Need cover now? See Formiti’s Interim DPO Service, or for long-term support our Global Outsourced DPO Service.
When a Data Protection Officer hands in their notice, the recruitment process begins — agencies are briefed, the role is advertised, and the shortlist takes shape. Meanwhile, processing continues without pause. Data subject access requests keep arriving. Marketing launches a new campaign. HR opens three vacancies and the applicant tracking system starts collecting CVs, right-to-work documents, and diversity monitoring data from hundreds of candidates, with no designated officer reviewing any of it.
Recruiting a senior internal DPO is rarely quick. Between notice periods, specialist vetting, and the depth of expertise the role demands, organisations frequently find themselves without cover for months rather than weeks. Under Article 37 of the UK GDPR and EU GDPR, if your organisation is required to designate a DPO, that obligation does not pause while you recruit. A vacancy is not a defence.
An interim DPO service bridges that gap — but the point is not simply to keep a name on the register. The right interim data protection officer treats the vacancy as a structured audit window: a defined period to examine what the departing DPO left behind, identify where compliance has quietly decayed, and hand the incoming permanent hire a programme that is documented and defensible rather than one they must reverse-engineer from scratch.
Formiti Consulting's Global Privacy & AI Governance Managed Services including outsourced DPO, cross-border representation, and the Privacy360 governance platform are designed precisely for this moment. The seven audits below set out what a competent interim engagement should deliver — and why each one matters before your next permanent DPO walks through the door.
1. Conducting a Full Privacy Programme Audit
The first task of any competent interim data protection officer is to establish what actually exists, as opposed to what the organisation believes exists. Privacy programmes decay quietly. A policy approved three years ago may still sit on the intranet while the business process it governs has been rebuilt twice.
Start with a documentary inventory: privacy notices, internal policies, retention schedules, DPIA templates, consent records, training materials, and the register of processing. Each item needs two assessments — does it exist, and does it reflect current operations? A retention schedule that omits the applicant tracking system is worse than no schedule at all, because it creates a documented expectation the organisation is visibly failing to meet.
Next, measure the inventory against the applicable legal framework. For most UK and EU organisations that means UK GDPR, EU GDPR, the Data Protection Act 2018, and any sector-specific obligations. Multinationals need the same exercise repeated across every jurisdiction where they establish a presence or monitor behaviour — a scope that Formiti Consulting's Privacy360 platform is built to support across 120+ jurisdictions.
The output must be a written privacy audit report with findings ranked by regulatory exposure, not alphabetically or by department. Prioritised remediation gives the executive something to fund and the incoming permanent DPO something to inherit. An undated verbal summary gives neither of them anything.
2. Assessing Your Current Data Mapping and Records of Processing
Article 30 records are the backbone of any GDPR compliance audit, and they are usually the first artefact to fall out of date when a DPO leaves. Processing activities get added by business units who have no idea the register exists.
Formiti's interim DPO will rebuild the Record of Processing Activities from operational evidence rather than from the previous version. Interview process owners. Pull system inventories from IT. Ask HR which recruitment platforms, assessment tools and background screening providers currently hold candidate data — this category is routinely missing from registers because recruitment is treated as an HR workflow rather than a processing activity.
Record of Processing Activities software makes this maintainable once established, but the initial reconstruction demands human interrogation.
Each entry needs a stated lawful basis that survives scrutiny. Legitimate interests claimed for candidate profiling without a balancing test is a finding. Consent relied upon where the employment relationship makes it non-freely-given is a finding. Record both.
Cross-border transfers deserve separate treatment. Verify that each international flow has a valid mechanism — adequacy, standard contractual clauses, or an approved alternative — and that a transfer risk assessment exists where one is required. Recruitment data moves internationally more often than most organisations realise, particularly where the ATS vendor hosts outside the UK or EEA.
3. Reviewing and Strengthening Data Subject Rights Processes
Data subject rights are where compliance failure becomes visible to the regulator, because the complaint comes directly from the individual. During a DPO vacancy, requests don't stop — they simply route to whoever last handled one. Engaging an outsourced DPO through Formiti Consulting's Global Privacy & AI Governance Managed Services ensures that routing has a competent, accountable destination from day one.
Formiti Consulting's interim DPO will trace the full lifecycle of a request as it genuinely operates. Who receives it? How is identity verified? Where is the clock started and who monitors it? Unsuccessful candidates are a particular risk group: rejection prompts subject access requests, and those requests reach into interview notes, scoring matrices, internal email commentary and any automated screening logic applied to the application. Many organisations discover at this point that hiring managers keep assessment notes in personal files that no fulfilment process will ever find.
Erasure and rectification need the same treatment. If a candidate asks for deletion, does the request propagate to the ATS, the agency that submitted them, the assessment platform and the backup estate — or only to the first of those?
Document where the bottlenecks sit. Common ones include legal review queues with no service level, redaction performed manually by staff with no training in third-party data, and no defined escalation when a request is complex enough to justify an extension. Fixing the workflow during the gap prevents the incoming permanent DPO inheriting a backlog of statutory breaches — and gives them a process that is already documented and defensible rather than one they must reconstruct from scratch.
4. Evaluating Third-Party and Vendor Privacy Risk
Your data protection compliance position is only as strong as the weakest processor acting on your instruction. Vendor oversight is also the discipline most likely to lapse without a DPO, because procurement will keep signing contracts regardless of whether anyone is reviewing the data protection terms.
As part of a structured privacy audit, Formiti Consulting's interim DPO will assemble a current processor list and test each relationship against three questions: is there a written Article 28 agreement in place, does it contain the mandated terms, and does the vendor's actual processing match what the agreement permits?
Recruitment is where this privacy audit tends to produce the most findings. Recruitment agencies frequently operate as independent controllers while the hiring organisation assumes they are processors — or the reverse — with no documented allocation of responsibility. Job boards, video interview platforms, psychometric assessment providers and background screening firms each sit in the candidate data chain, and each may be sub-processing to parties the organisation has never assessed.
Prioritise by risk rather than contract value. A small assessment vendor handling special category data on thousands of applicants warrants more attention than a high-spend supplier processing nothing personal. For high-risk processors lacking adequate terms, the interim DPO should draft remediation letters and track responses, so the permanent hire receives a live register rather than an open question.
5. Assessing Technical and Organisational Security Measures
Article 32 requires security appropriate to the risk, and "appropriate" is a moving standard. Measures documented two years ago may no longer reflect either the threat landscape or the organisation's own architecture after a cloud migration or a new platform rollout.
Formiti's interim DPO will not perform a penetration test. The mandate is to establish whether the technical and organisational measures described in policy and in processor contracts correspond to what IT has actually implemented, and whether that implementation is proportionate to the sensitivity of the data involved.
Focus on access control first. Who can see candidate records, and does that access end when a hiring manager's involvement in a vacancy ends? Over-provisioned ATS permissions are routine and rarely reviewed. Then examine encryption in transit and at rest, retention enforcement in storage systems, logging and monitoring coverage, and whether privileged access is subject to any review cycle.
Incident detection deserves specific attention. A measure that identifies a breach three weeks after it occurs cannot support a 72-hour notification obligation, however well documented the notification procedure itself may be.
Record each gap with a technical owner and a target date. Findings that sit between legal and IT with no named owner are the ones that survive multiple DPO tenures untouched — which is precisely why combining legal and technical expertise in one engagement produces results that a purely advisory review does not.
6. Strengthening Staff Training and Privacy Awareness
Training records are easy to produce and frequently meaningless. A completion rate of ninety-something per cent tells you how many people clicked through a module, not whether any behaviour changed.
The interim DPO should begin by establishing coverage honestly: which populations have been trained, when, on what content, and whether new joiners and role-changers are captured by any automatic trigger. Gaps usually cluster around contractors, seasonal staff and senior leadership — three groups with significant data access and the least patience for mandatory e-learning.
Then target the teams whose daily work carries the highest exposure. Hiring managers are an obvious priority during a recruitment-heavy period. They make retention decisions about CVs, write interview notes that will later be disclosed under subject access, and share candidate details across channels that were never designed for personal data. Generic awareness training does not equip them for any of that.
Role-specific sessions work better than universal modules. A thirty-minute briefing for hiring managers covering what to write in interview notes, where candidate data may and may not be stored, and how long applications are retained will prevent more incidents than an annual all-staff course.
Capture attendance and content so the permanent DPO can evidence the programme to a supervisory authority without reconstructing it.
7. Preparing for Regulatory Readiness and Incident Response
A DPO vacancy is exactly when an organisation is least prepared to handle a breach, and regulators do not adjust the 72-hour clock to accommodate staffing changes.
The interim DPO should first verify the mechanics. Who in the organisation can declare an incident? Is there a documented decision path for assessing whether notification is required, and who holds authority to make that call at two in the morning on a Saturday? Many procedures name a role that no longer exists or an individual who has left.
Confirm that supervisory authority details are correct and that the organisation knows which authority leads. Multinationals operating under the one-stop-shop need their lead authority identified and their Article 27 representative arrangements current, particularly where an outsourced DPO or representative was appointed by the departing officer.
A tabletop exercise converts a written procedure into a tested one. Run a realistic scenario — an ATS misconfiguration exposing candidate records to another employer's account is a good one, because it involves HR, IT, legal and communications simultaneously. Time the decisions. Note where the exercise stalls.
The output is a revised playbook with named deputies, tested escalation routes and a breach register ready for use. That document is one of the most valuable things a permanent DPO can inherit on day one.
Why the Recruitment Gap Is the Right Time to Improve, Not Just Maintain
There is a structural reason the vacancy is the best available window for this work. A permanent DPO arriving into an unaudited programme spends their first six months doing discovery — building relationships, locating documents, working out which registers are trustworthy. That is time spent establishing a baseline rather than acting on one.
An interim data protection officer performs that discovery before the permanent hire walks through the door, and does so with the specific advantage of having no internal history to protect. They have no prior approvals to defend, no relationships to preserve and no reason to soften a finding. The audit is more candid because the auditor is temporary.
The incoming DPO then starts from a documented position: a current ROPA, a ranked remediation plan, a tested incident playbook and a vendor register with known gaps and open actions. They can begin executing in week one.
Remediation also costs less when it is scheduled rather than forced. Addressing a lawful basis problem during a planned audit is a drafting exercise; addressing it after a complaint is a regulatory engagement. Organisations that treat the gap as an improvement phase pay the lower of those two prices.
How Formiti's Interim DPO Service Works
Formiti Consulting's Interim DPO Service is built to close the DPO recruitment gap without leaving your compliance programme on pause. The engagement is structured around the Three-Team Methodology: legal consultants who interpret obligations across every jurisdiction you operate in, privacy architects who translate those obligations into process design, and technical operations who implement the controls and evidence trails.
Most interim arrangements supply one of those three disciplines. The gap between legal advice and operational delivery is where compliance programmes stall — and where regulatory exposure quietly accumulates.
Each engagement begins with the audit sequence set out above and produces documented findings with named owners, priorities, and target dates. Not a verbal assessment that leaves with the consultant.
Formiti Consulting delivers the work on the Privacy360 platform, which maintains audit-ready records across 120+ jurisdictions. Records of processing, DSAR workflows, vendor registers, training evidence, and incident logs sit in one governed system rather than across spreadsheets held by individuals who may themselves be leaving. That matters most at handover — which is precisely the moment a DPO recruitment gap makes most organisations vulnerable.
When the permanent DPO joins, they receive platform access, a current compliance baseline, and a structured briefing on every open action. Formiti Consulting can then step back entirely, remain available for cross-border representation, or continue as outsourced DPO support in jurisdictions where no internal resource exists.
To learn more, visit Formiti Consulting's Interim DPO Service.
Conclusion: Turn the Gap Into a Compliance Advantage
Seven audits define a well-run interim engagement: a full privacy programme review, reconstruction of your Article 30 records, an examination of data subject rights workflows, a vendor and processor assessment, a review of technical and organisational measures, targeted training for high-exposure teams, and a tested incident response capability. Each produces documentation your permanent DPO can act on immediately.
A DPO recruitment gap represents a period of elevated regulatory exposure whether or not you use it productively. The cost of engaging an outsourced DPO through Formiti Consulting's Global Privacy & AI Governance Managed Services is fixed and known. The cost of discovering an unlawful candidate data flow through a complaint rather than an audit is neither.
Treat the vacancy as the audit window it is. Contact Formiti Consulting to explore how our Interim DPO Service — part of our Global Privacy & AI Governance Managed Services including outsourced DPO, cross-border representation, and the Privacy360 governance platform — can support your organisation. Give your incoming permanent hire a baseline that is documented, defensible, and ready for a supervisory authority to examine.