The DPO Competency Framework and Training Roadmap (Framework) is developed to guide Data Protection (DP) professionals in enhancing their competencies so as to perform their job functions effectively in an organisation. The Framework outlines the core competencies and proficiency levels for a DPO, and provides guidance on a viable career pathway from entry-level data protection executives to regional data protection senior management roles.

How can the Framework help you?

Organisations	DP Professionals	Training Providers
Have a better understanding of the different job functions so as to hire the right Data Protection Officer (DPO) Consider building up the data innovation-related competencies of their DP professionals as they move towards harnessing the value of data to deliver new and improved products and services	Clear career path for data protection Identify their competency gaps and relevant training courses to plug the gaps Effectively operationalise the organisation's data protection policies and processes	An accompanying Guide to help training providers in developing courses that meet the training needs of DP professionals Detailed description of the competency, proficiency, knowledge and abilities for training providers to design a comprehensive DP course curriculum

The Framework

The Framework comprises a set of:

3 job functions
9 competencies, each with a proficiency level where relevant, to strengthen the DPO’s capabilities with respect to data protection and data innovation
Training roadmap

Job Functions

Job Function	Baseline Tasks
Data Protection Executive	Monitor and assess the organisation’s personal data protection policies and practices, ensuring compliance with the PDPA. Identify risks associated with the collection, use, disclosure and storage of personal data and their impact and propose measures to manage the risks. Provide evidences of implementations and practices of the organisation’s data protection policies. Conduct audits, analyse findings and implement changes to address identified gaps. Identify and map out key stakeholder relationships, needs and interests, and coordinate with key stakeholders on a day-to-day basis.
Data Protection Officer	Develop and review a Data Protection Management Programme (DPMP) that covers policy, processes, and people for the handling of personal data at each stage of the data lifecycle. Perform a Data Protection and Impact Assessment (DPIA) to identify, assess and address business risks, based on the organisation’s functions, needs and processes. Develop training programme to educate staff on personal data protection policies and processes / SOPs Oversee activities to foster personal data protection awareness within the organisation. Enhance compliance processes based on an evaluation of gaps in business operations and data protection requirements, and clarify on ethically questionable situations at various stages of data or information life cycle. Facilitate the implementation of data innovation by translating the user’s privacy and personal data protection requirements into data-driven design thinking process.
Regional Data Protection Officer	Oversee data transfer activities and provides leadership guidance on personal data protection law in other jurisdictions. Understand the business operation of the organisation to establish a group/ regional level data governance strategy for data protection and innovation, as well as audit and compliance strategy to strengthen the internal controls. Lead cross functional teams in more than one country to co-develop remediation actions for minimising risk of personal data protection breach, and managing data breach incidents at group/regional-level. Advise on data ethics and data governance, and facilitate the business functions in strategic utilisation and exploitation of data assets to generate business value for the organisation. Assess the impact of emerging trends and technologies (e.g. Privacy Enhancing Technologies, cloud computing, blockchain, cybersecurity) and world-wide regulatory developments that pose significant risks associated with data protection.

Competency and Proficiency Level for Each Job Function

Note

A well-rounded DPO must also have non-data protection competencies to support other key tasks such as managing people and organisation. For a complete listing of the competencies relevant to DPOs, refer to the Skills Framework for ICT.

Click on the competency in the table below for a more detailed description of each competency and proficiency level.

Competency	Job Function**
Competency	DP Executive	DPO	Group DPO
Data Protection Management	Level 3	Level 4	Level 5
Business Risk Management	Level 3	Level 4	Level 5
Cyber and Data Breach Incident Management	Level 2	Level 4	Level 5
Stakeholder Management	Level 3	Level 4	Level 5
Audit and Compliance*	Level 3	Level 4	Level 5
Data Governance	-	Level 5	Level 6
Data Ethics*	Level 3	Level 4	Level 5
Data Sharing*	Level 3	Level 4	Level 5
Design Thinking Practice*	Level 3	Level 4	Level 5

*Competency may not be required depending on the organisation’s needs.

**Proficiency levels are pegged to the Technical Skills and Competencies (TSCs) from the Skills Framework.

DPO Training Roadmap

The DPO Training Roadmap is designed for DPOs to identify the courses necessary to help them achieve the next level of proficiency. The PDPC is working with training partners to apply the Framework in developing full-fledged data protection-related courses.