Can anyone become a DPO in Germany?

People from different professional backgrounds can become a data protection officer in Germany, but not everyone is suitable for appointment. GDPR Article 37(5) requires professional qualities, expertise in data protection law and practice, and the ability to perform the Article 39 tasks. Other responsibilities must not create a conflict of interest under Article 38(6).

Consider an organisation choosing between a legal specialist, an IT professional and an employee who has completed DPO training. Each brings something useful. Before appointing anyone, the organisation needs to examine what they know, what they can do and which processing decisions they already control.

Whether you are considering an appointment or assessing a colleague, the useful question is more specific than “Can anyone become a DPO?” It is: “Is this person suitable for this organisation’s processing and working arrangements?”

Do you need a degree or certificate to become a DPO?

Article 37(5) does not prescribe a particular university degree or named certificate. Its focus is competence and ability. You can read the provision in the Article 37 text published by Deutsche Rentenversicherung.

That distinction creates opportunities for people without a law degree. It also prevents a degree from becoming a substitute for assessing relevant expertise.

The Hessian supervisory authority’s FAQs explain that a certificate is not compulsory and that the route by which knowledge is acquired is not prescribed. They also emphasise adapting expertise to the working environment.

Keep three types of requirement separate:

A certificate can provide evidence of training or assessment. Examine what it actually records: attendance, completion, examination results or another defined achievement.

If you are comparing certified data protection officer requirements, first establish whether the page describes a credential or a legal appointment. Those are different questions, and their requirements should not be merged.

Which professional backgrounds can help?

A useful background gives you relevant experience to build on. It does not remove the need to assess gaps.

The following comparison illustrates potential strengths and areas to examine. These are not legal eligibility categories.

Return to the hypothetical candidates. The legal specialist might explain the rules clearly but need a better understanding of the systems. The IT professional might understand the systems but lack relevant legal knowledge. The trained employee might understand course examples but need to demonstrate how that knowledge applies at work.

These are possibilities to investigate, not conclusions about particular professions.

Ask each candidate to explain the same processing scenario. What information would they request? Which issues would they investigate? How would they communicate their advice? Their reasoning gives you more to assess than a job title alone.

What legal and practical knowledge do you need?

The required expertise depends on the processing and the protection the data needs. The Brandenburg supervisory authority’s guidance explains this context-sensitive approach.

A person’s readiness for one setting should therefore not be assumed to establish readiness for every sector, organisation or processing activity.

Legal knowledge you can apply

Preparation should help you assess relevant GDPR provisions, the BDSG and other applicable rules. The following are useful assessment areas, rather than a statutory examination syllabus:

• Lawful bases, purpose limitation and data minimisation.

• Transparency and individuals’ rights.

• Controller and processor responsibilities.

• Security obligations and personal-data breaches.

• Data protection impact assessments and international transfers.

• The DPO’s tasks, position and independence.

Applying the rules involves more than recalling article numbers. Consider a proposal to reuse recruitment information for a different purpose. A useful assessment identifies the relevant facts, explains the legal questions and makes clear what remains unresolved.

Understanding processing and organisational practice

You also need to understand what happens to information: where it originates, who accesses it, which suppliers receive it and how it is retained.

Useful practical abilities include asking precise questions, reviewing evidence and explaining findings to people with different responsibilities. Recognising when specialist input is needed also helps avoid unsupported advice.

When do other responsibilities create a conflict of interest?

A candidate can have strong expertise and still have responsibilities incompatible with the DPO role.

The European Data Protection Board’s DPO guide explains that other tasks must not place the DPO in a position where they determine the purposes and means of personal-data processing. It identifies management positions as common conflict risks, while recognising that other functions can also create conflicts. 

Assess decisions, not just job titles

Look at the candidate’s actual authority. Who decides why information is processed and how the processing operates? Would the person then monitor decisions they made in another capacity?

Relevant questions include:

• Do they determine what employee or customer information is collected?

• Do they decide its uses, access arrangements or retention?

• Would their DPO monitoring cover those decisions?

Use the answers to investigate the arrangement. A job title can signal a concern, but it does not describe every responsibility.

Two examples of responsibilities to examine

Example 1: an HR decision-maker. Consider a hypothetical HR manager who determines which employee-monitoring information is collected and how it is used. Appointing that person as DPO would create a conflict concern requiring assessment: their independent monitoring would cover processing decisions they control.

Example 2: an IT professional with advisory duties. Consider a technical specialist who explains security options but does not determine processing purposes or means. Their IT background alone does not settle the conflict assessment. Examine their authority, additional duties and proposed DPO work before reaching a conclusion.

Changing a role description without changing actual responsibilities does not resolve the underlying concern. Additional responsibilities may need restructuring; a different internal candidate or an external appointment may need consideration.

How can you assess readiness for a DPO appointment?

Use the following recommended checklist to organise the assessment. It is not a prescribed legal form or a points-based eligibility test.

Sample advice notes, relevant experience and documented learning can inform the discussion. Do not treat a single exercise as conclusive proof.

Distinguish development needs from conflicting responsibilities: further study may address a knowledge gap, while incompatible decision-making duties require an organisational response.

For broader context, GCI’s strategic data protection in practice discusses how privacy work connects with governance.

How can training help you prepare?

Use the assessment to choose your next step. Our complete guide to DPO certification in Germany provides broader qualification context.

GCI’s Data Protection Officer (DPO) Certification Training lists GDPR, BDSG, DPO responsibilities, DPIAs and technical and organisational measures in its curriculum. Compare these topics with the gaps you need to address. 

Completing training does not automatically establish suitability for a particular appointment or remove conflicts in another role.

View the DPO course curriculum