The Spanish Data Protection Agency (AEPD) has published the person certification scheme for the new position of the Data Protection Officer (DPO) which will recognise the professional's abilities to appropriately perform their functions.

The new General Data Protection Regulation (Reg. EU 2016/679), coming into force in May 2018, sets up the position of Data Protection Officer (DPO), a position that will be mandatory in certain organizations depending on the risk level of operations and data handling, as in the case of public administrations or hospitals.

The Regulation sets out the DPO's roles and responsibilities, but not what their competence or professional qualifications and experience should be. So, the Spanish Data Protection Agency (AEPD), aware of the market's need to identify competent professionals for the job, has decided to develop a certification scheme by using the tools established internationally to give confidence in the professionals' competence which is the persons certification accredited by ENAC according to the ISO 17024 standard.

The confidence provided by the accredited certification is based, as noted in the presentation this morning, on two main pillars:

• The existence of a certification scheme, developed by the Agency in cooperation with all the interested parties and based on the principles set out by the standard, identified the abilities people wanting to responsibly perform this function should have.
• The requirement that people who want to be certified for these skills need to be evaluated by certification bodies accredited by ENAC according to the requirements set out in the ISO 17024 standard that ensure their technical competence and impartiality.

Therefore, companies will benefit from transparent and accurate information on the abilities a person to be hired as DPO should have, if that person has been certified in the AEPD framework.

ENAC and AEPD Partnership

The presented scheme is part of a wider collaboration between the two agencies and which has resulted in the signing of a General Action Protocol, setting out the cooperation framework in all matters relating to the accreditation of compliance inspection agencies (OEC) for the certification of data protection officers under the scheme.

To check the requirements of the persons certification scheme for the new position of data protection officer, you can go to the following link to the AEPD webpage.

Detailed information about the accreditation process for this activity can be found in our documents section. If you have any questions please contact Roberto Cánovas, from ENAC Certification Department.