Who is this programme for?
Experienced DPOs, central privacy teams and data protection managers responsible for multiple entities or international structures.
Curriculum & Assessment Programme
Group Data Protection Officer – curriculum and assessment programme
Coordinate data protection across entities and countries: distinguish roles, oversee shared systems, assess international data flows and give group management decision-ready information.
Academy-owned programmes are offered in German and English. Hungarian instruction is available for PECB courses only.
Audience and entry requirements
What are the entry requirements?
Evidence of DPO knowledge and substantial practical privacy experience, for example through the complete Academy DPO programme or equivalent qualification and experience. Prior knowledge, responsibilities and access to a suitable group case are reviewed before booking. No particular certificate provider is required.
Scope and learning format
24 teaching units of live training over three days; each unit is 45 minutes. A 60-minute knowledge assessment is included on day three. This is followed by a six-month part-time transfer portfolio with six assignments and feedback, then a 45-minute final professional discussion. The individual practical workload is agreed before starting.
Which competencies will you demonstrate?
- Translate a group structure into privacy-relevant entities, roles and decision routes.
- Connect central standards and local requirements through documented exceptions and escalation.
- Coordinate international flows, transfer instruments and TIA updates consistently.
- Develop a DPIA and control structure for shared systems without conflating entity accountability.
- Coordinate a group incident exercise with traceable local decisions.
- Create a risk-based audit programme and decision-ready executive report.
The curriculum
Group structure, responsibility and DPO organisation
Distinguish entities, jurisdictions and decision authority; structure central and local roles, accessibility, resources and conflicts.
Scope / allocation
Day 1 · 4 teaching units
Evidence and output
A governance and responsibility matrix.
Controllership and intragroup collaboration
Review actual roles in shared systems and services; do not infer processing or joint controllership merely from group membership.
Scope / allocation
Day 1 · 4 teaching units
Evidence and output
A role assessment with reasoned contractual needs.
International data flows and TIA coordination
Coordinate transfer maps, transfer instruments, TIA evidence, supplementary measures and reviews consistently across entities.
Scope / allocation
Day 2 · 4 teaching units
Evidence and output
A transfer register with reasoned review steps.
Shared systems, DPIAs and safeguards
Assess group-wide HR, CRM or AI systems against local requirements, DPIA ownership, access, deletion and local exceptions.
Scope / allocation
Day 2 · 4 teaching units
Evidence and output
A cross-entity DPIA and control structure.
Group incidents and communications
Coordinate multiple controllers, local deadlines, shared situation reports and separate notification decisions in an incident exercise.
Scope / allocation
Day 3 · 4 teaching units
Evidence and output
An escalation and communication plan with assigned roles.
Audit programme, executive reporting and assessment
Connect risks, sampling, local implementation, metrics and management decisions in a group control programme.
Scope / allocation
Day 3 · 4 teaching units including a 60-minute knowledge assessment
Evidence and output
A prioritised board or executive report and knowledge assessment.
Practice portfolio · 1 · Entity and governance map
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 1 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
Practice portfolio · 2 · Role and contract matrix for shared services
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 2 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
Practice portfolio · 3 · Transfer register and in-depth TIA
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 3 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
Practice portfolio · 4 · DPIA and control model for a shared system
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 4 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
Practice portfolio · 5 · Cross-entity incident exercise
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 5 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
Practice portfolio · 6 · Audit programme, action follow-up and executive report
Work on a defined group case, with the candidate’s own reasoning, structured feedback and documented revision.
Scope / allocation
Month 6 of the six-month transfer phase
Evidence and output
One record requiring approval; real records only when authorised and appropriately anonymised, otherwise a previously agreed equivalent case.
How your work is assessed
Weighting: 25 %
Knowledge assessment
40 case-based single-choice questions with exactly one correct answer each; no negative marking.
60 minutes
- Correctly distinguish entities, roles, international data flows and organisational duties.
Weighting: 50 %
Transfer portfolio
Six documented assignments with feedback and revision; each record is assessed against five criteria worth 0–4 points each. The portfolio result is the mean of the six approved records.
Six months
- Reasoned separation of entities and responsibilities (critical)
- Traceable sources, data flows and transfer assessment
- Effective and practical governance and control design
- Risk-based escalation and protection of assessment and practical data (critical)
- Clear management information and documented improvement
Weighting: 25 %
Final portfolio defence
A professional discussion of the portfolio and a changed entity, transfer or incident scenario.
45 minutes
- Reasoned priorities and decisions
- Application to complex or conflicting requirements
- Separation of advice, oversight and business decisions (critical)
- Disclosure of uncertainty and risk-based escalation (critical)
- Clear communication with executives and local owners
Pass requirements
A pass requires at least 70% overall after weighting and at least 60% in every mandatory component. Each designated critical criterion must also achieve at least 2 of 4 rubric points; a critical deficiency cannot be offset by stronger performance elsewhere. These thresholds are Academy rules, not values prescribed by ISO/IEC 17024. Each of the six mandatory practical records must achieve at least 60% and meet every critical criterion. The final defence is available only after all six have been approved.
Permitted resources and AI
The supplied collection of legal sources, personal notes not collaboratively edited during the assessment, and templates expressly authorised for the relevant component may be used. Communication with third parties, generative AI and unauthorised aids are prohibited during graded assessments. Practical evidence must be anonymised; real personal or confidential information may only be used with documented authorisation and through the agreed secure transfer channel.
Identity and independent work
Identity is checked before the assessment using suitable government-issued photographic identification. Identification numbers or copies are not routinely retained for this purpose. Online assessments follow the technical and privacy conditions communicated in advance.
The common assessment rules also cover retakes, reasonable adjustments, appeals, confidentiality and certificate authorisation.
Assessment and Certificate RulesWhat your certificate demonstrates
Academy Advanced Certificate – Group Data Protection Officer
- Scope of the credential
- Assessed advanced competence in privacy governance, international data flows and coordinated controls within corporate groups, covering theory, six approved transfer records and a final defence.
- How to interpret the qualification
- An Academy-owned assessed course award; it is not accredited personnel certification under ISO/IEC 17024, PECB certification, or a data protection seal for an organisation or processing operation. Reference to ISO/IEC 17024 describes the programme’s alignment with selected principles. This is not a separate statutory title. A group structure does not create a blanket exemption from the requirements applying to individual controllers. Actual designation, accessibility and suitability must be assessed separately.
- Assessment date and currency
- Under Academy policy, this certificate is valid for a maximum of three years from its date of issue. It is issued only after all programme and assessment requirements have been met and the award decision has been documented. The validity period does not start on enrolment or at the beginning of the course. The actual validity period and expiry date are stated on the certificate; a shorter period applies only when expressly specified in the relevant course or assessment programme. There is no automatic extension. Renewal requires a documented review of current knowledge and application appropriate to the programme, using recent evidence and/or a suitable update or competence assessment. Repurchasing the entire course is not a blanket requirement. A renewed Academy certificate is also valid for no more than three years from its issue date. Attendance and passing an assessment remain verifiable historical facts tied to their dates; they do not provide indefinite validity as evidence of current competence.
This programme applies to deliveries whose agreed course and assessment plan explicitly references this revision. Existing bookings retain their agreed terms.
Programme questions
Is this an entry course for privacy beginners?
No. The programme builds on evidenced DPO knowledge and practice. Those still developing these foundations should first choose an appropriate foundational qualification pathway.
Can one person act for the entire group?
A shared DPO arrangement may be possible under the legal requirements. It does not replace consideration of the relevant entities, accessibility, resources, conflicts and responsibilities.
Are all group companies automatically joint controllers?
No. Privacy roles follow actual decisions and activities. The programme develops reasoned role assessments for the relevant shared processes and services.
What is produced during the six months?
A connected portfolio covering governance, roles and contracts, a transfer register with TIA, a DPIA/control model, an incident exercise, and audit and executive reporting. Each record is revised following feedback and assessed.
Is the certificate an international licence to act as group DPO?
No. It records the advanced competence assessed in the Academy programme. Legal requirements, actual appointment, local circumstances and relevant expertise must still be assessed separately.
Advice & course planning
Solo self-employed in Germany? Discuss potential KOMPASS support with an official advisory centre before booking. We can help you select a suitable programme in a consultation.
An Academy-owned assessed competence credential. The assessment programme refers to selected principles of ISO/IEC 17024:2026. This is not a claim of accreditation or fully demonstrated conformity.