Article 37(5) — DPOs must have 'expert knowledge'; supervisory authorities check this on audit
Done-for-you DPO training for your privacy program
We deliver mandatory DPO upskilling for in-house designated officers, privacy office staff, and senior management — Article 39 duties, governance, working with controllers and processors, and supervisory authority engagement. Managed delivery, audit-ready evidence accepted by EU supervisory authorities. Live for your team in under a week.
- 100,000+ professionals trained
- Article 39 duties covered end-to-end
- Live for your team in 5 business days
Why structured DPO training is mandatory — not optional
GDPR Article 37 requires public authorities, controllers/processors performing large-scale regular monitoring, and those processing large-scale special-category data to designate a Data Protection Officer. Article 37(5) requires the DPO to have 'expert knowledge of data protection law and practices' — supervisory authorities increasingly assess this on audit. Article 39 lays out the DPO's specific tasks, and Article 38 protects the DPO's independence. In-house designated DPOs need structured upskilling to fulfil these duties — and the wider privacy office needs the same vocabulary.
Article 38 — DPO independence and reporting line to highest management level requires the DPO be heard
Article 39 — specific tasks (informing, monitoring, training, advising, cooperating with the supervisor)
Inadequate DPO competence is a published aggravating factor in supervisory authority fining decisions
Role-based
by default.
Different roles face different risks. Training tailored to job responsibilities.
- 01Designated DPOs
Designated DPOs
- 02Privacy Office Staff
Privacy Office Staff
- 03Senior Management
Senior Management
- 04DSAR Handlers
DSAR Handlers
- 05Data Processing Vendors
Data Processing Vendors
- 06AI Governance Lead
AI Governance Lead
From kickoff to fully trained in under four weeks.
- Week 1 · Discovery
Scope your risk
A 60-min working session with a specialist. We map your obligations, current training gaps, and regulator priorities in your jurisdiction.
- Compliance scan
- Regulator review
- Role-based gap analysis
- Week 2–3 · Build
Tailor & integrate
Your processes, contacts, and policies go into the modules. We brand the LMS, wire SSO, and connect HRIS so enrolment is automatic.
- Custom scenarios
- White-label LMS
- HRIS / SSO sync
- Week 4+ · Operate
Deploy & evidence
Roll out to all staff. Automated nudges hit non-completers. Manager dashboards in real time. Audit-ready records when regulators ask.
- Automated nudges
- Real-time dashboards
- Evidence pack
Ready to scope your programme?
Book a 30-min discovery call — no slides, no pitch, just specifics.
What every enterprise rollout includes
Managed rollout in 5 business days
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Article 39 audit-ready evidence
Dated certificates per learner, exportable completion logs, and curriculum records that demonstrate DPO and privacy office competence under Article 37(5).
Manager dashboard & reporting
Track completion across the privacy office, designated DPOs, and senior management. Export evidence packages for supervisory authority queries and customer due-diligence reviews.
Single sign-on (SSO) & SCIM
SAML 2.0, OIDC, and SCIM provisioning. New privacy office hires enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Annual refresher cycle built-in
Multi-year licensing rolls learners forward each year with content updates as the EDPB releases guidance, supervisor decisions accumulate, and EU AI Act enforcement evolves.
Custom modules & policy attestations
Your logo on certificates, co-branded learner emails, and the option to attach your privacy policy, ROPA, DPIA template, or breach response procedure to any module.
Our regional supervisor explicitly asked for evidence of our DPO's expert knowledge under Article 37(5). The evidence package — dated certificates, structured curriculum, role-mapped learning records — closed that audit finding in one exchange.
Common questions.
Don't see your question? Send us a note — we usually reply same day.
Ask a questionReady to brief us on your team rollout?
Tell us your DPO designation status (designated, voluntary, group-shared), your privacy office headcount, and your senior management scope. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.