EMERGING CAREER: HOW TO BECOME A DATA PROTECTION OFFICER

What is a DPO: Origin of the data protection officer role

Though emerging as an official job title in the U.S., the data protection officer role originated in 2018 as a required part of General Data Protection Regulation (GDPR) compliance in the European Union (EU). It is an enterprise security leadership role whose primary purpose is to oversee a company's data protection strategy, protect customer data and implement the strategies to keep that consumer data protected.

GDPR was proposed and enacted by the European Parliament, the European Council and the European Commission to strengthen data protection for EU citizens. The role of the data protection officer (DPO) grew from this act, which calls for the "mandatory appointment of a DPO at every organization that processes or stores personal data for EU citizens." GDPR states that the "size of a company or organization is not what necessitates the need for a DPO, but rather the size and scope of the data that's being handled." 

They further state that DPOs must be "appointed for all public authorities and where the core activities of the controller or the processor involve regular and systematic monitoring of data subjects on a large scale, or where the entity conducts large-scale processing of special categories of personal data."

What about the U.S.?

Only the state of California enforces something like GDPR in its California Consumer Privacy Act (CCPA), a data privacy act that originated in January 2020 and gives California residents greater control over how businesses collect and use their personal information. And since there is no other formal or mandated compliance legislation like the GDPR to protect data privacy, the DPO job title isn't quite as common in the U.S., and may be called something different, such as Chief Privacy Officer or Chief Information Security Officer (CISO).

The Federal Trade Commission (FTC) does enforce the Gramm-Leach-Bliley Act (GLBA) in the U.S., which requires financial institutions offering loans, investment advice or insurance, to protect consumer data and make how they use consumer data transparent to their customers. Under the GLBA's Safeguards Rule passed in 2021 by the FTC, a financial institution must have a "qualified individual" overseeing the implementation of its information security program. This is largely considered a DPO-type role, thus recognizing it as a legitimate job title in the U.S.

What does a DPO do?

A data protection officer is required for businesses based on the scale of the data handling that they do, and many small businesses may avoid hiring for the role unless their business model is focused on data collection or storage, which is determined by what defines "data collection." While the role is mandatory in the EU, there are few regulations or rules that inform where a DPO should be hired in the U.S. and even in the EU the job description and when a DPO is mandatory are fuzzy about the criteria. The one agreed-upon set of rules is that who needs a DPO is decided by three factors that define the scale of data collection and storage as outlined in Article 29 of the Data Protection Working Party (WP29). These are:

In defining "large-scale," the GDPR cites four factors that help determine what that is:

• Who are the data subjects?
• What the data items are
• How long will the data be retained? Is it permanent?
• What is the geographical range of the data processed?

What a DPO does on the job:

The job duties for a data protection officer will likely be similar no matter if they work in the EU or the U.S., as the goal of the job is the same. Article 39 of the GDPR, and CPO Magazine define the duties of a DPO as:

• Educate company employees on compliance
• Determine and update data strategy, data governance and data collection best practices
• Conduct data protection impact assessments or DPIAs, which identify and minimize risks in the processing of personal data as early as possible
• Conduct audits to ensure compliance and address potential issues proactively
• Monitor performance and provide advice on the impact of data protection efforts
• Maintain comprehensive records of all data processing activities conducted by the company, so that they can be made public on request
• Cooperate with authorities, acting as a point of contact with them for any request for information addressed to the company, as well as making any inquiries to the authorities on behalf of the company

Ideally, DPOs will have the following skills and knowledge:

The importance of a DPO in data protection and privacy

A DPO is a critical component to a company's security and adherence to compliance in an age when data is compromised on a daily basis. A good data protection officer should be a proactive thinker and doer and foresee solutions that can help keep company employees alerted to compliance and regulations that may ensure the security of not only the company but the data of thousands of individuals. A good DPO will help to guide a business through the complexities of new approaches to privacy regulations, which could impact every department—from human resources, legal, corporate and product, to content, database design, IT infrastructure and cyber security.

Steps to become a data protection officer (DPO)

DPO education and experience

Data protection officers typically need a bachelor's degree in computer science, cyber security or information security or a related field. A bachelor's degree, Juris Doctor or equivalent work experience in privacy, compliance, information security or auditing may also be an alternative. Desired work experience may include five years in privacy and compliance-related risk management positions. Promotion to DPO can likely be considered after 10 years of experience in the various privacy disciplines, such as privacy and policy, privacy law, information governance, incident response, information security, training and awareness.

Certifications for data protection officers

Once you've entered the workforce in a cyber security or information security role, you can hone your skills and educate your way into a DPO position by enrolling in one or more certification programs. Certification programs offer professional credentials that you can add to your title by enhancing your skillset with focused areas of information security or data protection education. Certification programs may require that you have experience or a set period of time on the job before you're eligible to pursue the certification. Other certification providers may simply require you to pass an exam. Once you are eligible, most certifications take a few months to complete.

Some of the professional DPO certifications available for those wishing to enter, or who are currently in a DPO role are:

There are also other certifications available for professionals in the fields of HR, compliance and information security who might desire to expand their knowledge of data privacy regulation or move into a DPO role, or in the case of the CDPO certification, help them gain needed regulatory knowledge as a practicing DPO:

Bootcamps for DPOs

Bootcamps are another way to get focused training programs that prepare students with specific skills needed to enter the field of information security or any field you may be wanting to enter, such as cyber security or IT. Some bootcamps are designed for data security or data privacy professionals who already have some experience in the field or on the job, but most bootcamps are meant for people with very little to no previous experience in the area. These programs can usually be completed in a few months, are usually online and can be immersive and intensive.

Since the DPO role is relatively unique and new, a bootcamp may be a great way for professionals to get basics in information security, cyber security and related subjects quickly so they can begin their move toward data protection entry-level practitioner roles with a solid knowledge base.

Some bootcamps that may help lay the foundation include:

Flatiron School Cybersecurity Engineering Bootcamp

What you'll learn: You'll graduate prepared for a range of vital tier 1+ cyber security roles—like security engineer or penetration tester 

Format: Classroom or online

Length: 15 weeks

---

Columbia University Online Cybersecurity Bootcamp

What you'll learn: Real-world training in networking, systems, web technologies, databases and defensive and offensive cybersecurity

Format: Online

Length: 24 weeks

---

Data Incubator Data Science Bootcamp

What you'll learn: Data Science technologies with advanced Machine Learning, Natural Language Processing (NLP), advanced analytics and more

Length: 8 weeks

---

360DigiTMG Data Science for Internal Auditors

What you'll learn: Innovative technologies in internal auditing and utilizing them to improve business operations. You'll understand the fraud analytics lifecycle and learn about various data analytics, such as descriptive and predictive analytics, and you'll learn advanced techniques to detect fraud.

Length: 4 weeks

Data protection officer salary

Since DPOs can come from other parallel careers, such as compliance officer, or computer science and IT careers, it's hard to pinpoint an average salary for the field. The U.S. Bureau of Labor Statistics does not track salaries specific to DPOs, but it does cite median annual salaries for many of the cyber careers from which a DPO might come. Here are some comparisons of different careers to give you an idea of what an enterprise security leadership role's salary may be.

Because DPOs are mandatory in the EU for any business that collects data, it's difficult to gauge where a DPO might work based on geographical location. Rather, it would be more likely that DPOs would have a higher concentration of opportunities based on the type of business. For example, in the U.S. it makes sense that DPOs would be in demand near and around Washington D.C. where there are federal agencies that store data, such as the IRS. Areas pocketed with high tech, such as Silicon Valley or San Francisco and Seattle, may also be potentially high-employment geographic locations.

Some businesses or agencies where DPOs may be employed are:

• Federal government agencies that collect and store information, such as the IRS, FBI, Social Security Agency or NSA
• Military
• Local and state government agencies
• Financial institutions, including lenders, investment, securities and banking
• Technology, internet and e-commerce hubs
• Insurance companies, including healthcare
• Healthcare companies and hospitals
• Non-profits and not-for-profit businesses that collect data

Another factor in pay might be education level. While a master's degree isn't required, a bachelor's and experience are a must, and some positions require five or more years of experience in a related privacy role, such as compliance or HR, to even begin to take the steps to apply for a DPO position.

Frequently asked questions (FAQs)

Getting started as a DPO

With data protection and privacy becoming more integral to businesses every day, and laws and regulations being enacted to make companies accountable and liable for the data they are obligated to protect, the role of the DPO also becomes more critical and essential. If you are an independent and compliance-minded crusader who is dedicated to keeping user data safe and protected under the law, then why not get started on a DPO career path?

Not only will you showcase your grasp of the relevant laws, but you'll never stop learning as a DPO. If you are currently working in data science or analytics, HR, compliance or information/cyber security but want to step up to a career that is just beginning to make its presence felt in a big way, a DPO bootcamp, data science degree or certification program can help you tale the first step toward helping guide businesses through the complex new approach to privacy regulations.

To get started, all you need to do is click the Find Schools button and find the program that fits your needs.

---

Published: July 20, 2023