DPO Competency Framework and Training Roadmap

The DPO Competency Framework and Training Roadmap (Framework) is developed to guide Data Protection (DP) professionals in enhancing their competencies so as to perform their job functions effectively in an organisation. The Framework outlines the core competencies and proficiency levels for a DPO, and provides guidance on a viable career pathway from entry-level data protection executives to regional data protection senior management roles.

How can the Framework help you?

Organisations

 DP Professionals Training Providers
  • Have a better understanding of the different job functions so as to hire the right Data Protection Officer (DPO)
  • Consider building up the data innovation-related competencies of their DP professionals as they move towards harnessing the value of data to deliver new and improved products and services
  • Clear career path for data protection
  • Identify their competency gaps and relevant training courses to plug the gaps
  • Effectively operationalise the organisation's data protection policies and processes
  • An accompanying Guide to help training providers in developing courses that meet the training needs of DP professionals
  • Detailed description of the competency, proficiency, knowledge and abilities for training providers to design a comprehensive DP course curriculum

The Framework

The Framework comprises a set of:

Job Functions

Job Function Baseline Tasks
Data Protection Executive
  • Monitor and assess the organisation’s personal data protection policies and practices, ensuring compliance with the PDPA. 
  • Identify risks associated with the collection, use, disclosure and storage of personal data and their impact and propose measures to manage the risks.
  • Provide evidences of implementations and practices of the organisation’s data protection policies.
  • Conduct audits, analyse findings and implement changes to address identified gaps. 
  • Identify and map out key stakeholder relationships, needs and interests, and coordinate with key stakeholders on a day-to-day basis.
Data Protection Officer
  • Develop and review a Data Protection Management Programme (DPMP) that covers policy, processes, and people for the handling of personal data at each stage of the data lifecycle.
  • Perform a Data Protection and Impact Assessment (DPIA) to identify, assess and address business risks, based on the organisation’s functions, needs and processes.
  • Develop training programme to educate staff on personal data protection policies and processes / SOPs
  • Oversee activities to foster personal data protection awareness within the organisation.
  • Enhance compliance processes based on an evaluation of gaps in business operations and data protection requirements, and clarify on ethically questionable situations at various stages of data or information life cycle.
  • Facilitate the implementation of data innovation by translating the user’s privacy and personal data protection requirements into data-driven design thinking process.
Regional Data Protection Officer 
  • Oversee data transfer activities and provides leadership guidance on personal data protection law in other jurisdictions.
  • Understand the business operation of the organisation to establish a group/ regional level data governance strategy for data protection and innovation, as well as audit and compliance strategy to strengthen the internal controls.
  • Lead cross functional teams in more than one  country to co-develop remediation actions for minimising risk of personal data protection breach, and managing data breach incidents at group/regional-level.
  • Advise on data ethics and data governance, and facilitate the business functions in strategic utilisation and exploitation of data assets to generate business value for the organisation.
  • Assess the impact of emerging trends and technologies (e.g. Privacy Enhancing Technologies, cloud computing, blockchain, cybersecurity) and world-wide regulatory developments that pose significant risks associated with data protection.

 

Competency and Proficiency Level for Each Job Function

 DP Roadmap v2

Note

A well-rounded DPO must also have non-data protection competencies to support other key tasks such as managing people and organisation. For a complete listing of the competencies relevant to DPOs, refer to the Skills Framework for ICT.

Click on the competency in the table below for a more detailed description of each competency and proficiency level.

Competency Job Function**
DP Executive DPO Group DPO
Data Protection Management
 Level 3
 Level 4
 Level 5
Business Risk Management Level 3
 Level 4
 Level 5
Cyber and Data Breach Incident Management
 Level 2
 Level 4
 Level 5
Stakeholder Management
 Level 3
 Level 4
 Level 5
Audit and Compliance* Level 3 Level 4 Level 5
Data Governance
 - Level 5
 Level 6
Data Ethics* Level 3 Level 4 Level 5
Data Sharing* Level 3 Level 4
 Level 5
Design Thinking Practice*
 Level 3 Level 4
 Level 5

*Competency may not be required depending on the organisation’s needs.

**Proficiency levels are pegged to the Technical Skills and Competencies (TSCs) from the Skills Framework.

DPO Training Roadmap

The DPO Training Roadmap is designed for DPOs to identify the courses necessary to help them achieve the next level of proficiency. The PDPC is working with training partners to apply the Framework in developing full-fledged data protection-related courses. 

More courses will be available progressively from the fourth quarter of 2019. The following shows a tentative list of courses: 

 DPO Executive DPO Group DPO
Data Protection-related Courses  

[Data Protection Management]

[Business Risk Management]

[Cyber and Data Breach Incident Management]

[Audit and Compliance]

[Stakeholder Management]

  

[Data Protection Management]

[Business Risk Management]

[Cyber and Data Breach Incident Management]

[Stakeholder Management]

[Audit and Compliance]

[Data Governance]

  

[Data Protection Management]

[Audit and Compliance]

[Data Governance]

[Cyber and Data Breach Incident Management]

[Stakeholder Management]
Data Innovation-related Courses

[Data Ethics I]

[Data Sharing I]

[Design Thinking Practice I]

[Data Ethics II]

[Data Sharing II]

[Design Thinking Practice II]

[Data Ethics III]  

[Data Sharing III]

[Design Thinking Practice III]

 

Important Note

Training providers are to refer to the Guide to Develop Training Courses for DPOs (Guide) as an additional resource when designing data protection course curriculum for DPOs. 

The Guide will augment the Skills Framework for ICT to provide clarity on the additional knowledge and abilities that are relevant to the work of DPOs.

All data protection courses endorsed under IMDA Critical Infocomm Technology Resource Plus (CITREP+) will be listed on PDPC website.

Interested training providers may write to industry@pdpc.gov.sg to request for a copy of the Guide.

Tags:

Related Resources

Resources as reference materials on the PDPA requirements and good practices to adopt

Related FAQs

Related FAQs

View all