Home › Training Courses › Certified Data Protection Officer (C-DPO) Training Course
The Certified Data Protection Officer (C-DPO) Course is the professional qualification for anyone stepping into one of the most legally demanding roles in a UK organisation. Whether you have just been appointed as your company’s DPO or you are preparing for that position, this four-day, IBITGQ-accredited programme gives you the practical knowledge to carry out the role with confidence. You will learn to lead Data Protection Impact Assessments (DPIAs), manage complex data subject requests, report breaches to the ICO within the statutory deadline, and build a compliance framework that genuinely holds up — all within the requirements of the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. Pass the included exam and earn the internationally recognised, ISO 17024-certificated C-DPO (Provisional) qualification and 28 CPD points.
- 4-Day Intensive Training — Live Online or UK Classroom
- Exam Included — ISO 17024-certificated IBITGQ exam (150 questions, 4 hours), no extra charge
- 28 CPD Points awarded on successful completion
- Accredited by IBITGQ (International Board for IT Governance Qualifications)
- Free Tools Included — DPIA tool and GDPR compliance gap assessment tool
- Prerequisite: Certified GDPR Foundation certificate (or equivalent)
Also available: Self-Paced E-Learning | In-House Corporate Training
Book Your Place
Step 1 — Select Location
Live Online / London / Manchester
Step 2 — Select Date
Multiple guaranteed dates available. See the course calendar for the full schedule.
Step 3 — Quantity & Book
From £2,395 + VAT
Training a team of 4 or more? In-House Training is usually more cost-effective.
⚠️ Prerequisite: You must hold a Certified GDPR Foundation certificate — or equivalent knowledge — before attending this course.
What is the Certified Data Protection Officer Course?
Think of the difference between reading the Highway Code and actually driving a car. The GDPR Foundation course gives you the Highway Code. The C-DPO course puts you behind the wheel.
The DPO role carries real statutory weight. Under Articles 37 to 39 of the UK GDPR, a Data Protection Officer must have expert knowledge of data protection law and the ability to operate independently within an organisation. That is a substantial ask — particularly for someone who has just been handed the title with little formal preparation.
This course closes that gap. Over four intensive days, you move from knowing what the law says to knowing how to apply it. Every session is delivered by active privacy consultants who carry out DPIAs, handle DSARs, and manage ICO communications for live organisations. The examples they use come from genuine experience, not textbooks.
By the end of Day 4, you can advise controllers and processors on their obligations, lead a full DPIA, manage a data breach within the 72-hour window, and run an internal data protection audit. That is a very different position to where most delegates start.
Key Skills You Will Build
- Understand and apply Articles 37–39 of the UK GDPR — the legal basis for the DPO role
- Lead Data Protection Impact Assessments (DPIAs) from start to finish, including mandatory triggers and ICO guidance
- Handle Data Subject Access Requests (DSARs) — redactions, exemptions, and statutory deadlines
- Manage data breach response — 72-hour ICO notification and high-risk individual communications
- Draft Article 28 Data Processing Agreements (DPAs) with third-party suppliers
- Build and maintain Article 30 Records of Processing Activities (RoPA) that hold up to audit
- Advise leadership on data protection obligations, risks, and governance
- Plan and conduct internal data protection audits and manage relationships with the ICO
The 4-Day Course Syllabus
Each day builds directly on the last, taking you from legal frameworks and governance through to breach response, international transfers, and your certification exam.
DAY 1 — Legal Framework & the DPO Role
- The UK GDPR, Data Protection Act 2018, and the Data (Use and Access) Act 2025 — what each requires and how they fit together
- DPO appointment under Articles 37–39: when it is mandatory, what independence means in practice, and managing conflicts of interest
- Controller, Processor, Joint Controller, and Sub-Processor obligations
- The DPO’s reporting lines within an organisation’s governance structure
- Lessons from real enforcement cases — what went wrong and why
DAY 2 — Data Mapping, Lawful Bases & Subject Rights
- Building Article 30 Records of Processing Activities (RoPA) that hold up to ICO scrutiny
- Choosing the correct lawful basis — Legitimate Interests Assessments versus explicit consent
- Handling DSARs: redaction protocols, legal exemptions, and meeting the one-month statutory deadline
- Drafting compliant internal and external privacy notices
- Cross-border data transfer rules post-Brexit: UK IDTAs, Standard Contractual Clauses, and Transfer Risk Assessments
DAY 3 — DPIAs, Security Measures & Vendor Risk
- When a DPIA is legally required — ICO guidance on AI processing, biometric data, and large-scale monitoring
- Step-by-step DPIA methodology, working through a live case study using the included DPIA tool
- Article 32 Technical and Organisational Security Measures (TOMs) — what ‘appropriate’ actually means
- Privacy by Design and by Default — embedding it into systems and processes from day one
- Vendor risk assessment and drafting Article 28 Data Processing Agreements
DAY 4 — Breach Response, Auditing & Certification Exam
- Data breach management — containment, risk threshold analysis, and 72-hour ICO notification
- Notifying affected individuals in high-risk breach scenarios
- Internal audit planning and managing ICO inspections and formal investigations
- Using the included GDPR compliance gap assessment tool
- Exam preparation, review, and the official IBITGQ C-DPO certification assessment
Comparing GDPR Qualifications
Not sure which level is right for you? This table shows how the C-DPO sits alongside the Foundation, Practitioner, and combined DPO training routes.
| Feature | GDPR Foundation | GDPR Practitioner | DPO Training Path | C-DPO (This Course) |
|---|---|---|---|---|
| Focus | Core concepts & legal principles | Practical programme management | Strategy, leadership & ICO liaison | Full DPO role execution |
| Duration | 1 Day | 4 Days | 5 Days (Foundation + Practitioner) | 4 Days (2-Day Accelerated option available) |
| Target Role | HR, IT, general staff | Privacy leads, compliance managers | Appointed & outsourced DPOs | Appointed DPOs & aspiring DPOs |
| Prerequisites | None | Foundation certificate | Foundation certificate | Foundation certificate required |
| CPD Points | 7 CPD Points | 28 CPD Points | 35 CPD Points | 28 CPD Points |
| Exam Format | 40 questions, 60 minutes | 40 questions, 90 minutes | Advanced combined assessment | 150 questions, 4 hours, 75% pass mark |
Exam & Qualification Details
The exam is taken online on Day 4 of the course, set and invigilated by IBITGQ. The fee is fully included in the course price — no extra booking, no surprises.
Exam Format
- Delivery: Online, taken on Day 4 of the course
- Duration: 4 hours (240 minutes)
- Questions: 150 multiple-choice questions
- Pass mark: 75% (113 correct answers)
- Results: Provisional results immediately; confirmed within 10 working days
- Retakes: Available for an additional fee if needed
What Qualifications Will I Receive?
Delegates who pass are awarded the ISO 17024-certificated C-DPO (Provisional) qualification by IBITGQ, along with 28 CPD points. Your certificate is emailed within 10 working days. To upgrade to full C-DPO Professional status, you need to provide evidence of 36 months of verified DPO experience and 50 CPD learning hours — a straightforward path for anyone active in the role. You can also register on the IBITGQ/GASQ successful candidate register, a publicly verifiable record of your qualification.
Accreditation
This course holds accreditation from IBITGQ (International Board for IT Governance Qualifications), benchmarked against the ISO/IEC 17024:2012 standard. That is a globally recognised benchmark for personnel certification — your C-DPO qualification is acknowledged by employers worldwide, across every sector, whether you work in finance, healthcare, the public sector, or elsewhere.
Who Should Attend?
This is an advanced course built for professionals who are responsible — or about to become responsible — for data protection compliance at an operational level. If your job involves making GDPR compliance happen inside an organisation, rather than simply knowing what it requires, this is the course for you. It is particularly well suited to:
- Newly appointed or aspiring Data Protection Officers (DPOs)
- Privacy managers and data protection leads
- Compliance managers, risk officers, and in-house legal counsel
- IT directors, information security leads, and CISOs
- Information governance managers in the NHS, education, and the public sector
- HR managers and operations directors handling employee data at scale
- Independent privacy consultants advising UK businesses on GDPR compliance
Prerequisites & What to Bring
Before joining this course, you must hold a Certified GDPR Foundation certificate — or be able to demonstrate equivalent working knowledge of the UK GDPR framework. This is not a gatekeeping formality. The C-DPO content builds directly on Foundation concepts, and without that grounding the advanced sessions simply will not make as much sense.
If you have already passed both the Foundation and Practitioner qualifications, you may be eligible for the 2-Day Accelerated C-DPO option, which leads to the same qualification in a condensed format and earns 14 CPD points. Get in touch and we will confirm your eligibility before you book.
What Do I Need to Bring?
- A laptop or tablet with pop-ups enabled — required for the Day 4 exam
- Your course materials — sent to you in advance; bring them on the day
- Photographic ID — the invigilator will check it before the exam begins
What’s Included in the Course?
Course Materials
A full digital course manual emailed to you ahead of the start date, so you can read through the content before Day 1. Everything is provided as a PDF you can refer back to at any point.
Free DPIA Tool
A ready-to-use Data Protection Impact Assessment tool. You will practise with it on Day 3, and take it straight back to your organisation to use on live projects from day one.
GDPR Gap Assessment Tool
A free compliance benchmarking tool that shows you exactly where your organisation’s data protection programme stands against UK GDPR requirements — and where to focus your attention first.
Certification Exam
The ISO 17024-certificated IBITGQ C-DPO exam is included in your course fee. No additional booking, no separate payment — sit it on Day 4 and receive your provisional results immediately.
Frequently Asked Questions
How difficult is the C-DPO exam compared to the GDPR Practitioner exam?
Considerably more demanding. The C-DPO exam has 150 multiple-choice questions over four hours, compared to 40 questions over 90 minutes for the Practitioner. The pass mark is also higher at 75% rather than 65%. The questions are scenario-based, testing how you apply the law to real situations rather than asking you to recall definitions. Day 4 includes dedicated exam preparation, and your trainer will work through practice scenarios with you before you sit it.
Does this course cover both UK GDPR and EU GDPR?
The primary focus is the UK legal framework — UK GDPR, Data Protection Act 2018, and Data (Use and Access) Act 2025 — but the course also covers the relationship between UK GDPR and EU GDPR, and the mechanics of cross-border data transfers. This is particularly valuable for organisations that operate across the UK and Europe.
Can I attend if I took my Foundation exam with a different provider?
Yes, provided you have passed a recognised GDPR Foundation exam with another accredited provider. Contact us before booking and we will confirm that your existing qualification meets the entry requirement. In some cases, equivalent practical work experience in data protection can also be considered.
Is there a 2-day accelerated option?
Yes. If you hold both a Certified GDPR Foundation and a Certified GDPR Practitioner certificate, you may qualify for the 2-Day Accelerated C-DPO course. This covers the DPO-specific content and leads to the same C-DPO (Provisional) qualification, earning 14 CPD points. Get in touch to confirm your eligibility.
Can I retake the exam if I do not pass first time?
Yes. If you are unsuccessful on your first attempt, you can retake the exam for an additional fee. Contact us to arrange a convenient retest date.
Is in-house delivery available for teams?
Yes. If you have a team of four or more, in-house training is usually the more cost-effective route. The trainers come to your site and can focus the case studies on your sector — whether that is healthcare, financial services, education, or local government. Contact us for a quote.
Continue Your Privacy Career
Staff Awareness E-Learning
Rolling out awareness training across the rest of your team? The self-paced e-learning module covers GDPR basics for general staff and includes a manager completion report so you can track progress.
💰 Haven’t Done Foundation Yet?
You need the Foundation certificate before attending this course. Book Foundation and C-DPO together and save on the combined price — the fastest route from beginner to qualified DPO.
Secure Your Spot Today
The Certified Data Protection Officer (C-DPO) Course is the most direct route from GDPR awareness to a fully recognised, ISO 17024-certificated DPO qualification. Four days, one exam, and credentials that open doors to privacy lead, DPO, and senior compliance roles across the UK. Places fill quickly on popular dates — check availability and book your seat on the next available course.