Loading...
We deliver mandatory DPO upskilling for in-house designated officers, privacy office staff, and senior management — Article 39 duties, governance, working with controllers and processors, and supervisory authority engagement. Managed delivery, audit-ready evidence accepted by EU supervisory authorities. Live for your team in under a week.
Tell us your team size — receive a tailored proposal within 1 business day.
Trusted by Compliance Teams at Leading Organizations
Staff training is your first line of defence — and the first piece of evidence regulators ask for.
GDPR Article 37 requires public authorities, controllers/processors performing large-scale regular monitoring, and those processing large-scale special-category data to designate a Data Protection Officer. Article 37(5) requires the DPO to have 'expert knowledge of data protection law and practices' — supervisory authorities increasingly assess this on audit. Article 39 lays out the DPO's specific tasks, and Article 38 protects the DPO's independence. In-house designated DPOs need structured upskilling to fulfil these duties — and the wider privacy office needs the same vocabulary.
Article 37(5) — DPOs must have 'expert knowledge'; supervisory authorities check this on audit
Article 38 — DPO independence and reporting line to highest management level requires the DPO be heard
Article 39 — specific tasks (informing, monitoring, training, advising, cooperating with the supervisor)
Inadequate DPO competence is a published aggravating factor in supervisory authority fining decisions
Curated from our full library and tailored to your DPO designation status, your privacy office structure, and whether you're a controller, processor, or both — you don't pick modules from a menu, we propose the right curriculum.
Article 37 — when DPO designation is mandatory, voluntary, or group-shared
Article 38 — DPO independence, conflict of interest, position within the organisation
Article 39 duties — informing, monitoring, training, advising, supervisor cooperation
Risk-based approach: Records of Processing (Art. 30), DPIAs (Art. 35), LIAs
Working with controllers and processors — Article 28 DPAs and oversight
Data subject rights handling — DSARs, complaints, escalation workflows
Breach response — 72-hour notification, supervisory authority engagement (Art. 33)
Cross-border processing, lead supervisor, one-stop-shop mechanism
International transfers — SCCs, BCRs, adequacy decisions, transfer impact assessments
GDPR ↔ EU AI Act intersection — automated decisions, profiling, AI literacy
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Dated certificates per learner, exportable completion logs, and curriculum records that demonstrate DPO and privacy office competence under Article 37(5).
Track completion across the privacy office, designated DPOs, and senior management. Export evidence packages for supervisory authority queries and customer due-diligence reviews.
SAML 2.0, OIDC, and SCIM provisioning. New privacy office hires enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Multi-year licensing rolls learners forward each year with content updates as the EDPB releases guidance, supervisor decisions accumulate, and EU AI Act enforcement evolves.
Your logo on certificates, co-branded learner emails, and the option to attach your privacy policy, ROPA, DPIA template, or breach response procedure to any module.
We don't sell self-checkout seats to enterprises. We propose a curated curriculum based on your DPO designation status and privacy office structure, manage the rollout, and hand you an evidence package supervisory authorities and customers will accept.
“Our regional supervisor explicitly asked for evidence of our DPO's expert knowledge under Article 37(5). The evidence package — dated certificates, structured curriculum, role-mapped learning records — closed that audit finding in one exchange.”
“We rolled out the DPO program to our group's central privacy office plus the country DPOs across 8 entities. The shared dashboard and per-entity reporting made it easy to demonstrate consistent competence across the group.”
Tell us your DPO designation status (designated, voluntary, group-shared), your privacy office headcount, and your senior management scope. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.
Free proposal · response within 1 business day