Who is this programme for?
Data protection coordinators, compliance teams, process owners and professionals organising privacy across departments or improving an existing DSMS.
Curriculum & Assessment Programme
Data Protection Manager – curriculum and assessment programme
Design and run a data protection management system with clear ownership, reviewable processes, effective action tracking and useful reporting.
Audience and entry requirements
What are the entry requirements?
Basic GDPR knowledge and experience with business processes are recommended. Equivalent knowledge may come from professional experience or other training. No specific provider certificate is required; prior knowledge and goals are discussed before booking.
Scope and learning format
Twelve modules, twelve knowledge checks and a 70-question final assessment lasting 120 minutes in total. Teaching hours, dates and the number of in-person days are agreed before booking. Teaching is live online or in person.
Which competencies will you demonstrate?
- Map a DSMS scope, roles, decisions and escalation routes for a case.
- Specify privacy processes through inputs, activities, ownership, evidence and controls.
- Connect requirements and actual evidence in a traceable control system.
- Create a risk-based action plan with owners, deadlines and effectiveness checks.
- Coordinate incident, individual-rights and change processes.
- Write management reporting with meaningful metrics, outstanding risks and prioritised decisions.
The curriculum
1 · DSMS purpose and scope
Define the business context, organisational units, significant processing and internal interfaces.
Scope / allocation
Module 1 of 12
Evidence and output
A defined scope and reasoned baseline.
2 · Requirements and governance
Translate requirements into tasks and connect management, process owners, coordinators and the DPO through clear decision routes.
Scope / allocation
Module 2 of 12
Evidence and output
A governance model and responsibility matrix.
3 · Process and data map
Connect processes, systems, data flows and recipients; keep processing records and changes consistent.
Scope / allocation
Module 3 of 12
Evidence and output
A process map linked to processing records and systems.
4 · Lawfulness and evidence
Integrate review of legal grounds, transparency duties, consent evidence and documented decisions into approval workflows.
Scope / allocation
Module 4 of 12
Evidence and output
An approval workflow with defined evidence requirements.
5 · Individual rights as a process
Connect intake, identity checks, search scope, handling, approval and deadline monitoring.
Scope / allocation
Module 5 of 12
Evidence and output
A process specification including escalation points.
6 · Suppliers and data transfers
Integrate role assessment, processing contracts, joint controllership and international transfers into a reviewable supplier process.
Scope / allocation
Module 6 of 12
Evidence and output
A supplier assessment identifying unresolved legal and risk questions.
7 · Controls and supporting evidence
Connect controls with risks, assign ownership, and distinguish evidence of effectiveness from unsupported assurances.
Scope / allocation
Module 7 of 12
Evidence and output
A control matrix specifying review intervals and evidence types.
8 · Risk management and DPIAs
Prioritise risks to individuals, organise DPIA screening, and involve departments and the DPO appropriately.
Scope / allocation
Module 8 of 12
Evidence and output
A risk register and reasoned action plan.
9 · Incident management
Translate intake, assessment, decisions, communications and review into a time-sensitive process.
Scope / allocation
Module 9 of 12
Evidence and output
An incident workflow with a timeline and decision log.
10 · Document and change control
Control policies, versions, approvals, retention and changes to tools or processes; involve privacy expertise early in projects.
Scope / allocation
Module 10 of 12
Evidence and output
A change workflow and controlled document structure.
11 · Training, controls and internal reviews
Plan role-specific learning goals, controls, sampling and the handling of findings.
Scope / allocation
Module 11 of 12
Evidence and output
A risk-based control and training plan.
12 · Reporting and continual improvement
Bring meaningful indicators, priorities, escalations and improvement decisions together in a management report.
Scope / allocation
Module 12 of 12; final assessment 120 minutes
Evidence and output
A management report and integrated final assessment.
How your work is assessed
Weighting: 60 %
Knowledge and process understanding
60 single-choice questions with one correct answer each; one point per correct answer and no negative marking.
60 minutes
- Correctly interpret DSMS governance, records, individual rights, suppliers, risks, controls and reporting.
Weighting: 40 %
Application to an integrated case
Ten case-based short-answer questions within the same 70-question assessment, each scored from 0 to 4 using the published performance rubric.
60 minutes
- Governance, responsibility and distinction between management and DPO tasks (critical)
- Coherent process and evidence structure
- Reasoned risk and action prioritisation
- Timely escalation of urgent cases (critical)
- Metrics, control effectiveness and reasoned improvement
- Protection of personal information in records and reporting (critical)
Pass requirements
A pass requires at least 70% overall after weighting and at least 60% in every mandatory component. Each designated critical criterion must also achieve at least 2 of 4 rubric points; a critical deficiency cannot be offset by stronger performance elsewhere. These thresholds are Academy rules, not values prescribed by ISO/IEC 17024.
Permitted resources and AI
The supplied collection of legal sources, personal notes not collaboratively edited during the assessment, and templates expressly authorised for the relevant component may be used. Communication with third parties, generative AI and unauthorised aids are prohibited during graded assessments. Practical evidence must be anonymised; real personal or confidential information may only be used with documented authorisation and through the agreed secure transfer channel.
Identity and independent work
Identity is checked before the assessment using suitable government-issued photographic identification. Identification numbers or copies are not routinely retained for this purpose. Online assessments follow the technical and privacy conditions communicated in advance.
The common assessment rules also cover retakes, reasonable adjustments, appeals, confidentiality and certificate authorisation.
Assessment and Certificate RulesWhat your certificate demonstrates
Academy Course Certificate – Data Protection Manager
- Scope of the credential
- Assessed competence in the organisational design and coordination of a DSMS within the stated course scope; the record includes programme code, revision, assessment date and scope.
- How to interpret the qualification
- An Academy-owned assessed course award; it is not accredited personnel certification under ISO/IEC 17024, PECB certification, or a data protection seal for an organisation or processing operation. Reference to ISO/IEC 17024 describes the programme’s alignment with selected principles. The award does not evidence appointment as a DPO.
- Assessment date and currency
- Under Academy policy, this certificate is valid for a maximum of three years from its date of issue. It is issued only after all programme and assessment requirements have been met and the award decision has been documented. The validity period does not start on enrolment or at the beginning of the course. The actual validity period and expiry date are stated on the certificate; a shorter period applies only when expressly specified in the relevant course or assessment programme. There is no automatic extension. Renewal requires a documented review of current knowledge and application appropriate to the programme, using recent evidence and/or a suitable update or competence assessment. Repurchasing the entire course is not a blanket requirement. A renewed Academy certificate is also valid for no more than three years from its issue date. Attendance and passing an assessment remain verifiable historical facts tied to their dates; they do not provide indefinite validity as evidence of current competence.
This programme applies to deliveries whose agreed course and assessment plan explicitly references this revision. Existing bookings retain their agreed terms.
Programme questions
How does a data protection manager differ from a coordinator?
The manager designs and coordinates cross-departmental processes and evidence. The coordinator supports implementation within a department. Both differ from the statutory DPO function.
Are the twelve knowledge checks the final assessment?
No. They support learning and are completed and reviewed. The final evidence of competence comes from the 70-question assessment, which combines knowledge and case-based tasks.
Can I use an existing DSMS as a learning example?
Yes, with appropriate authorisation and anonymisation. The final assessment uses specified cases so that requirements remain comparable for all candidates.
Does the certificate confirm that our company complies with the GDPR?
No. It records individual performance assessed during the course. It does not assess or certify the organisation or its processing operations.
What prior knowledge do I need?
Basic GDPR knowledge and experience with organisational processes are recommended. Prior knowledge and learning goals are discussed before booking; no particular provider’s certificate is required.
Advice & course planning
Solo self-employed in Germany? Discuss potential KOMPASS support with an official advisory centre before booking. We can help you select a suitable programme in a consultation.
An Academy-owned assessed competence credential. The assessment programme refers to selected principles of ISO/IEC 17024:2026. This is not a claim of accreditation or fully demonstrated conformity.