![42% of DPOs Work the Role Full Time [2026 Data]](/_astro/how-many-companies-employ-a-dpo.DY7gErUL_1xiGdc.webp)
Only 42% of Data Protection Officers dedicate their entire working time to the role, according to CEDPO's 2024 DPO Survey of more than 1,120 DPOs across Europe, published in January 2025. Most organizations that have named someone as DPO have not given that person a full-time job, a dedicated budget, or any support staff, which makes "how many companies employ a DPO" a harder question to answer than a single headcount.
Designation and employment are not the same thing. Below is what the two best-documented data sets, a pan-European DPO survey and France's own national registry, actually show about how many organizations have a DPO on paper versus a DPO doing the job at any meaningful scale.
How many companies actually give their DPO full-time hours?
CEDPO's 2024 DPO Survey, fielded by the market research firm OpinionWay to ISO 20252 standards and covering more than 1,120 DPOs across 11 European countries, found that only 42% of internal DPOs spend their entire working time on data protection tasks, while a third allocate less than half their time to the role. Budget tells a similar story: nearly half of respondents report no dedicated budget at all, only 24% can manage a budget independently, and among those with a budget the average allocation was EUR 54,000.
Figure 1: Less than half of surveyed DPOs work the role full time, and a third spend under half their working hours on it. Source: CEDPO 2024 DPO Survey, 1,120-plus respondents, published January 2025.
Staffing looks similarly thin. 42% of DPOs work entirely alone with no support staff, another 19% have exactly one full-time-equivalent colleague, and a further 19% have two. Despite that, 55% of surveyed DPOs believe they need more support than they currently have, which is a useful caveat for any "X% of companies have a DPO" headline: naming someone to the role and giving that person the capacity to do it are two different milestones, and most organizations have only cleared the first one.
How many DPOs are registered in France right now?
France offers the freshest national count publicly available anywhere in the EU. CNIL, the French data protection authority, ran its fifth annual DPO Observatory survey between 5 and 21 November 2025 in partnership with the labor ministry's employment agency (Afpa), the French DPO association AFCDP, and the DGEFP, and its own methodology notes disclose that CNIL contacted 38,000 designated DPOs to recruit the survey's 2,390 respondents. That is the clearest current answer to how many organizations in France alone have formally named a DPO.
Figure 2: France's DPO population more than doubled between two different counting methods six years apart. Source: IAPP research (May 2019) for the 2019 figure; CNIL DPO Observatory methodology notes (November 2025) for the 2025 figure.
Treat that as directional growth rather than a precise multiple: the 2019 figure of roughly 18,000 counts unique individuals serving as DPO, while the 2025 figure of 38,000 counts CNIL's full list of designated contacts, which can include DPOs who serve more than one organization under a single registration. Both numbers are the best publicly documented count for their respective year, and the underlying direction, a French DPO population that has grown substantially since GDPR's first year, holds regardless of the exact counting method.
What share of "DPO" job titles are just a check-the-box role?
CNIL's 2025 Observatory sorted its 2,390 respondents into three profiles based on a weighted score across time dedicated, team size, budget, and domain expertise: DPO Ponctuel (minimal structure, little to no dedicated time or budget), DPO Mission (a partially structured, intermediate role), and DPO Métier (a specialized, full-time role with real resources). Only the third group looks like a fully resourced, dedicated privacy job.
Figure 3: Just 16% of surveyed French DPOs fall into the fully-dedicated "DPO Metier" profile. Source: CNIL DPO Observatory, "Les DPO a l'heure de l'IA" (published July 2026, survey fielded November 2025).
The gap between profiles is stark on every practical measure. DPO Ponctuel holders report a budget only 4% of the time and a support team only 11% of the time. DPO Mission holders report a budget 35% of the time and a team 21% of the time. DPO Metier holders report a budget 93% of the time and a team 53% of the time. In other words, roughly one in six designated DPOs in France works under conditions that would be recognizable as a normal, resourced job function.
Does company size decide whether the DPO role is real or symbolic?
Company size is the strongest predictor CNIL's data shows for which profile a DPO falls into. 69% of DPO Metier holders work at organizations with 1,000 or more employees, compared with just 23% of DPO Mission holders and only 8% of DPO Ponctuel holders at that scale. Smaller organizations overwhelmingly produce the least-resourced profile: 71% of DPO Ponctuel holders work at private-sector structures, and the group as a whole is concentrated outside Ile-de-France.
Figure 4: The fully-dedicated DPO Metier profile is heavily concentrated at large organizations; the minimally-structured DPO Ponctuel profile almost never appears there. Source: CNIL DPO Observatory, November 2025 survey.
That pattern matches what a company's own compliance budget would predict. A five-person startup and a 5,000-employee multinational both may have technically satisfied GDPR Article 37 by naming a DPO, but the survey data suggests only the larger organization is likely to have given that person a real budget, a team, and enough time to do the job as GDPR's drafters probably imagined it.
Is a DPO even legally required for your company?
GDPR Article 37 sets three narrow conditions, and a mandatory DPO only applies if at least one is met: the organization is a public authority, its core activities require large-scale regular and systematic monitoring of individuals, or its core activities involve large-scale processing of special category data such as health, biometric, or criminal-record information. Several EU member states layer additional national thresholds on top of these three triggers.
Figure 5: Only three narrow conditions make hiring a DPO a legal requirement rather than a voluntary choice. Source: GDPR Article 37(1).
Most small and mid-sized businesses never trigger any of the three conditions, which is exactly why the "how many companies have a DPO" question splits into two very different populations: organizations legally required to have one, largely public bodies and large-scale data processors, and everyone else who names a DPO voluntarily or skips the role entirely. Even when a DPO is not required, GDPR Article 13(1)(b) still requires a privacy notice to name a data protection contact whenever one has been designated, so a privacy policy generator that adds the correct contact block automatically saves a manual edit many sites forget.
What does it actually cost to employ a Data Protection Officer?
Salary is the largest recurring cost of turning a symbolic DPO designation into a real one. The IAPP Salary and Jobs Report 2025-26, based on more than 1,600 responses from over 60 countries, found professionals working a single privacy-focused role reported a median salary below $123,000, while those whose role also spans AI governance reported a meaningfully higher median above $169,700. That roughly $47,000 gap is itself evidence of how much the role has expanded since 2018.
Figure 6: Two-thirds of France's designated DPOs report no dedicated budget at all. Source: CNIL DPO Observatory, November 2025 survey.
A separate Afpa-run survey of 3,625 DPOs, published in January 2024, found 58% describe GDPR compliance as an opportunity rather than a constraint, suggesting that even under-resourced DPOs largely see the role as adding value rather than being pure overhead. For a full breakdown of what privacy programs cost across company sizes, including DPO and privacy-team salary benchmarks, see our cost of privacy compliance data.
How do the three DPO profiles compare?
| Measure | DPO Ponctuel | DPO Mission | DPO Metier |
|---|---|---|---|
| Share of surveyed DPOs | 32% | 52% | 16% |
| Has a dedicated budget | 4% | 35% | 93% |
| Has a support team | 11% | 21% | 53% |
| Works at a 1,000-plus employee organization | 8% | 23% | 69% |
| Works full time (75%+ of hours) on the role | 2% | 23% | 71% |
Table 1: The three DPO profiles CNIL's 2025 Observatory identified, scored across time dedicated, team size, budget, and expertise. Source: CNIL DPO Observatory, November 2025 survey (n=2,390).
The Bottom Line
There is no single clean number for how many companies employ a DPO, because designation, the legal act of naming someone to the role, and employment, giving that person real time, budget, and support, turn out to be two different milestones that most organizations have not both reached. France's 38,000 designated DPOs and IAPP's roughly 500,000 EEA-wide estimate answer the designation question. CEDPO's 42% full-time figure and CNIL's 16% fully-dedicated "DPO Metier" share answer the harder, more useful question: only a minority of named DPOs are actually resourced to do the job at scale. For most small and mid-sized businesses that do not trigger Article 37's mandatory thresholds at all, the practical takeaway is narrower than either statistic suggests: check whether your organization actually meets one of the three legal triggers, and if your privacy policy names a DPO or privacy contact, make sure that contact block is current rather than a leftover from a compliance project years ago.
Frequently Asked Questions
How many companies actually employ a Data Protection Officer? France's CNIL had 38,000 designated DPOs on its contact list as of November 2025, the freshest national count publicly available, and IAPP separately estimated roughly 500,000 organizations across the EEA had registered a DPO within GDPR's first year. But designation is not the same as employment: CEDPO's 2024 survey of over 1,120 DPOs found only 42% of them dedicate their entire working time to the role.
What percentage of DPOs work the role full time? 42%, according to CEDPO's 2024 DPO Survey of more than 1,120 DPOs across 11 European countries, conducted by OpinionWay to ISO 20252 standards. A third of respondents allocate less than half their working time to data protection tasks, and nearly half report no dedicated budget at all.
Does every company have to hire a Data Protection Officer? No. GDPR Article 37 only requires a DPO for public authorities, organizations whose core activities involve large-scale regular monitoring of individuals, or large-scale processing of special category data. Most small and mid-sized businesses fall outside all three triggers.
How much does it cost to employ a Data Protection Officer? Privacy professionals working a single privacy-focused role reported a median salary below $123,000 in 2025, per the IAPP Salary and Jobs Report 2025-26. Professionals combining privacy and AI governance responsibilities reported a higher median above $169,700, reflecting how much the role has expanded since GDPR took effect.
Where the Numbers Come From
- CEDPO (Confederation of European Data Protection Organisations). (2025). "CEDPO DPO Survey 2024, Executive Summary." Survey of 1,120-plus DPOs across 11 European countries, fielded by OpinionWay to ISO 20252 standards, published January 2025.
- CNIL, Afpa, AFCDP and DGEFP. (2026). "Les DPO a l'heure de l'IA, enquete 2025." Fifth edition of the DPO Observatory, 2,390 respondents surveyed 5 to 21 November 2025, drawn from CNIL's list of 38,000 designated DPOs; 95% confidence level, plus-or-minus 2% margin of error.
- CNIL. (2024). "What Are the Economic Benefits of Having a DPO for a Company?" Cites Afpa's fourth DPO statistical survey, 3,625 respondents, January 2024.
- IAPP. (2025). "Salary and Jobs Report 2025-26: Privacy, AI Governance and Digital Responsibility." Survey of 1,600-plus respondents from over 60 countries, fielded March to April 2025.
- IAPP. (2019). "An Estimated 500,000 Organizations Have Registered DPOs Across Europe." Documents 376,306 directly-registered DPOs across 12 EU member states as of May 2019, the source of this post's 2019 France comparison figure.
Note: All figures verified as of August 2026. CNIL's 38,000-designated-DPO count and the DPO Observatory's profile breakdown come from a survey fielded in November 2025 and published in July 2026; the CEDPO figures are from a January 2025 publication and have not been updated since. Figures are refreshed at least twice a year to track new survey editions.
