Assignment

Initial assignment of 3.5 months. Extension is possible after a positive evaluation.

We Offer

• Competitive salary
• Professional development opportunities
• Flexible working arrangements

About the Company

The FAVV is a federal government service dedicated to ensuring the protection of personal data and compliance with data protection regulations.

Apply Now

Interested candidates can apply through our application portal.