Who is this programme for?
Prospective DPOs, data protection managers moving towards a DPO role, and professionals or managers developing the necessary knowledge and practical foundations.
Curriculum & Assessment Programme
Data Protection Officer – curriculum and assessment programme
Develop DPO competence over a full year of practice: five training days and a theory examination, followed by a twelve-month part-time traineeship with recurring assignments, feedback and a final defended competence portfolio.
Academy-owned programmes are offered in German and English. Hungarian instruction is available for PECB courses only.
Audience and entry requirements
What are the entry requirements?
Basic GDPR knowledge and familiarity with business processes are recommended. Assessment language, suitable access to a host organisation, professional mentoring and an individual traineeship plan must be agreed before starting. No specified prior certificate is required. The traineeship is a part-time professional development pathway; it does not itself promise an employment contract or remuneration.
Scope and learning format
Five training days covering twelve theory modules and a 95-question theory examination lasting 90 minutes. These are followed by a twelve-month part-time traineeship with twelve monthly assignments, documented feedback, revision and a final portfolio. The final professional discussion lasts 45 minutes. Teaching hours, regular mentoring and the binding practical workload are agreed in the individual plan before the programme begins.
Which competencies will you demonstrate?
- Explain the duties and limits of a DPO role in its specific organisational context.
- Assess a privacy question through verifiable facts, relevant requirements and reasoned judgement.
- Review and provide traceable advice on individual-rights, supplier and incident processes.
- Produce a reasoned DPIA review or opinion addressing risks, controls, limitations and further questions.
- Plan a risk-based audit, assess evidence and document findings objectively.
- Document practical work so that its quality, authorship and secure use of information can be assessed.
- Support management and departments with clear, prioritised recommendations without taking over their accountability.
- Develop and update a consistent record of processing activities and related data flows.
- Complete a DPIA and a transfer impact assessment (TIA) for a defined case and disclose professional limitations.
- Translate feedback over repeated review cycles into demonstrably improved privacy documents and processes.
The curriculum
1 · Understanding the legal framework
Apply scope, principles, legal grounds and special categories to typical processing situations.
Scope / allocation
Day 1 · theory phase
Evidence and output
A reasoned assessment of a processing scenario.
2 · Designation, position and conflicts
Distinguish DPO duties and authority from management accountability; assess expertise, resources and potential conflicts.
Scope / allocation
Day 1 · theory phase
Evidence and output
A role analysis covering conflicts and escalation.
3 · Supervisory authorities and communications
Address jurisdiction, structured fact gathering, traceable advice and communication with authorities.
Scope / allocation
Day 1 · theory phase
Evidence and output
A factual communication draft supported by evidence.
4 · Individual rights and transparency
Examine requests, identity checks, scope, deadlines, exceptions and secure disclosure through a case.
Scope / allocation
Day 2 · theory phase
Evidence and output
A reasoned handling and approval plan.
5 · Accountability and suppliers
Distinguish controllers, processors and joint controllers; assess contracts, evidence and transfers.
Scope / allocation
Day 2 · theory phase
Evidence and output
A role and contract assessment identifying open review points.
6 · Controls and incident assessment
Evaluate controls against risks; recognise personal data breaches, prepare notification decisions and document their rationale.
Scope / allocation
Day 3 · theory phase
Evidence and output
A control assessment and incident record.
7 · DPIAs and privacy by design
Work through screening, risks to individuals, controls, residual risk and the DPO’s advisory role for a proposed project.
Scope / allocation
Day 3 · theory phase
Evidence and output
A reasoned DPO opinion on a DPIA.
8 · DSMS, controls and audit methods
Develop a risk-based review programme, sampling, interviews, findings and action follow-up.
Scope / allocation
Day 4 · theory phase
Evidence and output
An audit plan with evidence-based criteria.
9 · Core records and retention
Structure processing records, privacy information, policies, deletion rules and documented advice consistently.
Scope / allocation
Day 4 · theory phase
Evidence and output
A document register with ownership and update requirements.
10 · Employment and social-sector data
Recognise special contexts, access restrictions, purpose limitation and the limits of general conclusions; seek specialist input where needed.
Scope / allocation
Day 4 · theory phase
Evidence and output
A risk-based opinion on an employment-related process.
11 · Marketing and communications
Assess lead collection, existing-customer communications, consent evidence, objections and internal approvals.
Scope / allocation
Day 5 · theory phase
Evidence and output
A reasoned campaign review checklist.
12 · Websites, tracking and international transfers
Trace data flows, consent mechanisms, third parties and international transfers; complete an integrated assessment.
Scope / allocation
Day 5; theory examination according to the separate assessment schedule
Evidence and output
A 95-question theory examination and agreed individual practice plan.
Practical phase and documented assignments
1
Role, remit and data map
Clarify the DPO remit, conflicts, contacts and processing priorities; create an initial data and process map with documented limitations.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
2
Record of processing activities (ROPA)
Document at least two different real processes, aligning purposes, data, recipients, retention, legal-ground review questions and data flows.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
3
Legal grounds and transparency
Prepare a legal-ground assessment and suitable privacy information, addressing consent or legitimate-interest balancing only where relevant.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
4
Processing arrangements and collaboration
Assess a supplier case and an internal or external collaboration, justify roles and identify missing contractual terms or evidence.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
5
Controls, access and deletion
Assess controls for a selected process and develop access and deletion arrangements supported by evidence, risks and improvement recommendations.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
6
Data protection impact assessment (DPIA)
Prepare reasoned screening and a complete DPIA case covering description, necessity, risks, controls and residual risks; distinguish the DPO opinion from the controller’s decision.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
7
International transfer and TIA
Map a specific transfer and prepare a transfer impact assessment (TIA) covering the transfer instrument, reliable sources, measures, limitations and review triggers.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
8
Individual rights in practice
Review the request workflow and work through an access or deletion case covering identity, search scope, exceptions, deadlines and secure disclosure.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
9
Personal data breaches and incident response
Conduct a safe incident exercise and document the timeline, risk assessment, notification decisions, ownership and follow-up.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
10
Training and privacy communications
Prepare and deliver an agreed role-specific awareness activity with a learning objective, case example and effectiveness check.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
11
Data protection audit
Plan a focused audit, select a reasoned sample, assess evidence and write findings against defined criteria.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
12
Activity report and improvement follow-up
Prepare a management report with prioritised risks, actions, owners and deadlines; revise earlier portfolio work following feedback and explain remaining limitations.
Evidence and output
A versioned record covering the starting point, candidate contribution, sources, professional reasoning, result and limitations; appropriately anonymise sensitive information.
Feedback and sign-off
Structured professional feedback, reasoned revision and reassessment. At least 60% and at least 2 of 4 points in every critical criterion; approval is required before the final defence.
How your work is assessed
Weighting: 30 %
Theory examination
95 single-choice questions with exactly one correct answer each, including case-based scenarios. One point per correct answer and no negative marking.
90 minutes
- Correctly interpret the legal framework, DPO role, individual rights, suppliers, controls, DPIAs, DSMS and specific application contexts.
Weighting: 50 %
Twelve-month practice portfolio
Twelve monthly assignments with an initial submission, structured feedback and revision where necessary. Every record receives its own assessment; the portfolio result is the mean of the twelve approved records.
Twelve months; all records must be approved before the final discussion
- Technically sound, reasoned application to the practical case
- Completeness and consistency of documents, data flows and processes
- Role separation, risk-based escalation and limits of own authority (critical)
- Traceable authorship and secure use of information (critical)
- Use of professional feedback and reasoned improvement
Weighting: 20 %
Final portfolio defence
A professional discussion of the portfolio, with targeted questions on DPIAs, TIAs, processing records, roles, evidence and ambiguous cases. No new real processing activity needs to be initiated for the assessment.
45 minutes
- Reasoned defence of methods and chosen controls
- Application to a changed scenario
- Disclosure of uncertainty and professional limitations
- Role clarity and risk-based escalation (critical)
- Clear advice and prioritisation
Pass requirements
A pass requires at least 70% overall after weighting and at least 60% in every mandatory component. Each designated critical criterion must also achieve at least 2 of 4 rubric points; a critical deficiency cannot be offset by stronger performance elsewhere. These thresholds are Academy rules, not values prescribed by ISO/IEC 17024. In addition, each of the twelve practical records must achieve at least 60% and satisfy its critical criteria. All twelve must be approved before the final defence. Weighting: theory 30%, portfolio 50%, defence 20%. Missing evidence or critical deficiencies cannot be offset by a sufficient average.
Permitted resources and AI
The supplied collection of legal sources, personal notes not collaboratively edited during the assessment, and templates expressly authorised for the relevant component may be used. Communication with third parties, generative AI and unauthorised aids are prohibited during graded assessments. Practical evidence must be anonymised; real personal or confidential information may only be used with documented authorisation and through the agreed secure transfer channel.
Identity and independent work
Identity is checked before the assessment using suitable government-issued photographic identification. Identification numbers or copies are not routinely retained for this purpose. Online assessments follow the technical and privacy conditions communicated in advance.
The common assessment rules also cover retakes, reasonable adjustments, appeals, confidentiality and certificate authorisation.
Assessment and Certificate RulesWhat your certificate demonstrates
Academy Qualification Certificate – Data Protection Officer
- Scope of the credential
- Evidence of passing the theory examination, completing the twelve-month part-time traineeship with twelve approved practical records, and passing the final portfolio defence. The certificate records the programme code, revision, assessment date and defined competence areas, including processing records, DPIAs and TIAs.
- How to interpret the qualification
- An Academy-owned assessed course award; it is not accredited personnel certification under ISO/IEC 17024, PECB certification, or a data protection seal for an organisation or processing operation. Reference to ISO/IEC 17024 describes the programme’s alignment with selected principles. The final DPO qualification certificate is issued only after the complete year-long programme. A record of the five-day theory phase or theory examination is explicitly not the full DPO award. Designation and suitability for a particular organisation must be assessed separately.
- Assessment date and currency
- Under Academy policy, this certificate is valid for a maximum of three years from its date of issue. It is issued only after all programme and assessment requirements have been met and the award decision has been documented. The validity period does not start on enrolment or at the beginning of the course. The actual validity period and expiry date are stated on the certificate; a shorter period applies only when expressly specified in the relevant course or assessment programme. There is no automatic extension. Renewal requires a documented review of current knowledge and application appropriate to the programme, using recent evidence and/or a suitable update or competence assessment. Repurchasing the entire course is not a blanket requirement. A renewed Academy certificate is also valid for no more than three years from its issue date. Attendance and passing an assessment remain verifiable historical facts tied to their dates; they do not provide indefinite validity as evidence of current competence. For the full DPO certificate, the period therefore begins only when that certificate is issued after the twelve-month traineeship, twelve approved practical records and a passed final defence, not after the theory phase alone.
This programme applies to deliveries whose agreed course and assessment plan explicitly references this revision. Existing bookings retain their agreed terms.
Programme questions
Do I receive the DPO certificate after five days?
No. Completion of the theory phase or a passed theory examination is documented separately. The final Academy qualification certificate requires twelve months of traineeship, twelve approved practical records and a passed final defence.
How does the part-time traineeship work?
You complete twelve monthly assignments in an agreed host organisation. Each receives professional feedback and is revised where needed. The assignments connect with one another, turning individual documents into a traceable privacy portfolio.
Will I actually prepare DPIAs, TIAs and processing records?
Yes. These outputs are expressly required in the portfolio. Where no suitable real case is available, an equivalent assessable case is agreed in advance. Assessment considers the candidate’s reasoning, traceability, role boundaries, risks and limitations, rather than template completion alone.
Is the traineeship an employment relationship?
The programme describes part-time professional development. It does not itself promise an employment relationship, a particular host organisation or remuneration. Practical access, mentoring, workload and organisational conditions are agreed before starting.
What happens if a practical assignment is not yet sufficient?
You receive reasoned feedback and may revise the record under the assessment framework. Unapproved or missing mandatory records prevent admission to the final defence and issue of the final certificate.
Must my employer disclose sensitive information?
No. Only necessary, authorised and appropriately anonymised evidence is submitted. For records that cannot be transferred, an equivalent assessable representation is agreed in advance.
Advice & course planning
Solo self-employed in Germany? Discuss potential KOMPASS support with an official advisory centre before booking. We can help you select a suitable programme in a consultation.
An Academy-owned assessed competence credential. The assessment programme refers to selected principles of ISO/IEC 17024:2026. This is not a claim of accreditation or fully demonstrated conformity.