Who is this programme for?
Data protection contacts in HR, IT, purchasing, sales and operations, project leads and staff supporting a DPO in day-to-day work.
Curriculum & Assessment Programme
Data Protection Coordinator – curriculum and assessment programme
Support practical data protection in your department: gather information systematically, coordinate tasks, recognise risks and involve the DPO promptly.
Academy-owned programmes are offered in German and English. Hungarian instruction is available for PECB courses only.
Audience and entry requirements
What are the entry requirements?
No specified prior certification. A basic understanding of business processes and sufficient language ability for professional texts and case work are needed. Prior knowledge and learning goals are reviewed before booking.
Scope and learning format
Ten modules with knowledge checks and a 90-minute final assessment. Binding teaching hours, dates and in-person sessions are specified in the schedule before booking. Live online or in person by agreement.
Which competencies will you demonstrate?
- Describe departmental processing systematically, including its purpose, data categories and participants.
- Distinguish coordinator tasks from controller decisions and the DPO’s advisory role.
- Prepare an individual-rights workflow with ownership and deadline controls.
- Review controls and evidence against a specified risk.
- Escalate a potential incident or DPIA need promptly and with clear reasoning.
- Design minimised, secure information handover and a short awareness activity.
The curriculum
1 · Foundations and principles
Identify personal information, sensitive categories, purposes, minimisation and accountability in a department.
Scope / allocation
Module 1 of 10
Evidence and output
A processing outline identifying data categories, purposes and individuals affected.
2 · Roles and responsibilities
Separate the coordinator’s tasks from organisational accountability, DPO advice and IT responsibilities; establish escalation routes.
Scope / allocation
Module 2 of 10
Evidence and output
A responsibility and escalation matrix for a sample process.
3 · Documenting processing
Collect information for a record of processing activities, submit proposed legal grounds for review, and distinguish suppliers from recipients.
Scope / allocation
Module 3 of 10
Evidence and output
A complete draft processing record with unresolved review questions.
4 · Organising individual rights
Recognise requests, make proportionate identity checks, track ownership and deadlines, and assemble information securely.
Scope / allocation
Module 4 of 10
Evidence and output
A workflow covering receipt, ownership, deadlines and authorisation.
5 · Technical and organisational measures
Review access rights, encryption, backup, deletion and supplier evidence against the relevant risks.
Scope / allocation
Module 5 of 10
Evidence and output
A traceable list of controls, evidence and gaps.
6 · Recognising and escalating incidents
Capture signs of a personal data breach, separate verified facts from assumptions, and escalate internally without delay.
Scope / allocation
Module 6 of 10
Evidence and output
A structured initial incident report with a timeline and open questions.
7 · Supporting a DPIA
Recognise indicators of high risk and assemble data flows, stakeholders, purposes and measures for a data protection impact assessment.
Scope / allocation
Module 7 of 10
Evidence and output
A screening record with a reasoned escalation recommendation.
8 · Cookies, tracking and marketing
Identify consent and information needs, approvals for new tools, and the interaction between Germany’s TDDDG and the GDPR.
Scope / allocation
Module 8 of 10
Evidence and output
A review checklist for a website or marketing project.
9 · Awareness and collaboration
Recognise training needs in a department, prepare a short awareness intervention, and track improvement actions.
Scope / allocation
Module 9 of 10
Evidence and output
A short awareness activity with an assessable learning objective.
10 · Transfer and final assessment
Work through an integrated practical case, explain unresolved questions and the limits of the coordinator role.
Scope / allocation
Module 10 of 10; final assessment 90 minutes
Evidence and output
Knowledge assessment and documented case analysis.
How your work is assessed
Weighting: 50 %
Knowledge assessment
30 single-choice questions, including short contextual scenarios; one correct answer per question.
45 minutes
- Correct technical interpretation; one point for each correct answer and no negative marking.
Weighting: 50 %
Written case analysis
One supplied case assessed across five domains, each scored from 0 to 4.
45 minutes
- Clarity of role and limits of own authority (critical)
- Complete and traceable fact gathering
- Risk-based priorities and timely escalation (critical)
- Appropriate actions and reliable documentation
- Minimised and secure disclosure of information (critical)
Pass requirements
A pass requires at least 70% overall after weighting and at least 60% in every mandatory component. Each designated critical criterion must also achieve at least 2 of 4 rubric points; a critical deficiency cannot be offset by stronger performance elsewhere. These thresholds are Academy rules, not values prescribed by ISO/IEC 17024.
Permitted resources and AI
The supplied collection of legal sources, personal notes not collaboratively edited during the assessment, and templates expressly authorised for the relevant component may be used. Communication with third parties, generative AI and unauthorised aids are prohibited during graded assessments. Practical evidence must be anonymised; real personal or confidential information may only be used with documented authorisation and through the agreed secure transfer channel.
Identity and independent work
Identity is checked before the assessment using suitable government-issued photographic identification. Identification numbers or copies are not routinely retained for this purpose. Online assessments follow the technical and privacy conditions communicated in advance.
The common assessment rules also cover retakes, reasonable adjustments, appeals, confidentiality and certificate authorisation.
Assessment and Certificate RulesWhat your certificate demonstrates
Academy Course Certificate – Data Protection Coordinator
- Scope of the credential
- Assessed competence in coordinating departmental data protection under this programme, recording its code, revision, assessment date and assessed scope.
- How to interpret the qualification
- An Academy-owned assessed course award; it is not accredited personnel certification under ISO/IEC 17024, PECB certification, or a data protection seal for an organisation or processing operation. Reference to ISO/IEC 17024 describes the programme’s alignment with selected principles. The award does not replace DPO designation.
- Assessment date and currency
- Under Academy policy, this certificate is valid for a maximum of three years from its date of issue. It is issued only after all programme and assessment requirements have been met and the award decision has been documented. The validity period does not start on enrolment or at the beginning of the course. The actual validity period and expiry date are stated on the certificate; a shorter period applies only when expressly specified in the relevant course or assessment programme. There is no automatic extension. Renewal requires a documented review of current knowledge and application appropriate to the programme, using recent evidence and/or a suitable update or competence assessment. Repurchasing the entire course is not a blanket requirement. A renewed Academy certificate is also valid for no more than three years from its issue date. Attendance and passing an assessment remain verifiable historical facts tied to their dates; they do not provide indefinite validity as evidence of current competence.
This programme applies to deliveries whose agreed course and assessment plan explicitly references this revision. Existing bookings retain their agreed terms.
Programme questions
Does this award replace a data protection officer?
No. The coordinator supports the department and DPO. DPO designation, position and duties remain subject to the applicable legal requirements.
Do I need a previous certificate?
No particular previous certificate is required. Familiarity with business processes and the ability to understand professional texts in the agreed assessment language are helpful.
What is assessed in practice?
You work through a departmental case, distinguish responsibilities, document the required information and justify next steps, including escalation where appropriate.
Must I submit my employer’s data?
No. The final assessment uses supplied cases. Voluntary workplace examples require prior authorisation, anonymisation and a secure transfer channel.
How long is the course?
The programme contains ten modules. Total teaching hours, dates and the allocation of live online or in-person sessions are specified in the binding schedule before booking; the final assessment lasts 90 minutes.
Advice & course planning
Solo self-employed in Germany? Discuss potential KOMPASS support with an official advisory centre before booking. We can help you select a suitable programme in a consultation.
An Academy-owned assessed competence credential. The assessment programme refers to selected principles of ISO/IEC 17024:2026. This is not a claim of accreditation or fully demonstrated conformity.