How to Get DPO Certification and Become a DPO?
%20(1).png)
DPO Consulting Joins Grant Thornton
Summary
DPO certification attests that an individual holds the competences expected of a data protection officer. It is voluntary. The GDPR never mentions it as a condition for holding the role or for being registered with a supervisory authority.
That distinction matters to two different audiences. For a professional who wants to become a DPO, it shows where to put the effort, on experience and demonstrable competence rather than on stacking certificates. For a company that has to appoint a delegate, it moves the question to what the GDPR actually demands of the person, and to the choice between an internal profile and an external provider.
DPO certification, in the French scheme, is a voluntary mechanism that lets an individual prove they meet the competence requirements the GDPR sets for a data protection officer. The CNIL launched it after a public consultation in 2018 and built it on two frameworks, a certification framework setting the entry conditions and the 17 expected competences, and an approval framework governing which bodies may issue it.
One point is widely misunderstood. The CNIL issues no certificates. They are issued by certification bodies approved by the CNIL, which must themselves hold COFRAC accreditation for the certification of persons under EN ISO/IEC 17024. The table below summarises the scheme as the CNIL describes it.
The certification is open to individuals only. A firm or a provider cannot be certified as a DPO under this scheme, even where the consultants within it hold the certificate personally. Outside France, no equivalent regulator-backed scheme exists in most member states, so private certifications dominate and their value depends entirely on the issuing body.
No. The GDPR conditions the appointment of a data protection officer on neither a certificate nor a degree. The CNIL confirms this without ambiguity, certification is required neither to perform the role nor to be registered with it. The four points below explain what the text demands instead, and where a certificate still carries real weight.
Article 37(5) of the GDPR provides that the data protection officer is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices, and the ability to fulfil the tasks in Article 39. The text speaks of real competence, never of a title. A controller must therefore be able to document why the person appointed meets those requirements.
Recital 97 states that the necessary level of expert knowledge should be determined according to the processing operations carried out and the protection required for the data processed. A DPO in a healthcare group handling patient records faces a higher bar than a DPO in a small services firm. That proportionality is why the Regulation sets no single qualification.
The European legislator chose an obligation of result on competence rather than a qualification requirement. Mandating a certificate would have closed the market and excluded strong profiles coming from legal, information security or audit. The CNIL also notes that any organisation remains free to certify DPOs against its own framework, which it has not approved, so the label on its own tells a buyer very little.
A certificate earns its place when competence has to be proven to a third party. An external DPO answering a tender, a candidate competing for a contested role, or a public body justifying its choice of appointment all benefit from a recognised framework. It works as evidence, it does not replace the experience the framework requires in the first place.
Anyone holding the professional qualities required by Article 37(5) can become a DPO, whatever their original background. Article 37(6) adds that the delegate may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. Three routes are therefore open.
One limit shapes the choice. Article 38(6) prohibits other tasks that would result in a conflict of interests. In practice that rules out people who determine the purposes and means of processing, such as an IT director, a marketing director or an HR director. Our guide to how to choose a DPO in 2026 sets out the selection criteria in detail.
The GDPR imposes no qualification, but the CNIL framework sets clear entry conditions for sitting the certification exam. A candidate must show either two years of professional experience in projects or tasks linked to the DPO role, or two years of experience plus at least 35 hours of data protection training delivered by a training organisation.
In practice, the profiles that succeed combine three foundations, solid legal grounding in the GDPR and national data protection law, an operational understanding of processing and security, and the ability to carry a message to business teams. Our breakdown of GDPR training requirements covers what an organisation should plan for its wider teams, beyond the delegate alone.
A certifying DPO training course prepares candidates for the three domains assessed by the exam, which test the 17 competences listed by the CNIL. Content covers the legal framework, operational compliance and running the function. Identifying the lawful basis for a processing activity, keeping a record, carrying out a data protection impact assessment, managing a breach and building an awareness programme all sit among the expected skills.
A clarification is needed on CNIL DPO training, a heavily searched phrase that describes something different from what most people assume. The CNIL delivers no DPO training and states explicitly that it does not direct candidates towards specific training organisations. What it does offer is a free MOOC, the Atelier RGPD, open to all and useful as a first step rather than as full exam preparation. CNIL DPO training in the strict sense does not exist, what exists is private training aligned to the CNIL framework.
For internal teams, a certifying DPO training course does not replace raising the competence of the wider organisation. Practical GDPR training tailored to each business function is what reduces incident numbers, far more than one person's certificate.
The cost splits into two items, preparatory training and the certification exam, and the CNIL sets neither. Each approved certification body prices its own exam, and training organisations price freely. The CNIL publishes the list of approved bodies, which lets a buyer compare on a reliable basis rather than on a commercial ranking.
The question of a free DPO certification comes up constantly. The answer is no for the certificate itself, since it requires an exam run by an accredited body. The CNIL's Atelier RGPD is free and covers the fundamentals, and part of the preparatory training can sit inside an employer-funded skills development plan. Searching for a free DPO certification therefore leads to free training, which is not the same thing.
The certificate is valid for three years from the date of issue. Renewal requires passing a fresh written exam in the same format and demonstrating at least one year of professional experience linked to the DPO role over the period. The limited validity is deliberate, it forces a refresh on a body of law that moves quickly.
The real timeline then depends on the route. The 35 hours of training amount to roughly a week, on top of which come personal preparation and the lead time to book the exam with the chosen body. A candidate who already meets the experience condition can think in weeks, someone changing career should think in months.
The decision turns on three criteria, knowledge of the organisation, coverage of competences and independence. The GDPR allows both models with no preference. The table below compares what each one brings, ahead of the detail section by section.
An internal DPO knows the processes, the people and the history of each project, which shortens every decision. The model requires time genuinely ring-fenced for the role and effective protection from instructions, as Article 38(3) demands. The main risk is combining the role with other duties, which creates a conflict of interests and undermines the appointment.
An external DPO is appointed under a service contract, in line with Article 37(6). They bring cross-client practice and independence that is easier to evidence, since they sit outside the internal reporting line. In exchange they have to be embedded in governance forums and project reviews, otherwise they discover new processing far too late.
Outsourced DPO services give access to a team rather than a person, covering legal, security and sector specifics without multiplying headcount. Cover continues through absences, the volume of work flexes with projects, and responsibilities are written into a contract. For an organisation without the volume to justify a full-time post, it is the easiest model to sustain. Our article on why outsourcing your DPO is the best GDPR strategy in 2026 goes further into the trade-offs.
Start from the volume and sensitivity of the processing, not from company size. An 80-person business handling health data needs more capacity than a 500-person manufacturer with no sensitive data. A hybrid model works well, an internal point of contact day to day plus DPO coaching for the complex questions.
DPO Consulting has supported European and international organisations on GDPR compliance for more than ten years, with over 50 in-house experts. Depending on the model chosen, that means acting as the appointed outsourced DPO, supporting a delegate already in post, or training the business teams around them.
If you are weighing recruitment against outsourcing, talk to a GDPR expert at DPO Consulting to size the processing that needs covering and the level of expertise required before you open a role.
No. The CNIL states that certification is required neither to perform the role of data protection officer nor to be registered with it. The GDPR requires professional qualities and expert knowledge, assessed against the organisation's own processing.
Yes. Article 37(6) of the GDPR provides that the delegate may fulfil the tasks on the basis of a service contract. The CNIL competence certification, however, is reserved for individuals, so a firm cannot itself be certified.
Yes, on two conditions. They must hold the expert knowledge required by Article 37(5), and their other tasks must not create a conflict of interests under Article 38(6). An employee who decides the purposes and means of a processing activity cannot then oversee it.
In most cases outsourcing is more realistic than recruiting. A small organisation rarely has the volume to justify a dedicated post, and a poorly designed combination of duties creates conflict of interest risk. The deciding factor is the nature of the processing, not headcount.
No. Certificates issued against the CNIL framework go through an approved and accredited body, which carries a cost. The CNIL Atelier RGPD MOOC is free, but it is introductory training, not a certification.
.png)
.svg)
.png)
.png)
