Workshops & Training

Legal training obligation

According to the requirements of the General Data Pro-tection Regulation (GDPR), a data protection officer may only be appointed on the basis of his or her professional qualifications and, in particular, his or her expert knowledge in the field of data protection law and data protection practice (Art. 38 Abs. 4 DS-GVO).

The necessary expertise requires a combination of legal, organisational and technical knowledge. The interaction between the GDPR and the BDSG, the large number of general clauses such as ‘legitimate interests’ and the cross-cutting nature of data protection law make it clear that a superficial knowledge of data protection law is not sufficient in this respect.

According to Art. 39 Abs. 2 DS-GVO GDPR, the company must support the data protection officer in the fulfilment of his or her tasks and, in particular, provide him or her with the resources necessary to accomplish his or her tasks and maintain his or her expertise.

Rather, the officer must be enabled to compensate for the lack of specificity of the BDSG by means of an independent interpretation in accordance with data protection law. According to Section 4f (5) sentence 1 BDSG, the company must support the data protection officer in the fulfilment of his tasks and, in particular, provide him with the human, material and financial resources necessary for the fulfilment of his tasks. As part of its duty to provide support, the company must also enable the employee concerned to obtain appropriate training.