01
Article 37(5) — DPOs must have 'expert knowledge'; supervisory authorities check this on audit
Loading...
We deliver mandatory DPO upskilling for in-house designated officers, privacy office staff, and senior management — Article 39 duties, governance, working with controllers and processors, and supervisory authority engagement. Managed delivery, audit-ready evidence accepted by EU supervisory authorities. Live for your team in under a week.
GDPR Article 37 requires public authorities, controllers/processors performing large-scale regular monitoring, and those processing large-scale special-category data to designate a Data Protection Officer. Article 37(5) requires the DPO to have 'expert knowledge of data protection law and practices' — supervisory authorities increasingly assess this on audit. Article 39 lays out the DPO's specific tasks, and Article 38 protects the DPO's independence. In-house designated DPOs need structured upskilling to fulfil these duties — and the wider privacy office needs the same vocabulary.
Article 37(5) — DPOs must have 'expert knowledge'; supervisory authorities check this on audit
Article 38 — DPO independence and reporting line to highest management level requires the DPO be heard
Article 39 — specific tasks (informing, monitoring, training, advising, cooperating with the supervisor)
Inadequate DPO competence is a published aggravating factor in supervisory authority fining decisions
Different roles face different risks. Training tailored to job responsibilities.
A 60-min working session with a specialist. We map your obligations, current training gaps, and regulator priorities in your jurisdiction.
Your processes, contacts, and policies go into the modules. We brand the LMS, wire SSO, and connect HRIS so enrolment is automatic.
Roll out to all staff. Automated nudges hit non-completers. Manager dashboards in real time. Audit-ready records when regulators ask.
Ready to scope your programme?
Book a 30-min discovery call — no slides, no pitch, just specifics.
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Dated certificates per learner, exportable completion logs, and curriculum records that demonstrate DPO and privacy office competence under Article 37(5).
Track completion across the privacy office, designated DPOs, and senior management. Export evidence packages for supervisory authority queries and customer due-diligence reviews.
SAML 2.0, OIDC, and SCIM provisioning. New privacy office hires enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Multi-year licensing rolls learners forward each year with content updates as the EDPB releases guidance, supervisor decisions accumulate, and EU AI Act enforcement evolves.
Your logo on certificates, co-branded learner emails, and the option to attach your privacy policy, ROPA, DPIA template, or breach response procedure to any module.
Our regional supervisor explicitly asked for evidence of our DPO's expert knowledge under Article 37(5). The evidence package — dated certificates, structured curriculum, role-mapped learning records — closed that audit finding in one exchange.
Don't see your question? Send us a note — we usually reply same day.
Ask a questionTell us your DPO designation status (designated, voluntary, group-shared), your privacy office headcount, and your senior management scope. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.