PREREQUISITES – Conditions of justification -



NOTICE TO PROFESSIONALS WITH EXPERIENCE IN DATA PROTECTION: All the years that can be formally accredited will be taken into account.

An error of interpretation on the wording of the Certification Scheme of the AEPD-DPD v.1.1 led us to consider that the professional experience for the purposes of the justification was counted from May 25, 2016. This is not the case, there is no limitation on the date following the indications received by the AEPD.


In accordance with the provisions of ANNEX I of the Certification Scheme AEPD-DPD v.1.1




- Provide certificate of having received a minimum recognized formation, in relation to the subjects object of the program of the Scheme.


- Justify, according to the prerequisites, a training of 60, 100 or 180 hours.


- The recognition of the training will be done according to the requirements defined in the Scheme, by the Certification Entities.


- The distribution of the hours of the training programs will follow the same percentage established for each of the domains of the Scheme program. A training program can consist of several courses.


- For the 60-hour training the distribution will be as follows:


Domain 1 - 30 hours, Domain 2 - 18 hours, Domain 3 - 12 hours


- For the formation of 100 hours the distribution will be as follows:


Domain 1 - 50 hours, Domain 2 - 30 hours, Domain 3 - 20 hours


- For the training of 180 hours the distribution will be as follows:


Domain 1 - 90 hours, Domain 2 - 54 hours, Domain 3 - 36 hours


- For training expressed in ECTS1 or LRU2 credits (referring to university education, even with internships or final year work) it is considered that 1 ECTS is 25 hours and 1 LRU is 10 hours.


1 Credits according to the European Credit Transfer System.


2 Credits according to the University Reform Law of 1983.





Justify the work or professional experience required by the prerequisites: two, three or five years of experience. For this purpose, objective evidence of the general and specific experience must be provided by means of a statement from the employer or client, employment contract, etc.


Experience in the treatment of high-risk personal data will be especially valued with twice the time than years of experience in the treatment of non-high-risk personal data.


In the event that the experience is not a full year, the experience that equals or exceeds six months will be valued and will be valued as half of the annual score.


Only in case of not achieving the required experience, up to one year of experience can be validated through validation of additional merits, that is, up to 60 points.


As work experience will also be considered the training given and in particular, will be assessed as twice the hours of training received.


For the training given in a specific subject only one of the given editions will be considered accepted, in case there are more than one with the same title and syllabus.


For the evaluation of the experience, the scale of,





If the score required by the prerequisites of professional experience is reached, it will not be necessary to assess any additional merit. Only in the case that the minimum score required due to lack of years of experience is not exceeded, the following table of merits will be used to complement the score.


Aspects considered as prerequisites will not be evaluated as merits.


For the evaluation of the additional merits, the scale of


* 3 Attributable to each merit individually considered. In specific cases such as attendance at events, it will be considered that a unit is reached when the minimum total hours recognized is accredited.


* 4 According to EHEA: European Higher Education Area.


* 5 Experience different from that used for assessment as a prerequisite.


* 6 New CDPP since December 2016.


* 7 CDPP before December 2016.