DPO Certificate: Is It Mandatory? What the Law Actually Says

It's one of the most widespread misconceptions in the GDPR world: "To be a DPO, you need a mandatory certificate." On course websites, in ads, sometimes even in tender specifications, it shows up as if it were a requirement of the law. It isn't.

Let's separate the myth from the text. The short answer: the law requires competence, not a certificate. And the difference matters — both for companies that appoint a DPO and for people who want to become one.

What the GDPR actually requires

The conditions for designating a data protection officer are set out in Article 37 of the GDPR. Paragraph (5) is the relevant one here, and it says plainly: the DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices, as well as the ability to fulfil the tasks referred to in Article 39.

Notice what it does not say: it does not call for a particular diploma, a state exam, an accreditation or a "DPO certificate". The text speaks about the level of knowledge and the ability to do the job, in proportion to the complexity and sensitivity of the organisation's processing. The riskier the processing, the higher the expertise expected — but not in the form of a piece of paper.

This is confirmed by the official DPO guidance of the European Data Protection Board (EDPB), carried over from the former Article 29 Working Party: professional certification is not a legal requirement to be a DPO. It is a possible good practice, not an obligation.

The supervisory authority neither issues nor requires a "DPO certificate"

A second common misconception: the idea that the supervisory authority hands you a kind of "DPO attestation". That is not the case. ANSPDCP does not issue and does not make the designation of a data protection officer conditional on obtaining any certificate from it. What happens instead is a notification of the DPO's contact details to the authority (Art. 37(7)) — an administrative step, not an exam.

In other words, there is no public authority in Romania that "authorises" individuals as DPOs. The responsibility for appointing a genuinely competent person stays with the organisation (the data controller).

So what are the courses and certificates?

Here we need to be precise, so we don't swing to the opposite extreme. In Romania there is a recognised occupation — "Data protection officer" — with an occupational standard and a place in the national classification of occupations. On that basis, training providers run courses that, at the end, issue a certificate of professional competence.

What does such a certificate prove? That you attended and passed structured training. That's it — and that's not nothing. It is useful, it is credible to a partner or an employer, and it can speed up your entry into the role. But it must be said just as clearly: it is not a statutory condition to be designated DPO. The GDPR does not impose it and ANSPDCP does not impose it. Anyone presenting it as "mandatory by law" is overstating it.

Watch out for marketing myths

Phrases such as "mandatory DPO certification", "the only certificate the law accepts" or "you can't practise without this attestation" are red flags. None of them has any basis in the GDPR. Often they turn useful training into a false obligation, to justify the price.

What you should look for instead, in a person or a firm about to act as DPO:

• Real, current expertise — both on the legal side (GDPR, national law) and on information security. The field keeps changing; knowledge from three years ago is not enough.
• Practical experience — records of processing drawn up, DPIAs carried out, data subject requests handled, incidents managed. Not just theory.
• References — verifiable clients or projects, not just promises.
• Ongoing learning — attending training, following ANSPDCP and European authority decisions, reading EDPB guidance.

What genuinely matters for a credible DPO

Beyond any paper, a serious data protection officer needs a concrete set of competences:

• Knowledge of the GDPR and national law, in particular Law no. 190/2018, which sets out how the regulation applies in Romania.
• Understanding of the organisation — what data it collects, why, how it flows, where it is stored. Without that, advice stays generic.
• Information security literacy — the DPO need not be a security engineer, but must understand the technical risks and reasonable measures.
• Independence and no conflict of interest — conditions imposed by Art. 38 of the GDPR, which matter more than any diploma.

If you want to dig into the role itself, we've written at length about what a DPO is and about who can be the GDPR data protection officer. For small and medium businesses, an outsourced DPO brings up-to-date competence without the cost of an extra employee.

And yet, training matters

None of this means training is pointless — quite the opposite. A good course is the fastest way to build or refresh the competence required by Art. 37(5). The key is to treat it correctly: as an investment in what you can do, not as "the mandatory certificate" without which you're not allowed to exist.

In that spirit, we offer training courses for data protection officers and for the teams that work with personal data every day — to build real competence and keep it current.

In conclusion

The question "Is the DPO certificate mandatory?" has a short answer: no. The law requires competence — expert knowledge and the ability to do the job — not a piece of paper. A certificate can prove you've learned and has its value, but it doesn't make you a DPO on its own and is not imposed by the GDPR or by ANSPDCP. Choose people and partners by what they know and have demonstrated, not by a promise of "mandatory accreditation".

Frequently asked questions