Introduction

The definition of requirements for professional profiles in the field of processing and protection of personal data are necessary to establish the fundamental set of knowledges, skills and competences that distinguish such profiles.

The standard applies to the professional profiles in the identified area, regardless of the working methods and type of employment relationship. Tasks and activities related to the profession are described on the basis of all functions actually performed by professionals working in the field of processing and protection of personal data in different work contexts. These functions are varied and concern technical, administrative, cultural, scientific and legal aspects.

This document adopts the reference European framework for the definition of competences and related skills: EN 16234‑1. For related ICT-oriented profiles, such as for example the system administrator, please refer to CEN CWA 16458‑1.

The profiles specified in this document are not intended to be exhaustive and are applicable regardless of the work placement of the subjects operating in the sector.

The main intended audience of this document comprises professionals seeking guidance regarding their professional development, enterprises defining their internal data protection organization and related hiring requirements, bodies providing personnel training, accreditation and certification services.

Methodological approach

Within the development of this document the principles and indications set out in Recommendation 2008 / C111 / 01 (European Qualification Framework - EQF) and Recommendation 2009 / C 155/02 (European Credit System for Vocational Education and Training - ECVET) were first considered.

From a methodological point of view, it was established in particular that:

• the basic terms and definitions (Clause 3) adopted are, for the most part, derived from the EQF, ECVET and the relevant terminology commonly used in the European Community;
• the specific terms and definitions of the subject “protection of personal data” are consistent with those set out in EU 2016/679 Regulation;
• for the description of the requirements of knowledge, skills and competence of a specific professional profile, it is necessary to start from a preliminary identification of the tasks and specific activities of the professional profile (Clause 4);
• the requirements of the specific professional profile are specified in terms of knowledge, skills and competence (Clause 5) and the personal ability expected have also been identified, as far as applicable. An indication of the levels associated with the specific professional activity, using the e-CF levels which are directly mapped to the ones within the European Qualifications Framework (EQF), is also provided;
• the useful elements regarding the applicable assessment methods are specified (Clause 7). These elements have been developed taking into due consideration what already consolidated within voluntary technical standardization, also with reference to the normative corpus concerning the conformity assessment (EN ISO/IEC 17000 series);
• in Annex A (informative) skills and knowledges applicable to the development of the profiles are listed;
• in Annex B (normative) requirements for access to professional profiles are specified.

Furthermore, as far as relevant, the guidelines specified in the CEN Guide 14 were also followed.

BS EN 17740:2023

Requirements for professional profiles related to personal data processing and protection

Current

Published:

30 Nov 2023