Becoming A Data Protection Officer

A data protection officer advises an organisation on the GDPR, monitors how it complies and acts as the contact point for regulators and individuals. To become a data protection officer, you need expert knowledge of data protection law and practice. You also need the ability to do the tasks and a position that lets you do them independently. The law requires no single certificate. In practice, though, the knowledge the role demands overlaps closely with what the CIPP/E and the CIPM test. The free CIPP/E assessment shows where you stand today.

When an organisation needs a data protection officer

The GDPR makes the role mandatory in three cases, set out in Article 37(1). First, a public authority or body processes the data, unless it is a court acting in its judicial capacity. Second, the core activities require regular and systematic monitoring of individuals on a large scale. Third, the core activities consist of large-scale processing of special categories of data or criminal records data.

Outside those cases, the appointment is voluntary. So a job advert for a data protection officer tells you something about the employer: either one of the three cases applies, or it chose the role anyway.

Staff member or contractor

Under Article 37(6), the data protection officer may be a member of staff or work under a service contract. So the role can be a career inside one organisation, or an external service to several. Both routes need the same knowledge.

What the law asks of a data protection officer

Article 37(5) sets the standard. An organisation must choose its data protection officer for professional qualities and, in particular, expert knowledge of data protection law and practices. The article names no degree and no certificate. Instead, the Article 29 Working Party expanded on the role in its guidelines on data protection officers, which it revised in 2017.

Article 39(1) lists the tasks. At minimum, the data protection officer informs and advises the organisation and its staff. They also monitor compliance with the GDPR and with internal policies, advise on data protection impact assessments and cooperate with the supervisory authority.

Independence is part of the job

Article 38(3) protects the role. Nobody may instruct the data protection officer on how to perform the tasks. The organisation may not dismiss or penalise them for performing them, and they report directly to the highest management level. That independence shapes the work: you advise, monitor and report, but you do not decide the processing yourself.

If you are weighing this role against others, the data protection officer page in our career plan sets it next to related roles.

Which certifications fit a data protection officer

The law and the tasks point to two kinds of knowledge. One is the law itself: the GDPR, its principles, the rights of individuals, transfers and enforcement. That is the subject of the CIPP/E, the IAPP’s certification for European data protection law.

Running a privacy programme is the other: governance, assessments, policies, metrics, incident response and requests from individuals. That is the subject of the CIPM. A data protection officer who monitors compliance needs both, because you cannot monitor a programme without knowing what a working one looks like.

Our career plan therefore runs CIPP/E first, then CIPM. For each exam in detail, read our CIPP/E study guide and our guide on how to prepare for the CIPM. If you already know the route is right, start the CIPP/E course.

How long it takes

At three hours a day, about 21 hours a week next to a job, the CIPP/E takes about a month. That is roughly 90 hours. At the same pace, the CIPM takes about three weeks, roughly 70 hours. Your own figure depends on what you already know, which is why the assessment estimates your study time before you begin.

Where to start

Take the certification that matches the first half of the job. For a data protection officer, the career plan puts the law first. So begin with the free CIPP/E assessment on 22Academy, our sister platform within Future Prep. Then read the CIPP/E course guide to see how the course works. Once the CIPP/E is behind you, the free CIPM assessment is the next step.