European Data Protection Supervisor Jobs

Mission and mandate

The EDPS was established by Regulation (EC) 45/2001 of 18 December 2000 (the EU's first own data protection regulation, applying to the EU institutions themselves), which was repealed and replaced by Regulation (EU) 2018/1725 of 23 October 2018 in alignment with the GDPR. The Supervisor and the Assistant Supervisor are appointed by joint decision of the European Parliament and the Council for a five-year renewable term. The current Supervisor is Wojciech Wiewiórowski (since 6 December 2019, reappointed for a second term in 2024 running to 2029). The Assistant Supervisor post is vacant or filled depending on the cycle.

The EDPS has six core functions: (1) supervision of EU institutions, monitoring data processing operations across all EU bodies, conducting on-spot inspections, handling complaints from EU staff and citizens about EU institutional processing, and issuing decisions (including reprimands, orders, and administrative fines) under Regulation (EU) 2018/1725; (2) consultation on EU legislative proposals, issuing formal opinions on Commission proposals with data-protection implications, a major workstream covering proposals in security, migration, finance, digital, and AI; (3) European Data Protection Board secretariat, providing the operational secretariat to the EDPB, which is composed of the heads of national DPAs and acts as the coordination body for GDPR enforcement across the EU; (4) IT supervision and large-scale databases, supervising EU centralised databases (SIS, VIS, Eurodac, EES, ETIAS, ECRIS-TCN) and the EU eIDAS infrastructure; (5) cooperation with national DPAs, coordinating cross-border GDPR cases involving EU bodies and national authorities; (6) thought leadership on emerging issues, AI, neurotechnology, generative AI, behavioural advertising, data brokers.

The EDPS's powers under Regulation (EU) 2018/1725 include investigative powers (access to any information necessary for the performance of its tasks, on-site inspections), corrective powers (warnings, reprimands, orders to comply, temporary or definitive bans on processing, administrative fines up to €50,000 per breach), and consultative powers (legally required consultation on Commission proposals).

Structure and operational divisions

The EDPS is led by the Supervisor, supported by a small leadership team and structured into operational and corporate units. The operational side comprises: the Supervision and Enforcement Unit (handling EU institution complaints, prior consultations, inspections, and enforcement decisions); the Policy and Consultation Unit (drafting EDPS opinions on Commission proposals and producing thought-leadership outputs on emerging issues); the Technology and Privacy Unit (IT supervision, large-scale database oversight, privacy engineering, AI assessment); and the Information and Communication Unit (the EDPS website, publications, conferences, and outreach including the Internet Privacy Engineering Network IPEN).

The EDPB Secretariat sits within the EDPS organisationally but operates under the authority of the EDPB Chair (currently Anu Talus from December 2023, the Finnish DPA Commissioner). The Secretariat supports the EDPB in coordinating cross-border GDPR cases, in producing EDPB guidelines on GDPR interpretation, and in handling Article 65 GDPR binding decisions where national DPAs disagree. The Secretariat staff are EDPS employees but report on EDPB matters to the EDPB Chair.

Geographically the EDPS is concentrated in Brussels at rue Montoyer and rue Wiertz, next to the European Parliament. There are no field offices.

Hiring landscape over the last 12 months

EDPS hiring is dominated by AD jurists. AD5 entry posts come from EPSO reserve lists, primarily the EU Public Administration competition law profile and the dedicated EU law competitions. AD7 to AD9 specialist posts are filled both from EPSO reserve lists and from direct vacancy notices targeting candidates with prior data-protection experience at a national DPA, at a Commission legal service, at a top-tier privacy law firm, or in academia. The AI Act (Regulation (EU) 2024/1689) triggered a hiring wave in 2024 to 2025 around AI-relevant data protection expertise.

The Technology and Privacy Unit recruits AD5 to AD9 with technical privacy engineering backgrounds, applied cryptography, differential privacy, secure multi-party computation, ML privacy attacks and defences, federated learning. These posts are competitive given the scarcity of candidates who combine deep technical privacy knowledge with EU law literacy.

A smaller stream of AD posts opens in support functions (HR, finance, communications) but most non-jurist posts at EDPS are AST or FG. Contract agent recruitment via CAST Permanent covers administrative support and IT operations. The EDPS does not run a structured traineeship of its own but participates in inter-institutional traineeship cycles.

Salary realism by grade and the Brussels coefficient

Brussels is the reference duty station under Article 64 of the Staff Regulations with a correction coefficient of 100.0. EDPS salaries equal the nominal EU grid: AD5 step 1 €6,153 monthly basic, AD7 step 1 €7,876, AD9 step 1 €10,083, AD12 step 1 €13,400. With the standard 16% expatriation allowance (€1,260 at AD7, not modified by the coefficient), a household allowance for a married hire (~€220 plus 2% of basic), and a dependent-child allowance per child (~€510), an AD7 expatriate jurist with one child lands around €9,500 to €10,500 gross monthly before tax. EU tax is progressive; net take-home is roughly 76 to 82% of gross at AD7.

Most EDPS staff live in central Brussels (Etterbeek, Ixelles, around the European Quarter) or in commuter towns in Flemish or Walloon Brabant. The four European Schools in Brussels cover children's schooling with the education allowance. Brussels cost of living for housing, transport, and groceries is moderate by EU duty-station standards. Use the salary calculator to model an AD7 take-home for Brussels.

Languages, security clearance, and competition profile

English and French are both working languages at the EDPS, with English dominant in operational work (complaint handling, opinions on Commission proposals, EDPB secretariat documents) and French used heavily in management communication and in interaction with Belgian local administration. A working command of both is highly valuable. Knowledge of additional EU languages is the regulatory minimum and is operationally valuable, opinions on Commission proposals are issued in English but consultation files frequently arrive in French, German, Italian, or Spanish.

Some EDPS posts involve handling EU CONFIDENTIAL or EU SECRET classified material, particularly those touching large-scale databases (SIS, VIS, Eurodac, EES, ETIAS, ECRIS-TCN) and security-relevant Commission proposals. Clearance for these posts is granted by the home member state and takes 6 to 12 months. Most general supervision and consultation roles do not require clearance.

Competition profiles favour candidates with a strong legal background (national law degree, master's or LLM in EU law or in data protection law) plus prior experience at a national DPA, at a Commission legal service, at a top-tier privacy law firm, in academia (a recognised publication record in EU data protection law), or at a major international organisation. The CIPP/E professional certification from the IAPP is increasingly valued. For the Technology and Privacy Unit, a STEM degree plus applied privacy engineering experience is the typical profile.

Application paths

The EDPS recruits via three routes. EPSO open competitions, the main entry channel for AD jurists. The EU Public Administration law profile competition and the dedicated EU law competitions produce reserve lists that the EDPS draws from as posts open. Direct vacancy notices, for specialist posts where the relevant EPSO list is exhausted or where the profile demands specific privacy or AI law experience, the EDPS publishes direct vacancy notices on edps.europa.eu/about/work-us. Applications are submitted via the EU Careers portal. Shortlisted candidates undergo a written test (typically a data-protection case study) and a structured interview.

Contract agent via CAST Permanent, candidates register on the EU Careers portal in the relevant FG profile (Project/Programme Management, Legal Support where applicable, ICT, Administrative Support) and respond to specific EDPS notices. CA posts are typically 3 to 5 year contracts, renewable.

Seconded national experts, serving officials from national DPAs apply through their national point of contact for 2 to 4 year deployments. The SNE route is structurally important to the EDPS given its coordination role with national authorities; many SNEs are later recruited via subsequent EPSO competitions. Inter-institutional mobility from the Commission, the EEAS, or other EU bodies' legal services is a common entry route for senior AD posts.