The European Data Protection Board published its first opinion regarding certification schemes, responding to a submission from Luxembourg’s National Commission for Data Protection on its EU GDPR Certified Assurance Report-based Processing Activities. In his opinion, the board underlined the importance of the DPO’s skills.
The DPO qualification following the Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria.
Reminder:
The General Data Protection Regulation (GDPR) has established the concept of a Data Protection Officer (DPO) in Europe. DPOs are independent data protection experts who are responsible for monitoring an organisation’s compliance, informing it of, and advising on its data protection obligations, and acting as a contact point for data subjects and the relevant supervisory authority. Organisations must assess whether they need to appoint one and, if so, who they should give that responsibility to. There are some legal requirements that must be met, such as avoiding conflicts of interest, which can prove challenging. Recent European case law, particularly in Germany and France, has further clarified and reinforced the expectation that DPOs must operate with genuine independence, both in terms of reporting lines and absence of conflicting operational roles.
The opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR-CARPA certification criteria, adopted by the European Data Protection Board (EDPB) on February 1, 2022, outlines, among other things, the obligations applicable to controllers and processors.
The board of the EDPB underlined the importance of the DPO’s skills. Indeed, the Luxembourg Supervisory Authority suggested two criteria to evaluate the qualification of the DPO if he/she does not have a minimum of three years of professional experience:
(i) The DPO must have two years of legal experience and have undergone extensive training on data protection; or
(ii) The DPO has access to in-house legal assistance, or via an open-ended service contract with an external firm, covering all GDPR topics.
According to the EDPB, this second requirement should not be used alone in assessing the qualification of the DPO. The Board mentions that the DPO should not be considered qualified only because he/she “has access to legal assistance internally, or via a non-limiting service contract with an external firm, covering all GDPR subjects.”
This criterion could be an additional condition for assessing the DPO’s competencies, but not a stand-alone, exclusive requirement. Since GDPR compliance within an organization relies heavily on the work and regular expertise of a DPO, it is paramount that this position be assigned to someone with the appropriate expertise. However, the required data protection training must be recent and up to date. In 2025, several supervisory authorities (including the CNIL and the BfDI) recommend that DPOs receive formal refresher training at least once a year to maintain up-to-date knowledge. Additionally, some non-EU countries such as China now require organisations to officially register their DPO with local authorities when certain data processing thresholds are met.
Does the situation seem complex and you are not sure of what to do? You feel that this is too many skills for one person?
Indeed. This is really hard to find a person combining all the recommended skills. This is why at MyData-TRUST, our main strength is our multidisciplinary team, composed of Data Protection Officers (DPO) specialized in the healthcare sector, lawyers specialized in data protection and privacy, and cybersecurity experts, highly trained in data protection and privacy. Our DPOs are certified by the Maastricht University, after following a 6-month intense training, and work very closely with our legal and IT teams. In 2025, externalised DPO models (DPO-as-a-Service) have become the preferred solution in highly regulated sectors, offering a reliable response to increasing demands for expertise, neutrality, continuity of service, and up-to-date regulatory insight.
When appointing your external DPO at MyData-TRUST, you have only one point of contact: your DPO, and behind this person stands a multidisciplinary team of experts ready to support you.
In 2025, organisations face increasingly complex challenges in data protection, including artificial intelligence oversight, cybersecurity integration, secondary use of health data, and risk management in clinical research. Our team combines legal, technical, and sector-specific expertise to help you navigate these evolving obligations with confidence.
If you are an organisation operating in the health sector and looking for tailored advice or further information, contact MyData-TRUST. We will be pleased to assist you.
