ISO 27701 Clause 7.2: Competence

Quick Reference (60 Seconds)

If you only read one thing: Clause 7.2 is where the PIMS stops being a programme on paper and becomes a programme with demonstrably capable people running it. A 7.2-conformant PIMS is one in which the organisation has determined the necessary competence for each privacy-role holder (the seven profiles, DPO, Privacy Lead, Consent Manager operator, SDF officer, DPIA practitioner, processor-side privacy contact, Grievance Officer), has ensured those people acquire it (through education, training, mentoring, certification or experience), has evaluated the effectiveness of the actions taken (not just delivered training, but tested whether competence was built), and has retained documented information as evidence. Not a DPO with a credential and no time; not a Grievance Officer with an inbox and no privacy training; not a Consent Manager operator because there is no Consent Manager; not a security-competence register re-skinned as a privacy-competence register. The certification auditor will trace each privacy role to a named holder, a competency profile, an effectiveness evaluation, and an evidence record; the Data Protection Board of India will, after a principal complaint or a breach, ask who was competent to do what. Get 7.2 wrong, a phantom DPO, a credential-only profile, an unevaluated training record, a Grievance Officer who has never been trained, and however strong the rest of the PIMS is, the certificate will be at risk because the operational processes cannot be competently run. Get it right, and every other clause becomes easier to evidence because the people are demonstrably capable.

What the Standard Actually Requires

The paraphrased requirement

ISO/IEC 27701:2025 Clause 7.2 asks organizations to ensure people doing PIMS work are competent and keep evidence of it. The paraphrase is short; the operational load is significant. Four moves do the work, each separately testable in audit.

First, the organisation must determine the necessary competence of each person whose work affects the PIMS's performance. The act of determination is analytical: for each privacy-role holder named in the Clause 5.3 charter (and for each privacy-adjacent process owner whose work touches personal data), the organisation writes down what knowledge, skills, experience and behaviour the role requires. Determination is not a guess or a copy of a job description; it is a documented competency profile that the role-holder, the line manager and the DPO have agreed. The Singahi Privacy-Role Competency Profile template (toolkit doc 02) is the load-bearing analytical artefact, one profile per privacy role, maintained as living Documented Information.

Second, the organisation must ensure people acquire the necessary competence. Where the competency profile identifies a gap between the current state and the required state, the organisation commits to closing it through one or more competence-building actions: formal education (degrees, diplomas), structured training (classroom, e-learning, workshops), recognised certifications (a recognised privacy-management certification, a region-specific privacy professional credential, a privacy-technologist qualification, a PIMS Lead Auditor or Lead Implementer programme, a national Indian data-protection certification stream), mentoring (the senior-practitioner-to-junior pattern), supervised on-the-job experience (the apprentice pattern), or secondment (the cross-team rotation pattern). Acquisition is the action; not a promise.

Third, the organisation must evaluate the effectiveness of the actions taken. The 2025 edition inherits the harmonized-structure framing that the organisation evaluate whether the competence was actually built, not just delivered. The competence-evaluation method (toolkit doc 10) is the load-bearing test: a test piece (draft a DPIA from a fact pattern; respond to a DSAR scenario; run a breach tabletop), a supervised performance observation (a senior practitioner observing the role-holder execute the task), a scenario interview (a structured interview with a competency-based scoring rubric), or a certification outcome (the pass/fail signal from an independent assessment). A training-attendance record alone is not effectiveness evidence; an evaluated performance is.

Fourth, the organisation must retain documented information as evidence of competence. The Evidence / Training Records Register (toolkit doc 12) holds, per role-holder: education records (degrees, diplomas, transcripts), training records (course completion certificates, workshop records, e-learning completion logs), experience records (role history, project portfolio, supervised-performance summaries), qualification records (certifications with issuing body and expiry, badges with verification, accreditation references), and effectiveness-evaluation records (test-piece outcomes, observation summaries, scenario-interview scores). The register is the artefact the certification auditor samples at Stage 1 and Stage 2.

The four-axis competence model

The harmonized structure on Clause 7.2 is short and does not prescribe a competence model. The Singahi four-axis competence model is the operational expression that practitioner commentary, the Annex B normative guidance and the established competency-framework literature converge on:

Knowledge. The body of explicit, learnable, testable subject matter the role requires. For a DPO: the DPDP Act 2023 and Rules 2025; GDPR Articles 5, 6, 7, 12 to 22, 24, 25, 28, 30, 32 to 36, 37 to 39; ISO/IEC 27701:2025 clauses and Annex A; ISO/IEC 27001:2022 and 27002:2022; ISO/IEC 29100 (the 11 privacy principles); ISO/IEC 29134 (DPIA methodology); the Puttaswamy lineage; the sectoral overlays (RBI, SEBI, IRDAI, CERT-In). For a DPIA practitioner: the ISO/IEC 29134 methodology, the WP248 nine-criteria DPIA-trigger list, the Article 35(7) DPIA content structure, the Singahi DPIA template. For a Consent Manager operator: the section 2(1)(g) interoperability and revocability architecture, the registered-Consent-Manager ecosystem, the API contract, the withdrawal-signal honouring logic.

Skills. The applied abilities, what the role-holder can do, not just what they know. For a DPO: drafting a privacy policy, running a DPIA workshop, briefing the board, running a regulator engagement, drafting a breach notification. For a DPIA practitioner: facilitating a consultation, scoring a risk matrix, drafting treatment options, presenting to a decision-maker. For a Consent Manager operator: configuring the API integration, monitoring the consent-record synchronisation, handling an exception. For a Grievance Officer: receiving a complaint, escalating appropriately, drafting the response within the section 13 period.

Experience. The on-the-job exposure that turns knowledge and skills into judgement. Experience is measured in years of relevant privacy work, in the count and complexity of artefacts produced (how many DPIAs, how many DSARs, how many breach tabletops), in the variety of contexts (controller-only, processor-only, both; BFSI, healthcare, e-commerce). For senior privacy-role holders, the experience axis is the differentiator between a credentialed beginner and a competent practitioner.

Behaviour. The dispositional and ethical qualities the role requires. For a DPO: independence (the statutory independence that GDPR Article 38(3) and the DPDP section 10 board-accountability both encode), confidentiality, ethical judgement, the willingness to escalate. For a Grievance Officer: patience, empathy, the willingness to take a complaint seriously. For a Consent Manager operator: precision, exception-awareness, the willingness to flag a discrepancy. The behaviour axis is often the unwritten dimension; the Singahi four-axis template makes it explicit and testable.

The seven privacy-role competency profiles

The seven privacy-role competency profiles are the operational heart of Clause 7.2 in a PIMS. They are the privacy-specific load that the ISMS-competence tradition does not carry. The seven roles are derived from the Clause 5.3 charter (the Singahi companion guide to Clause 5.3 details the charter itself); 7.2 makes each one testable.

Role 1, Data Protection Officer (DPO). Required for Significant Data Fiduciaries under DPDP section 10 (India-based, board-accountable); recommended for non-SDF Data Fiduciaries above a manageable scale; the GDPR Article 37(5) analogue requires "expert knowledge of data protection law and practices." Knowledge: DPDP Act 2023 + Rules 2025 in depth; GDPR (Arts 5, 6, 7, 12 to 22, 24, 25, 28, 30, 32 to 36, 37 to 39); ISO/IEC 27701:2025 (clauses and Annex A); ISO/IEC 27001:2022 and 27002:2022 (the integrated-with-distinction posture); ISO/IEC 29134 (DPIA methodology); ISO/IEC 29100 (privacy principles); sectoral overlays. Skills: privacy programme leadership; DPIA facilitation; regulator engagement; board reporting; breach-response command; privacy policy and notice drafting; cross-border transfer assessment. Experience: typically 5+ years in privacy or adjacent disciplines (law, security, compliance, risk); for SDFs the experience expectation is materially higher. Behaviour: statutory independence; confidentiality; ethical judgement; willingness to escalate. Evidence: recognised privacy-management certification or equivalent; region-specific privacy professional credential where processing touches the EU (GDPR-relevant); demonstrated portfolio (DPIAs led, breach tabletops run, policies drafted).

Role 2, Privacy Lead / Privacy Officer. The DPO's deputy or the non-SDF organisation's senior privacy professional. Knowledge: the DPDP and ISO/IEC 27701:2025 working knowledge; the operational processes (ROPA, DPIA, DSAR, breach, processor oversight); the sectoral overlays. Skills: running the day-to-day privacy programme; supervising privacy analysts; drafting operational artefacts; coordinating with HR, IT, security, legal. Experience: typically 3+ years in privacy or adjacent disciplines. Behaviour: attention to detail; coordination; willingness to learn. Evidence: recognised privacy-management certification or recognised privacy-technologist certification where the role has a technical dimension; demonstrated portfolio.

Role 3, Consent Manager operator. The role on the Data Fiduciary side that operates the API integration with registered Consent Managers under DPDP section 2(1)(g). Knowledge: the section 2(1)(g) interoperability and revocability architecture; the registered-Consent-Manager ecosystem; the API contract; the consent-record data model; the withdrawal-signal honouring logic; the relationship between the Consent Manager and the operational consent management platform (the two are distinct). Skills: configuring the API integration; monitoring the consent-record synchronisation; handling exceptions; coordinating with the engineering team on integration changes. Experience: typically 2+ years in a privacy-operations or API-operations role. Behaviour: precision; exception-awareness; willingness to flag a discrepancy. Evidence: technical training on consent architecture; demonstrated operation of the integration (or, where the ecosystem is still maturing, the API design and the build plan).

Role 4, Significant Data Fiduciary (SDF) officer. For organisations designated under DPDP section 10, the role that coordinates the SDF-specific obligations: the SDF DPIA pipeline (one Data Protection Impact Assessment every 12 months), the independent data audit cycle, the algorithmic-software review cycle, the board reporting. The SDF officer is often the DPO wearing a second hat or a dedicated deputy; the role exists only where the organisation is an SDF. Knowledge: the DPDP section 10 obligations in depth; the ISO/IEC 29134 DPIA methodology (the SDF DPIA is the DPDP-flavoured DPIA); the algorithmic-AI fairness literature (demographic parity, equalised odds, calibration); the ISO/IEC 42001:2023 AI management system structure. Skills: running the SDF DPIA pipeline; coordinating the independent data audit; commissioning and reviewing the algorithmic-software review; board reporting. Experience: typically 5+ years in privacy with a meaningful AI/ML exposure for the algorithmic-software dimension. Behaviour: independence; analytical judgement; willingness to escalate a high-residual-risk processing activity. Evidence: recognised privacy-management certification; demonstrated portfolio of SDF DPIAs led; where algorithmic fairness is in scope, an AI-fairness qualification or equivalent experience.

Role 5, DPIA practitioner. The role that produces the Data Protection Impact Assessments (the Article 35 DPIA or the section 10 SDF DPIA) under Clause 8.2 of the PIMS. The DPIA practitioner works under the DPO or the SDF officer; the role exists in any organisation with material processing activities that trigger a DPIA. Knowledge: the ISO/IEC 29134:2017 methodology; the WP248 nine-criteria DPIA-trigger list; the Article 35(7) DPIA content structure; the sectoral overlays. Skills: facilitating a DPIA consultation; scoring a privacy risk matrix; drafting treatment options; presenting to a decision-maker; integrating the DPIA with the broader privacy risk assessment. Experience: typically 2+ years in privacy or adjacent disciplines; demonstrated DPIA portfolio. Behaviour: analytical thoroughness; consultation skill; willingness to deliver a high-residual-risk finding. Evidence: recognised privacy-management certification; demonstrated DPIA portfolio.

Role 6, Processor-side privacy contact. The role on the Data Processor side that manages the controller relationship, the infringing-instruction process under Annex A.2.2.5, the sub-processor change-notification pipeline, the return / deletion workflow, the breach-notification-to-controller capability. Knowledge: the Annex A.2 processor controls; the Article 28 DPA structure; the section 8(6) breach-notification clock (the processor's duty is to notify the controller without undue delay); the cross-border transfer chain. Skills: running the infringing-instruction process; maintaining the sub-processor inventory; coordinating the return / deletion; handling a breach notification to the controller. Experience: typically 3+ years in privacy or vendor management. Behaviour: contractual precision; willingness to push back on an infringing instruction. Evidence: recognised privacy-management certification or processor-specific training; demonstrated operation of the infringing-instruction process.

Role 7, Grievance Officer. The role under DPDP section 13 (and the Article 13/14 transparency contact under GDPR) that handles data-principal complaints within the prescribed response period. Knowledge: the DPDP rights regime (sections 11 to 14); the Article 13/14 transparency requirements; the organisation's privacy policy; the DSAR fulfilment workflow; the escalation paths. Skills: receiving and registering complaints; categorising and routing; drafting the response within the period; escalating material complaints to the DPO; tracking the grievance KPI. Experience: typically 2+ years in customer-facing privacy, customer support with privacy training, or legal. Behaviour: patience; empathy; willingness to take a complaint seriously; willingness to escalate. Evidence: privacy training (the DPDP section 13 module); demonstrated operation of the grievance workflow.

The Singahi Privacy-Role Competency Profile template (toolkit doc 02) operationalises all seven profiles in a single document set with the four-axis model, the determination step, the acquisition plan, the evaluation method, and the evidence register per role.

The competence cycle, determine, acquire, evaluate, evidence

The four moves are not a one-time exercise; they are a cycle. The Singahi competence cycle (toolkit doc 02 Section 3) operationalises the four moves as a recurring discipline.

Determine. The competency profiles are drafted, reviewed and approved. The drafting step uses the four-axis template; the review step involves the role-holder, the line manager and the DPO; the approval step is by top management (Clause 5.1) for the DPO and SDF officer profiles, and by the DPO for the other five. The profiles are living documents, they are re-opened on every material event trigger (new processing activity class, new technology, new jurisdiction, new regulation, post-incident, SDF designation, M&A) and refreshed annually at the management review.

Acquire. For each role-holder, the gap between the current state and the profile-required state is the Training Needs Analysis output (toolkit doc 09). The acquisition plan closes the gap through one or more of the competence-building actions: education, training, certification, mentoring, on-the-job experience, secondment. The acquisition plan is funded by the Clause 7.1 budget allocation for training and certification.

Evaluate. The effectiveness-evaluation method (toolkit doc 10) tests whether the competence was actually built. The method is role-specific: for the DPO, a test piece (draft a DPIA from a fact pattern) plus a board-briefing observation; for the Consent Manager operator, a supervised API-configuration exercise; for the DPIA practitioner, a peer-reviewed DPIA; for the Grievance Officer, a scenario interview on a difficult complaint. The evaluation outcome is the effectiveness evidence.

Evidence. The Evidence / Training Records Register (toolkit doc 12) holds, per role-holder, the records that demonstrate competence: education (degrees, diplomas), training (course completion, workshop attendance, e-learning logs), experience (role history, project portfolio), qualifications (certifications with issuing body and expiry), effectiveness (test-piece outcomes, observation summaries, scenario-interview scores). The register is the artefact the certification auditor samples.

The cycle reopens on every material event trigger and refreshes annually. The Change-Monitoring Log (toolkit doc 02 annex) records every reopening and the resulting profile update.

What the standard does NOT require (the demarcation)

• 7.2 does not require every privacy-role holder to hold an external certification. A certification is one input to competence evidence; it is not the only input. The test is the demonstrable ability to perform the role, measured against the competency profile. A DPO with five years of defensible privacy work and no certification is conformant if the effectiveness evaluation passes; a DPO with three certifications and no operational performance record is non-competent if the effectiveness evaluation fails.
• 7.2 does not require a specific credentialing body or a specific certification. The standard is credential-neutral. The credential landscape (recognised privacy-management certifications, region-specific privacy professional credentials, privacy-technologist qualifications, PIMS Lead Auditor and Lead Implementer programmes, national Indian data-protection certification streams) is the input the organisation evaluates; the choice is the organisation's, calibrated to the role and the regulatory context.
• 7.2 does not require a full-time DPO for every organisation. For SDFs under DPDP section 10, the DPO is a statutory role with board accountability; the statute does not say "full-time" but the operational load effectively requires it for most SDFs. For non-SDFs the DPO is commonly fractional (0.2 to 0.8 FTE) in growing companies and may be an external DPO-as-a-service. The test is competence and adequacy, not FTE-count.
• 7.2 does not require every staff member to be competent in privacy. The general staff whose work touches personal data but who are not privacy specialists fall under Clause 7.3 (Awareness). The 7.2 scope is the privacy team and the privacy-adjacent process owners, the role-holders whose work affects the PIMS's performance.
• 7.2 does not require zero remaining gaps. Competence is dynamic. The discipline is to identify the gap, document the closure plan, fund the closure plan, and review the cycle. A documented gap with a closure plan is conformant; an undocumented gap is nonconformant.
• 7.2 does not require public disclosure of the competence evidence. The Evidence / Training Records Register is internal Documented Information per Clause 7.5. The board reporting for SDFs and listed entities may include a competence-attestation summary; the full register is private.

The DPDP overlay, where Indian law raises the competence floor

The DPDP Act 2023 and the DPDP Rules 2025 raise the competence floor for Indian Data Fiduciaries in five specific ways. The competency profiles must address each.

Section 10 SDF, DPO expert knowledge. A Data Fiduciary designated as Significant must appoint a DPO based in India, accountable to the board. The DPO is the DPDP analogue of the GDPR Article 37(5) DPO with "expert knowledge of data protection law and practices." The competency profile for the SDF DPO must therefore demonstrate the expert-knowledge threshold, through a combination of recognised certification, demonstrated portfolio, and effectiveness-evaluation outcomes, that a non-SDF DPO profile need not reach. The independent data auditor and the algorithmic-software reviewer (also section 10) are specialist competence lines that the DPO coordinates but need not personally hold; the DPO's competence is the integrative competence that manages the specialist lines.

Section 8(6), competent breach-response capability. The breach clock (intimation without delay, then a 72-hour report; Rule 7 of the DPDP Rules 2025) and the parallel CERT-In 6-hour clock (CERT-In Directions 28 April 2022) require a breach-response capability that is competent to run both clocks in parallel, the detection, the triage, the containment, the Board notification without delay (detailed report within 72 hours), the CERT-In notification within 6 hours, the principal notification without undue delay. The breach-response role-holders must be trained on the dual-clock playbook; their competence is tested in the tabletop exercise (Clause 9.1 monitoring).

Section 9, competent verifiable-parental-consent operators. The verifiable-parental-consent infrastructure (section 9 children and persons with disability) requires operators who understand the age-assurance, the parental-identity-verification, and the no-behavioural-monitoring-or-targeted-advertising control. For Edtech and consumer-facing firms with minors in the user base, this is a material competence line.

Section 2(1)(g), Consent Manager operator. The Consent Manager regime implicitly requires the Data Fiduciary to staff an operator role that understands the registered-Consent-Manager ecosystem, the API contract, the consent-record data model, the withdrawal-signal honouring logic. The operator competency profile (Role 3 above) is the load-bearing 7.2 competence line for the Consent Manager integration.

Section 13, Grievance Officer. The Grievance Officer with the prescribed response period is a statutory role. The competency profile (Role 7 above) must demonstrate that the officer can discharge the role, receive, register, categorise, route, respond within the period, escalate material complaints. A customer-support inbox with no privacy training is non-competent on the section 13 obligation.

The companion guidance, Annex B is normative in 2025

In ISO/IEC 27701:2019 the implementation guidance lived in informative Annex F. In ISO/IEC 27701:2025 the guidance lives in Annex B (Implementation Guidance for PII Controllers and Processors), and Annex B is normative. For Clause 7.2 specifically, the Annex B guidance (numbered to mirror the clause) explains how the competency profiles should be structured, how the effectiveness evaluation should be evidenced, and how the SDF-DPO expert-knowledge threshold should be operationalised. Auditors will test against Annex B, not just against the clause text.

The relevant external anchors are summarised in Section 6.2. The load-bearing ones for Clause 7.2 are: ISO/IEC 27001:2022 Clause 7.2 (structurally identical on the infosec side, enabling the integrated-with-distinction posture); ISO/IEC 27002:2022 control 6.2 (the People-cluster control on terms and conditions of employment, which cross-references privacy competence where the role has a privacy dimension) and the broader 6.x People cluster; ISO/IEC 29134:2017 (the DPIA methodology that the DPIA practitioner must master); ISO/IEC 27018:2019 (the cloud-processor-side privacy contact reference); ISO/IEC 42001:2023 (the AI Management System reference for the algorithmic-software reviewer); GDPR Article 37(5) on DPO expert knowledge, Article 38 on the DPO position, Article 39 on DPO tasks; NIST Privacy Framework v1.0 Communicate-P function (the training and authorisation subcategory); and SOC 2 Common Criteria CC1.5 on competence and accountability.

What auditors actually check

The certification auditor's Clause 7.2 examination has seven predictable moves.

First, the auditor opens the Privacy-Role Competency Profiles. Are there profiles? Are they dated, version-controlled, signed by the role-holder, the line manager and the DPO? Do they cover the seven privacy roles? Are the four axes (knowledge, skills, experience, behaviour) populated for each role? If any of these fails, minor nonconformity. If the profiles do not exist, major nonconformity.

Second, the auditor tests the determination discipline. The auditor picks a privacy role (the DPO, the DPIA practitioner, the Grievance Officer) and asks: how was this profile determined? Who drafted it? Who reviewed it? How does it reflect the current regulatory landscape (DPDP, GDPR where relevant, sectoral)? If the profile is a stale job description copied from a template, the determination fails.

Third, the auditor tests the acquisition. For each role-holder, the auditor asks: what was the gap between the current state and the profile-required state? What actions were taken to close the gap (training, certification, mentoring, on-the-job)? Were the actions actually delivered (attendance records, completion logs, certification issuances)? If the gap was identified but no action taken, or the action was planned but not delivered, the acquisition fails.

Fourth, the auditor tests the effectiveness evaluation. This is the load-bearing 7.2 move. The auditor asks: how do you know the training worked? What is the effectiveness-evidence record? Show me the test piece, the observation summary, the scenario-interview score, the certification outcome. A training-attendance record alone is not effectiveness evidence; an evaluated performance is.

Fifth, the auditor tests the Evidence / Training Records Register. The auditor samples role-holders and asks for the complete evidence set: education, training, experience, qualification, effectiveness. Are the records current? Are the certifications in date? Are the experience records specific (count of DPIAs led, count of DSARs fulfilled) or generic ("5 years in privacy")?

Sixth, the auditor tests the SDF-DPO competence attestation (where applicable). For an SDF under DPDP section 10: where is the expert-knowledge evidence? Where is the board attestation? Where is the demonstrated portfolio of SDF DPIAs led? Where is the algorithmic-fairness coordination evidence? If any of these is missing, the 7.2 (and 5.3 and 8.2) evidence fails.

Seventh, the auditor tests the review trail. When were the profiles last reviewed? Was it at the management review (Clause 9.3)? Have event-trigger reviews happened (a new processing activity class since the last review should have produced a profile update; a post-incident should have produced a competence re-evaluation; an SDF designation should have produced a profile uplift)?

Why This Control Matters

The competence spine every other clause relies on

Every other clause and annex of ISO/IEC 27701:2025 inherits its operational capacity from Clause 7.2. The leadership commitment (5.1) is delivered by competent top management; the policy (5.2) is drafted and maintained by a competent DPO; the roles (5.3) are competently discharged; the privacy risk assessment (6.1) is run by a competent DPO and CISO; the privacy objectives (6.2) are delivered by competent owners; the awareness programme (7.3) is funded and designed under 7.1 but delivered by competent trainers; the communication (7.4) is competent; the Documented Information (7.5) is hosted on competently-run systems; the operational processes (Clause 8), the ROPA, the consent management, the rights handling, the processor oversight, the cross-border transfer mechanism, the breach playbook, each require a competent role-holder; the monitoring (9.1), the internal audit (9.2) and the management review (9.3) are run by competent people; the nonconformity and corrective action (10.2) and the continual improvement (10.1) require competence to execute. Without 7.2, the rest of the PIMS is unstaffed by demonstrably capable people.

This is not a stylistic observation. It is the operational reality the certification auditor and the Data Protection Board of India converge on. A PIMS with a strong policy, a complete ROPA, a deep DPIA pipeline and airtight security controls but no demonstrably competent DPO, no competent Consent Manager operator, no competent Grievance Officer is, in auditor language, a "system without competent operators", a structural finding that cascades into every other clause because the operational processes cannot actually be run well. A PIMS with a demonstrably competent privacy team is defensible end-to-end.

The Indian regulatory weight behind 7.2

In India, Clause 7.2 has a regulatory weight that goes beyond the ISO standard itself. The DPDP Act 2023 and the DPDP Rules 2025 make privacy-role competence a statutory duty for Indian Data Fiduciaries, with the section 33 + Schedule penalty maxima attached.

The most load-bearing 7.2-relevant DPDP provision is section 10, the SDF DPO's expert knowledge. The SDF DPO is the Indian statutory analogue of the GDPR Article 37(5) DPO with "expert knowledge of data protection law and practices." The competency profile for the SDF DPO must demonstrate the expert-knowledge threshold, and the Data Protection Board, in any post-incident examination, will test the threshold. An SDF DPO whose profile is a generic management profile with no privacy depth is non-competent on the section 10 obligation, with up to 150 crore rupees of penalty exposure.

The second most load-bearing is section 8(6), the breach clock. The dual-clock design (DPDP without delay plus a 72-hour detailed report, CERT-In 6 hours) requires a breach-response capability that is competent to run both clocks. The breach-response role-holders' competence is tested in the tabletop exercise (Clause 9.1); the post-incident examination (whether by the Board, by CERT-In, or by the sector regulator for BFSI/listed entities) will test whether the capability was competent to meet the clocks. An under-trained breach-response capability is a section 8(6) failure with up to 200 crore rupees of penalty exposure.

The third is section 13, the Grievance Officer. The Grievance Officer with the prescribed response period is a statutory role; the section 13 obligation is discharged by a competent officer. The customer-support-inbox pattern is non-competent on section 13; the section 13 failure pattern is one of the most common post-complaint findings the Board is expected to make as its operational machinery emerges through 2026 and 2027.

The fourth is section 2(1)(g), the Consent Manager. The Consent Manager interoperability requirement implicitly requires the Data Fiduciary to staff an operator role that understands the registered-Consent-Manager ecosystem and the API architecture. The operator competency profile is the load-bearing 7.2 competence line for the Consent Manager integration; the customer-facing consent infrastructure cannot be competently run without it.

The lineage is the wedge. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 declared the right to privacy a fundamental right; the Aadhaar judgment (2019) 1 SCC 1 set the proportionality test; after drafts (2019, 2022, 2023), the DPDP Act was enacted on 11 August 2023; the DPDP Rules 2025 were notified on 13 November 2025; ISO/IEC 27701:2025 was published on 14 October 2025. The Indian statute and the international standard were, in effect, made for each other; the competency profiles are where the statutory duty to be competent meets the standard's expectation that the PIMS be operated by demonstrably capable people.

The cost of non-compliance

The cost of a Clause 7.2 failure breaks down into four bands.

Direct DPDP penalty exposure for an organisation whose under-competent privacy team produced a missed breach-notification clock, an undeliverable DSAR, an unperformable section 9 verifiable-parental-consent, an absent or incompetent section 10 SDF DPIA, or an unattended section 13 grievance can run to the Schedule maxima, up to 250 crore rupees for section 8(5), 200 crore for sections 8(6) and 9; 150 crore for section 10.

Indirect regulatory consequences are larger and slower. A competence failure that produces an incorrect ROPA, an incomplete DPIA, an unperformable dual-clock breach playbook, or an unstaffed Grievance Officer cascades through every other clause and amplifies the cost of every other nonconformity.

Commercial cost is significant. The Indian privacy incidents most cited in board rooms, Juspay (approximately 35 million records in 2021, publicly acknowledged), BigBasket (approximately 20 million records alleged in 2020), Air India / SITA (approximately 4.5 million customers affected by the SITA breach disclosed in 2021), MobiKwik (contested allegations, denied by the company), all carried post-incident examinations that tested whether the organisation had the competent capacity to detect, contain, notify and recover. An under-competent incident-response capability amplifies the commercial cost.

Certification cost is the most immediate. Recoverable; entirely avoidable.

Scope and Applicability

By organisation size

The first set of competency profiles is deliverable in 8 to 14 weeks.

Mid-sized (250 to 2,000 staff). A full-time or near-full-time DPO (1 FTE) with the recognised privacy-management certification plus a region-specific privacy professional credential where processing touches the EU; a privacy team of 2 to 6 FTE with the credential mix matched to the role (privacy-management for the DPO and Privacy Lead; privacy-technologist for the Consent Manager operator and the DPIA practitioner with a technical dimension; recognised PIMS Lead Auditor or Lead Implementer for the internal auditor); the Grievance Officer as a half-time to full-time role with formal privacy training; the Consent Manager operator role established; the SDF officer role established where the designation applies or is approachable. The first cycle typically takes 14 to 24 weeks.

Multi-entity enterprise (2,000+ staff or multi-jurisdiction). A layered privacy-competence model: a group DPO with deputies per jurisdiction; a privacy team of 10 to 50+ FTE with a multi-credential mix; the SDF officer function internalised; the Consent Manager operator function scaled across multiple integrations; an algorithmic-software reviewer function internalised; the Grievance Officer function scaled to the principal-volume; an enterprise L&D programme with a privacy track. Typically 6 to 10 months for the first cycle.

By PIMS role

PII controller (Data Fiduciary) primary. The competence leads with the controller-side roles: the DPO, the Privacy Lead, the DPIA practitioner, the Grievance Officer, the Consent Manager operator, the SDF officer (where designated). The full seven-role profile set applies.

PII processor (Data Processor) primary. The competence leads with the processor-side roles: the processor-side privacy contact (Role 6) is the load-bearing profile; the DPO/Privacy Lead profile applies but is typically calibrated to the processor-side load (the Annex A.2 controls, the Article 28 DPA structure, the infringing-instruction process). The Grievance Officer profile may apply where the processor has direct principal contact (uncommon for pure BPO/ITeS but common for SaaS with consumer-facing features).

Both controller and processor. The most common shape for Indian growing companies (especially SaaS, ITeS, BFSI-adjacent). The competence envelope covers both sides and the boundary between them, which roles are controller-side (the organisation's own principals), which are processor-side (the customer's principals reached through the organisation's processing), where the boundary is contested (joint-controller arrangements under Annex A.1.2.8 / GDPR Article 26).

By sector

Sector-specific competence overlays are addressed in Section 21. The headline sectors, BFSI, Healthcare, IT-ITeS, E-commerce, Edtech, Manufacturing, each carry distinctive competence profiles (RBI localisation and digital-lending competence for BFSI; health-data sensitivity and clinical-data confidentiality for Healthcare; customer-data scale and cross-border processor chains for IT-ITeS; consumer-privacy expectations and children's-data for E-commerce; verifiable parental consent and the section 9 regime for Edtech; OT-IT convergence and the supply-chain processor ecosystem for Manufacturing).

Key Definitions and Terminology

Competence (PIMS). The demonstrable ability of a person to perform the privacy-role work assigned to them, measured against the four-axis competency profile (knowledge, skills, experience, behaviour) for that role. Competence is the test, not credentials.

Competency profile. The load-bearing 7.2 artefact per role-holder (or per role category where individual profiles are derived from the category template): the four-axis description of what the role requires. The seven privacy-role competency profiles (DPO, Privacy Lead, Consent Manager operator, SDF officer, DPIA practitioner, processor-side privacy contact, Grievance Officer) are the operational heart of 7.2 in a PIMS.

Four-axis competence model. The Singahi operational expression of the competence construct: knowledge (explicit, learnable, testable subject matter), skills (applied abilities), experience (on-the-job exposure), behaviour (dispositional and ethical qualities).

Training Needs Analysis (TNA). The analytical artefact that converts each competency profile into the gap between the current state and the required state, with a per-role closure plan. Documented Information per Clause 7.5.

Competence evaluation. The test of whether the competence-building actions (training, certification, mentoring, on-the-job experience) actually built the competence. Methods include test piece, supervised performance observation, scenario interview, certification outcome.

Evidence / Training Records Register. The Documented Information per Clause 7.5 holding, per role-holder, the records that demonstrate competence: education, training, experience, qualification, effectiveness-evaluation. The artefact the certification auditor samples at Stage 1 and Stage 2.

Recognised privacy-management certification. A category of professional credential covering privacy-programme management, typically obtained by examination after a structured course of study, maintained through continuing education, and offered by an established credentialing body. This guide describes the category generically; the organisation selects a specific credential based on the role, the regulatory context, and the relative weight of the credential in the market. The credential is one input to competence evidence, not the only input.

Recognised region-specific privacy professional credential. A category of professional credential focused on a specific jurisdiction's privacy regime, for instance, a credential focused on the EU GDPR (relevant where the organisation processes EU personal data and engages with EU supervisory authorities). Described generically; the organisation selects based on its regulatory footprint.

Recognised privacy-technologist certification. A category of professional credential covering the technology of privacy, privacy-by-design in software and product engineering, privacy-enhancing technologies, the technical dimension of consent management and DSAR fulfilment. Relevant for the Consent Manager operator, the DPIA practitioner with a technical dimension, and the privacy engineer in a SaaS or product organisation.

PIMS Lead Auditor / Lead Implementer credential. A category of professional credential focused on the ISO/IEC 27701:2025 standard itself, the Lead Auditor stream for those who audit PIMS certifications, the Lead Implementer stream for those who implement them. Relevant for the internal auditor (Clause 9.2) and for the DPO/Privacy Lead.

National Indian data-protection certification stream. A category of professional credential focused on the DPDP Act 2023 and the DPDP Rules 2025, emerging as the Indian privacy-profession market matures. Relevant for the DPO operating in the Indian regulatory context, especially where the organisation is an SDF.

Statutory DPO competence (DPDP section 10 / GDPR Article 37(5)). The threshold of expert knowledge of data protection law and practices required of the DPO under DPDP section 10 (for SDFs) and GDPR Article 37(5) (for organisations in scope of the GDPR DPO obligation). The competency profile for the SDF DPO must demonstrate this threshold.

Consent Manager operator. The role on the Data Fiduciary side that operates the API integration with Consent Managers registered with the Data Protection Board under DPDP section 2(1)(g). A distinctive Indian privacy-role profile with no clean GDPR or NIST analogue.

Significant Data Fiduciary (SDF) officer. The role that coordinates the SDF-specific obligations under DPDP section 10, the SDF DPIA pipeline, the independent data audit, the algorithmic-software review, the board reporting. Often the DPO wearing a second hat or a dedicated deputy; the role exists only where the organisation is an SDF.

DPIA practitioner. The role that produces the Data Protection Impact Assessments (the Article 35 DPIA or the section 10 SDF DPIA) under Clause 8.2. Works under the DPO or the SDF officer.

Processor-side privacy contact. The role on the Data Processor side that manages the controller relationship, the infringing-instruction process (Annex A.2.2.5), the sub-processor change-notification pipeline, the return / deletion workflow, the breach-notification-to-controller capability.

Grievance Officer. The role under DPDP section 13 (and the Article 13/14 transparency contact under GDPR) that handles data-principal complaints within the prescribed response period. A statutory role with a competence requirement, not a customer-support inbox.

Integrated-with-distinction posture (competence dimension). The Singahi-recommended pattern where the ISMS competence register and the PIMS competence register are maintained in a single integrated register with two clearly labelled sub-sections. The CISO and the DPO co-own the integrated register; the privacy-specific roles (DPO, Consent Manager operator, DPIA practitioner, Grievance Officer) are configured distinctly even where the underlying HR record is shared.

Competence review cadence. The cycle at which the competency profiles and the evidence register are revisited, annual at the management review (Clause 9.3), and event-trigger on new processing activity class, new technology, new jurisdiction, new regulation, post-incident, SDF designation, M&A, or material role change.

Effectiveness evidence. The record that the competence-building action actually built the competence, the test-piece outcome, the observation summary, the scenario-interview score, the certification outcome. Distinct from the attendance record (which only evidences delivery, not effectiveness).

Relationship to Other Clauses and Frameworks

Inside ISO/IEC 27701:2025

• 4.1 (context): the issues identified shape the competence envelope, the sector, the geography, the AI-driven processing surface, the cross-border transfer load all generate specific competence requirements.
• 4.2 (interested parties): the requirements register carries a competence load, every material requirement (DPDP, GDPR, sectoral) implies a competent role-holder to discharge it.
• 4.3 (scope): defines the competence boundary.
• 4.4 (the PIMS): the four verbs (establish, implement, maintain, continually improve) are the verbs the competence must support.
• 5.1, 5.2, 5.3 (leadership, policy, roles): top management approves the competency profiles; the policy commits the organisation to a competent PIMS; the roles in 5.3 are the roles 7.2 evidences, the seven profiles derive directly from the 5.3 charter.
• 6.1 (risks): every material risk must have a treatment that is competently operated. The risk-to-competence reconciliation is canonical 7.2 evidence.
• 6.2 (objectives): every measurable privacy objective must have an owner competent to deliver it.
• 6.3 (changes): changes trigger competence-profile re-opens.
• 7.1 (resources): funds the competence build (training budget, certification budget, DPO-as-a-service).
• 7.3 (awareness): the complement to 7.2, 7.2 is the privacy team; 7.3 is everyone else. The demarcation is the load-bearing line.
• 7.4 (communication): competence expectations are communicated to role-holders; performance feedback is communicated back.
• 7.5 (documented information): hosts the evidence register; the controls on documented information apply to the profiles, the TNA, and the register.
• 8.1 to 8.3 (operation): each operational process requires a competent role-holder, the ROPA, the DPIA, the consent, the DSAR, the processor oversight, the transfer, the breach each test the operator's competence.
• 9.1, 9.2, 9.3 (monitoring, audit, review): the monitoring infrastructure, the internal audit programme and the management review each test competence (the tabletop exercise tests breach-response competence; the internal audit samples the evidence register; the management review re-opens the profiles).
• 10.1, 10.2 (improvement, corrective action): the corrective-action capacity and the improvement pipeline require competence to execute.
• Annex A.1 (controllers), A.2 (processors), A.3 (security): every applicable control must have a competent operator; the SoA-to-competence reconciliation is the canonical evidence.

Cross-framework

• ISO/IEC 27001:2022 Clause 7.2 (Competence), structurally identical on the infosec side; the integrated-with-distinction posture uses the shared structure.
• ISO/IEC 27002:2022 control 6.2 (Terms and conditions of employment) plus the broader 6.x People cluster, the ISMS-competence reference; only control 5.34 is PII-specific in 27002, but the People cluster applies to privacy-role competence where the role has a privacy dimension.
• ISO/IEC 29134:2017 (Guidelines for privacy impact assessment), the methodological reference for the DPIA-practitioner competence.
• ISO/IEC 27018:2019 (Cloud PII processor code of practice), the cloud-processor-side privacy contact competence reference.
• ISO/IEC 42001:2023 (AI Management System), the structural reference for the algorithmic-software reviewer dimension of the SDF officer profile.
• ISO/IEC 27706:2025 (PIMS certification-scheme competence), informs the cert-body's own competence to audit the 7.2 evidence; cross-references the 7.2 discipline from the auditor side.
• GDPR Articles 37(5), 38, 39, DPO expert knowledge, position, tasks; shape the DPO competency profile.
• GDPR Article 32, security of processing; shapes the technical dimension of the processor-side privacy contact profile.
• NIST Privacy Framework v1.0 (NIST.CSWP.01162020, 16 January 2020), Communicate-P function (the training and authorisation subcategory), the US-flavoured structural analogue.
• SOC 2 (AICPA TSC 2017), Common Criteria CC1.5 (competence and accountability) and the Privacy category P8.0 (Monitoring and enforcement), the SOC 2 view of the competence discipline.
• DPDP Act 2023, section 8 general obligations (the duty to be competent to discharge), section 8(6) (breach notification, competent dual-clock capability), section 9 (children, competent verifiable-parental-consent operators), section 10 SDF (DPO expert knowledge, SDF DPIA practitioner profile, independent data auditor competence, algorithmic-software reviewer), section 11 (rights, competent DSAR fulfilment), section 13 (Grievance Officer with capability to discharge), section 16 (cross-border negative list, competent TIA practitioner), section 2(1)(g) Consent Manager operator, section 33 + Schedule penalties. The DPDP is the load-bearing regulatory input to the Indian competency profiles.

Inside the harmonized structure, what 7.2 inherits

The harmonized structure (HS, formerly Annex SL) is the shared skeleton ISO uses for management-system standards. 27701:2025, 27001:2022, 22301:2019, 9001:2015, 14001:2015, 45001:2018, 42001:2023 all use it. For 7.2, this means:

• The clause text is structurally identical across all HS standards, only the subject-matter load differs.
• An organisation running an integrated 27001 + 27701 + 42001 programme can run a single combined competence register with sub-sections for each discipline.
• The four-move cycle (determine, acquire, evaluate, evidence) is common across HS standards.
• The four-axis competence model (knowledge, skills, experience, behaviour) is a Singahi operationalisation that fits all HS standards.

The Singahi integrated competence register (toolkit doc 12 annex B) supports the HS-combined pattern: a single register with columns tagging each role as ISMS-relevant, PIMS-relevant, AIMS-relevant, BCMS-relevant, or shared.

Detailed Implementation Guidance, The Seven Privacy-Role Competency Profiles and the Four-Move Competence Cycle

Figure · Process

What Clause 7.2 asks you to do

Move 1, Decide the relationship between the PIMS competence register and the ISMS competence register

This is the most consequential decision and a frequent certification nonconformity zone. The choice is between three patterns (the same patterns as Clause 7.1, applied to competence).

Pattern A, Integrated-with-distinction (Singahi recommended default). A single competence register, a single training-needs analysis, a single evidence register, but two clearly labelled sub-sections (ISMS-relevant and PIMS-relevant) and two clearly labelled role sets (the ISMS roles, CISO, security analysts, SOC operators; the PIMS roles, the seven privacy-role profiles). The CISO and the DPO co-author the register. The integrated posture is the most efficient for organisations running an integrated ISMS+PIMS programme, which is most Indian growing companies.

Pattern B, Parallel with reconciliation. Two registers, two TNAs, two evidence files, with a documented reconciliation that proves the two registers agree on the shared roles (the CISO with privacy duties, the incident-response lead, the security analyst who handles DSAR evidence). Heavier operationally; defensible where the two functions sit in different teams.

Pattern C, Reskin (avoid). The ISMS competence register re-labelled "PIMS Competence Register" with the privacy-specific roles (DPO, Consent Manager operator, DPIA practitioner, Grievance Officer) unevidenced. The single most common 7.2 finding in the Indian growing-company segment.

The decision is recorded in the PIMS Competence Policy (toolkit doc 01 Section 5). The default for most growing companies is Pattern A; the migration to Pattern A from Pattern B is the most common maturity-upgrade move; the migration from Pattern C is the most common remediation move.

Move 2, Draft the seven Privacy-Role Competency Profiles

The seven profiles are the operational heart of 7.2 in a PIMS. The Singahi Privacy-Role Competency Profile template (toolkit doc 02) provides a single document structure used for all seven roles, the four axes, the determination step, the acquisition plan, the evaluation method, the evidence record per role-holder.

For each role, the profile contains:

• Role title and reporting line. Who the role reports to (the DPO reports to the board for SDFs; the Privacy Lead reports to the DPO; the Consent Manager operator reports to the Privacy Lead or the DPO; the Grievance Officer reports to the DPO with escalation to the board where material; the SDF officer reports to the DPO; the DPIA practitioner reports to the DPO or the SDF officer; the processor-side privacy contact reports to the DPO or the Privacy Lead).
• The four axes. Knowledge (the body of explicit subject matter); skills (the applied abilities); experience (years, count of artefacts, variety of contexts); behaviour (dispositional and ethical qualities).
• The DPDP / regulatory anchors. Which DPDP sections, GDPR articles, sectoral instruments the role must be competent on.
• The acquisition pathway. How the role-holder acquires the competence (certification category, mentoring pattern, on-the-job exposure).
• The effectiveness-evaluation method. How the organisation tests whether the competence was built.
• The evidence record. What is retained in the Evidence / Training Records Register.

The seven profiles are summarised in Section 2.3 above; the full templates are toolkit doc 02.

Move 3, Run the Training Needs Analysis (Move 3, the gap-closure plan)

For each role-holder, the TNA (toolkit doc 09) compares the current state (the role-holder's existing education, training, experience, qualifications) with the profile-required state (the four axes from the profile) and identifies the gap. The gap is the training need; the closure plan is the action, the certification course, the workshop series, the mentoring arrangement, the on-the-job exposure plan, the secondment.

The TNA is refreshed annually per role-holder (at the management review) and on every material event trigger (new processing activity class, new technology, new jurisdiction, new regulation, post-incident, SDF designation, M&A).

The TNA outputs feed the Clause 7.1 training-and-certification budget line. The integration is canonical: 7.1 funds what 7.2 identifies.

Move 4, Run the effectiveness evaluation and feed the evidence register

The effectiveness evaluation (toolkit doc 10) is the load-bearing 7.2 discipline. The four-method menu:

Method 1, Test piece. The role-holder produces an artefact from a fact pattern. For the DPIA practitioner: draft a DPIA from a fact pattern (a new AI-driven marketing-lead scoring system). For the Grievance Officer: draft a response to a difficult complaint fact pattern. For the processor-side privacy contact: draft an infringing-instruction response. The test piece is peer-reviewed by a senior practitioner; the review is the effectiveness evidence.

Method 2, Supervised performance observation. A senior practitioner observes the role-holder execute the task in real work. For the Consent Manager operator: observe the API integration configuration and the exception handling. For the Privacy Lead: observe the DPIA workshop facilitation. The observation summary is the effectiveness evidence.

Method 3, Scenario interview. A structured interview with a competency-based scoring rubric. For the DPO: a 60-minute interview on a complex scenario (a cross-border transfer with a Schrems-II dimension; a Rule 13(3) algorithmic-software review; a board briefing on a high-residual-risk processing activity). The interview score is the effectiveness evidence.

Method 4, Certification outcome. The pass/fail signal from an independent assessment. For a role where a recognised certification exists and maps cleanly to the competency profile (the privacy-management certification for the DPO; the privacy-technologist certification for the Consent Manager operator; the PIMS Lead Auditor credential for the internal auditor), the certification outcome is acceptable effectiveness evidence. The certification is one input, for senior roles it should be combined with at least one of the other three methods.

The effectiveness-evaluation outcomes feed the Evidence / Training Records Register (toolkit doc 12). The register is the artefact the certification auditor samples at Stage 1 and Stage 2.

The credential landscape, described generically

The credential landscape is the input the organisation evaluates; the choice is the organisation's, calibrated to the role and the regulatory context. This guide describes the landscape by category; it does not recommend a specific credential or name a specific issuing body.

Category 1, Recognised privacy-management certifications. A category of professional credential covering privacy-programme management, typically obtained by examination after a structured course of study, maintained through continuing education, and offered by an established credentialing body. The category is the natural fit for the DPO and the Privacy Lead. When evaluating a specific credential in this category, the organisation tests: the syllabus coverage (does it cover the DPDP, the GDPR, the ISO/IEC 27701:2025 framework, the operational disciplines, ROPA, DPIA, DSAR, breach, processor oversight); the examination rigour; the continuing-education requirement; the geographic recognition (the credential should be recognised in the markets the organisation operates in); and the cost-to-value for an Indian growing company.

Category 2, Recognised region-specific privacy professional credentials. A category focused on a specific jurisdiction's privacy regime. For organisations processing EU personal data, an EU-focused privacy professional credential is the natural complement to the general privacy-management certification. For organisations in the UK post-Brexit, a UK-focused credential. As the Indian privacy-profession market matures, India-focused credentials focused on the DPDP are expected to emerge; the organisation should evaluate these on the same criteria.

Category 3, Recognised privacy-technologist certifications. A category covering the technology of privacy, privacy-by-design in software and product engineering, privacy-enhancing technologies, the technical dimension of consent management and DSAR fulfilment. The natural fit for the Consent Manager operator, the DPIA practitioner with a technical dimension, and the privacy engineer in a SaaS or product organisation.

Category 4, PIMS Lead Auditor and Lead Implementer programmes. A category focused on the ISO/IEC 27701:2025 standard itself, the Lead Auditor stream for those who audit PIMS certifications, the Lead Implementer stream for those who implement them. The natural fit for the internal auditor (Clause 9.2) and for the DPO/Privacy Lead who wants a deep working knowledge of the standard's structure.

Category 5, National Indian data-protection certification streams. A category focused on the DPDP Act 2023 and the DPDP Rules 2025. The Indian market is in early-stage maturation; the organisation should track emerging offerings and evaluate them on the syllabus-coverage criterion (does it cover the Act, the Rules, the sectoral overlays) and the recognition criterion (is the credential recognised by Indian recruiters, regulators and cert bodies).

The credentialing pathway for each privacy role is recorded in the role's competency profile (toolkit doc 02). The pathway is the recommended credential category (or categories) plus the timing (when in the role-holder's tenure) plus the budget source (the Clause 7.1 training-and-certification line).

Worked example, Saffron Logistics bench-marked privacy-competence programme

To make the four moves concrete, consider Saffron Logistics (a fictional Gurugram-based supply-chain-tech firm with 1,400 staff and approximately 3.6 million shipper and consignee principals; the facts are composite from publicly reported sector patterns and should not be attributed to any real organisation). Saffron's first 7.2 cycle produced a Pattern A integrated-with-distinction competence register, the seven privacy-role competency profiles (DPO 1 FTE with a recognised privacy-management certification plus a region-specific EU credential; Privacy Lead 1 FTE with a recognised privacy-management certification; Consent Manager operator 0.5 FTE with a recognised privacy-technologist certification; DPIA practitioner 1 FTE with a recognised privacy-management certification; processor-side privacy contact 0.5 FTE with a recognised privacy-management certification; Grievance Officer 1 FTE with formal DPDP training and a recognised privacy-management certification; SDF officer 0.5 FTE, the DPO wearing a second hat pending the SDF designation analysis), a TNA refreshed annually per role-holder, a four-method effectiveness-evaluation programme (test piece for the DPIA practitioner and the Grievance Officer; supervised performance for the Consent Manager operator; scenario interview for the DPO; certification outcome for the Privacy Lead), and an Evidence / Training Records Register seeded with education, training, experience, qualification and effectiveness records per role-holder. The first-cycle effort: 18 weeks of internal time plus external advisory; the resulting artefact set passed Stage 1 audit at first attempt with no Clause 7.2 finding; the bench-marked programme positioned Saffron for the SDF designation analysis 18 months later.

The competence-monitoring discipline in more depth

The competency profiles are only as good as their currency. Three patterns dominate. Pattern A, Annual update only (the default for compact organisations): the profiles and the TNA are updated in the 30 days before the management review; suitable for a stable processing-activity set, a small principal volume and no SDF triggers. Pattern B, Event-trigger update (the discipline most organisations should run): the profiles are re-opened whenever a material event fires (new processing activity class, new technology, new jurisdiction, new regulation, post-incident, SDF designation, M&A, material role change), with the DPO maintaining a Change-Monitoring Log. Pattern C, Continuous monitoring (for SDFs, listed entities and large enterprises): the profiles and the evidence register are monitored continuously through the HR information system, the learning-management system, and the privacy-management platform, with the DPO and the Head of L&D convening a monthly tactical forum.

Tools, Technologies, and Solutions

The tool categories (genericised)

Human Resources Information System (HRIS). The system of record for the role-holder's employment data, role title, reporting line, hire date, role history. The HRIS is the primary source for the experience axis of the competency profile.

Learning Management System (LMS). The system of record for training delivery, course enrolment, completion, assessment scores. The LMS is the primary source for the training-record axis of the evidence register.

Talent / Competence management platform. A specialist platform for competency profiles, effectiveness evaluations, succession planning. Mature enterprises deploy a standalone platform; growing companies typically use the LMS or a spreadsheet. The Singahi Privacy-Role Competency Profile template (toolkit doc 02) is LMS-agnostic and platform-agnostic.

Privacy-management platform (PMP), competence module. Some privacy-management platforms include a competence module that links the privacy-role profiles to the operational processes (the DPIA the practitioner produced, the DSAR the Grievance Officer handled). Useful for the effectiveness-evaluation evidence but not the primary register.

Credential verification service. A service that verifies the currency and the authenticity of certifications with the issuing body. Useful for the SDF-DPO attestation where the credential is part of the expert-knowledge evidence.

Selection criteria (cross-cluster)

Select on: India-DPDP coverage (the most load-bearing criterion for an Indian Data Fiduciary, most global platforms are GDPR-heavy and DPDP-thin); integrated-with-distinction support (the ability to plan, evidence and operate the privacy competence alongside the security competence in a single environment); effectiveness-evidence depth (the ability to record test-piece outcomes, observation summaries, scenario-interview scores, not just course attendance); DPDP-Rules-2025 readiness (the SDF thresholds, the Consent Manager registration conditions); integration with the HRIS, the LMS and the privacy-management platform; the credential-verification capability; and cost-to-value for the Indian growing-company segment.

Build vs buy

Most growing companies should buy the HRIS, the LMS and (where deployed) the talent management platform. The build decisions are: the seven privacy-role competency profiles (build in-house with external advisory for the first cycle, the profiles are too organisation-specific to outsource end-to-end); the effectiveness-evaluation programme (build in-house with external advisory for the scenario-interview and the test-piece design, the evaluation is the organisation's own test); the integrated-with-distinction reconciliation (build in-house, the reconciliation logic is organisation-specific).

Policy and Procedure Templates

PIMS Competence Policy (sample of our own drafting)

The organisation maintains Privacy-Role Competency Profiles as living Documented Information artefacts that record the four-axis competence requirement (knowledge, skills, experience, behaviour) for each of the seven privacy roles (Data Protection Officer, Privacy Lead, Consent Manager operator, Significant Data Fiduciary officer, DPIA practitioner, processor-side privacy contact, Grievance Officer). The DPO and the Head of HR jointly own the profiles; the CISO co-owns the integrated-with-distinction sub-section. The profiles are reviewed annually at the management review and re-opened on every material event trigger. The organisation commits to ensuring that each role-holder acquires the necessary competence, to evaluating the effectiveness of the actions taken, and to retaining documented information as evidence. The DPO maintains the Training Needs Analysis, the effectiveness-evaluation programme, and the Evidence / Training Records Register as Documented Information per Clause 7.5.

SDF-DPO Competence Attestation (sample of our own drafting)

Where the organisation is designated a Significant Data Fiduciary under section 10 of the Digital Personal Data Protection Act 2023, the Data Protection Officer shall possess expert knowledge of data protection law and practices, calibrated to the volume, sensitivity and risk of the organisation's processing. The expert-knowledge threshold is demonstrated through a combination of: a recognised privacy-management certification; demonstrated portfolio of DPIAs led; effectiveness-evaluation outcomes from the scenario-interview and the test-piece methods; and continuing-education currency. The DPO's competence attestation is reported to the Board / Risk Management Committee annually and on material change.

Grievance Officer Capability Statement (sample of our own drafting)

The Grievance Officer appointed under section 13 of the Digital Personal Data Protection Act 2023 shall have the capability to discharge the role, to receive, register, categorise, route, respond within the prescribed period, and escalate material complaints to the DPO. The Grievance Officer's competency profile evidences: training on the DPDP rights regime (sections 11 to 14); training on the organisation's privacy policy and DSAR workflow; the scenario-interview outcome on a difficult-complaint fact pattern; and the escalation-protocol familiarisation. The Grievance Officer is not a customer-support inbox; the role is a real privacy-role profile with a competence requirement.

PIMS Competence Planning Procedure (sample of our own drafting, summarised)

The Procedure has eleven steps. (1) Scope and inputs, applies to the seven privacy-role profiles; inputs are the Clause 5.3 charter, the risk register (6.1), the operational processes (Clause 8), the SoA (6.1.3). (2) Profile drafting, the DPO and the Head of HR draft the seven profiles using the four-axis template. (3) Profile review, each profile is reviewed by the role-holder, the line manager and the DPO. (4) Profile approval, top management approves the DPO and SDF officer profiles; the DPO approves the other five. (5) Training Needs Analysis, the TNA (toolkit doc 09) compares the current state with the profile-required state per role-holder. (6) Acquisition plan, the gap-closure actions are planned and budgeted (the Clause 7.1 training-and-certification line). (7) Effectiveness-evaluation programme, the four-method programme (toolkit doc 10) is designed per role. (8) Evidence register seeding, the Evidence / Training Records Register (toolkit doc 12) is seeded with current education, training, experience, qualification records. (9) Event-trigger re-open, the DPO maintains the Change-Monitoring Log and re-opens the Procedure on every material event trigger. (10) Annual review at the management review, the DPO presents the profile set, the TNA, the effectiveness outcomes, and the next-cycle ask. (11) Documented Information control, the Procedure and its annexes are controlled per Clause 7.5.

Integrated-with-Distinction Competence Statement (sample of our own drafting)

The organisation maintains the ISMS competence register and the PIMS competence register under a single integrated register with two clearly labelled sub-sections. The CISO and the DPO jointly own the integrated register. Where a role serves both systems (the CISO with privacy duties, the incident-response lead, the security analyst who handles DSAR evidence), the FTE allocation and the training plan are documented per role with the time-split between ISMS and PIMS work recorded.

Sample DPA clauses on processor-side privacy-contact competence (sample of our own drafting)

The Processor shall ensure that the processor-side privacy contact designated under this Agreement is competent to discharge the role, to operate the infringing-instruction process under ISO/IEC 27701:2025 Annex A.2.2.5, to maintain the sub-processor inventory, to coordinate the return / deletion workflow, and to handle a breach notification to the Controller without undue delay. The Processor shall, on request, provide the Controller with a current statement of the processor-side privacy contact's competence, including the relevant privacy-management certification or equivalent, the demonstrated portfolio, and the effectiveness-evaluation outcome.

Risk Assessment and Treatment

This section addresses the privacy-competence risk theme, the risks that arise when the competence envelope is inadequate to the operational load. The Singahi PIMS Competence Risk Register (toolkit doc 09 annex) records the typical risks.

The high-impact, high-likelihood risks to treat first are: the ISMS-competence reskin (the most common 7.2 finding in the Indian growing-company segment); the phantom DPO without the expert-knowledge threshold (the most direct section 10 exposure for SDFs); the Grievance Officer as inbox (the most direct section 13 exposure); the Consent Manager operator absence (the most distinctive Indian competence failure); and the credential-only profile (the most common effectiveness-evidence failure).

Audit and Compliance Checklist

The 28 questions below cover the audit-evidence surface for Clause 7.2. Expected evidence and red flags noted. Most can be answered from the toolkit doc 04 audit-evidence checklist.

1. Are there Privacy-Role Competency Profiles for each of the seven privacy roles (DPO, Privacy Lead, Consent Manager operator, SDF officer, DPIA practitioner, processor-side privacy contact, Grievance Officer)? Expected: dated, version-controlled, signed by the role-holder, the line manager and the DPO. Red flag: missing or stale.
2. Do the profiles use the four-axis model (knowledge, skills, experience, behaviour)?
3. Do the profiles cite the DPDP / GDPR / sectoral anchors relevant to the role?
4. Is there a Training Needs Analysis per role-holder comparing the current state with the profile-required state?
5. Is there an effectiveness-evaluation programme per role using the four-method menu (test piece, supervised performance, scenario interview, certification outcome)?
6. Is there an Evidence / Training Records Register per role-holder holding education, training, experience, qualification and effectiveness records?
7. Are the certification-expiry dates tracked, with a renewal-reminder cadence?
8. Are the training-attendance records complemented by effectiveness evidence (not mistaken for effectiveness evidence)?
9. For the SDF DPO, is the expert-knowledge threshold demonstrated through the combined evidence set (certification plus portfolio plus scenario-interview outcome)?
10. For the SDF DPO, is the competence attestation reported to the Board / Risk Management Committee?
11. For the Grievance Officer, is the capability to discharge the section 13 role evidenced (DPDP rights training, scenario-interview outcome, escalation-protocol familiarisation)?
12. For the Consent Manager operator, is the competence to operate the API integration evidenced (privacy-technologist certification or equivalent, supervised performance record)?
13. For the DPIA practitioner, is the 29134 / Article 35(7) methodology literacy evidenced?
14. For the processor-side privacy contact, is the Annex A.2 / Article 28 competence evidenced (including the infringing-instruction process)?
15. For the SDF officer (where designated), is the algorithmic-AI fairness coordination competence evidenced?
16. Is the integrated-with-distinction posture (Pattern A) evidenced where the ISMS and PIMS share competence?
17. For the shared roles (the CISO with privacy duties, the incident-response lead, the security analyst who handles DSAR evidence), is the time-split between ISMS and PIMS work documented?
18. Is the SoA-to-competence reconciliation evidenced (the sample of applicable Annex A.1 / A.2 / A.3 controls traced to the competent operator)?
19. Is the competence review wired into the annual management-review cycle?
20. Are event-trigger reviews recorded in the Change-Monitoring Log (new processing activity class, new technology, new jurisdiction, new regulation, post-incident, SDF designation, M&A, material role change)?
21. Is the training-and-certification budget ring-fenced (the Clause 7.1 line protected from cost-cycle cuts)?
22. Are the certifications in date (no lapsed credentials at the time of the audit)?
23. Is the succession plan for the DPO and the Grievance Officer in place?
24. Is the credential landscape evaluation documented (the choice of credential per role, with the criteria)?
25. Are the effectiveness-evaluation outcomes recorded (test-piece outcomes, observation summaries, scenario-interview scores)?
26. Is the SDF-designation analysis on the annual-review agenda (the SDF officer profile drafted ahead of designation)?
27. Is the algorithmic-software reviewer engaged for every AI-driven processing activity (the SDF officer function or the external advisor)?
28. Is the Change-Monitoring Log up to date (event-trigger reviews recorded with the resulting profile updates)?

Evidence the auditor will physically request

• The seven Privacy-Role Competency Profiles (dated, version-controlled, signed).
• The Training Needs Analysis per role-holder.
• The effectiveness-evaluation programme documentation and outcomes (test pieces, observation summaries, scenario-interview scores, certification outcomes).
• The Evidence / Training Records Register (per role-holder, the five-axis record: education, training, experience, qualification, effectiveness).
• The certification-expiry tracker with the renewal-reminder cadence.
• The SDF-DPO competence attestation (where applicable) with the board-minute noting.
• The Grievance Officer capability statement with the scenario-interview outcome.
• The Consent Manager operator profile (or the staged build plan where the integration is pending).
• The Change-Monitoring Log; the most recent management-review minutes showing the competence input.
• The credential-landscape evaluation document (the choice of credential per role).
• The succession plan for the DPO and the Grievance Officer.
• The integrated-with-distinction reconciliation (the shared-role time-split).

Common Stage-1 nonconformities the auditor will write up

• NC pattern 1, ISMS-competence reskin. Major NC. Remediation: Pattern A integrated-with-distinction migration, 6 to 12 weeks.
• NC pattern 2, Phantom DPO without the expert-knowledge threshold. Major NC. Remediation: recognised privacy-management certification; portfolio build; effectiveness re-evaluation; 8 to 16 weeks.
• NC pattern 3, Grievance Officer as inbox. Major NC. Remediation: privacy training; scenario interview; escalation protocol; 4 to 8 weeks.
• NC pattern 4, Consent Manager operator absent. Major NC (where the integration is in scope). Remediation: profile drafting; privacy-technologist certification; supervised performance build; 8 to 16 weeks.
• NC pattern 5, Training-attendance records mistaken for effectiveness evidence. Major NC. Remediation: four-method effectiveness-evaluation programme; test-piece outcomes recorded; 4 to 10 weeks.
• NC pattern 6, Stale profiles, lapsed certifications, absent event-trigger reviews, budget cut mid-cycle. Minor NC patterns. Remediation: profile refresh; certification renewal; Change-Monitoring Log reinstated; budget ring-fenced, 2 to 8 weeks each.

Metrics and KPIs

1. Profile coverage, the count of the seven privacy roles with a current (within 12 months) competency profile. Target: 7 of 7. Red flag: under 7 indicates a profile gap.
2. TNA currency, the count of role-holders with a current (within 12 months) Training Needs Analysis. Target: 100 percent.
3. Effectiveness-evaluation cadence, the count of role-holders with an effectiveness evaluation in the last 12 months. Target: 100 percent.
4. Certification currency, the count of role-holders with the required credential(s) in date. Target: 100 percent. Red flag: any lapsed credential at the time of the audit.
5. Test-piece pass rate, for roles evaluated by the test-piece method, the count of test pieces scoring above the threshold. Target: above 90 percent.
6. Scenario-interview pass rate, for roles evaluated by the scenario-interview method, the count of interviews scoring above the threshold. Target: 100 percent.
7. Supervised-performance completion, for roles evaluated by the supervised-performance method, the count of observations completed. Target: at least one per role-holder per year.
8. Evidence-register completeness, the count of role-holders with a complete five-axis record (education, training, experience, qualification, effectiveness). Target: 100 percent.
9. SDF-DPO attestation currency (for SDFs), the count of months since the last board attestation. Target: under 12.
10. Grievance Officer SLA performance, the percentage of grievances responded to within the DPDP section 13 period. Target: 100 percent. (This is also a Clause 9.1 KPI; it tests Grievance Officer competence in practice.)
11. Breach-tabletop performance, the count of dual-clock breach tabletop exercises per year meeting the CERT-In 6-hour and DPDP timelines (intimation without delay; 72-hour report). Target: at least 2 of 2 (one full exercise; one component drill). (Tests breach-response role-holder competence in practice.)
12. DPIA throughput, the count of DPIAs completed per FTE per year. Target: at industry benchmark (a competent DPIA practitioner completes 8 to 20 DPIAs per year depending on complexity).
13. DSAR SLA performance, the percentage of DSARs fulfilled within the DPDP section 11 response period. Target: above 95 percent. (Tests the DSAR fulfilment competence.)
14. Training-budget use, the actual training-and-certification spend divided by the planned budget. Target: 0.85 to 1.05.
15. Event-trigger review latency, median time from a material event to the competency profile re-open. Target: under 15 days.

Common Pitfalls and Audit Failures

Pitfall 1, The ISMS-competence reskin. The PIMS Competence Register is the ISMS register with a privacy label. The seven privacy-role profiles are unevidenced. The single most common 7.2 finding. Treatment: Pattern A integrated-with-distinction migration.

Pitfall 2, The credential-only profile. The DPO has a certification; therefore the DPO is competent. The certification is one input; the demonstrable ability to perform the role is the test. Treatment: combine certification outcome with test piece or scenario interview.

Pitfall 3, The Grievance Officer as inbox. The Grievance Officer is a customer-support inbox with no privacy training. Treatment: privacy training; scenario interview; escalation protocol.

Pitfall 4, The phantom DPO. The DPO is appointed in the org chart with no documented expertise profile. Treatment: profile drafting; effectiveness evaluation; SDF-DPO attestation where applicable.

Pitfall 5, The Consent Manager operator absence. The Consent Manager integration is not scoped; the operator role does not exist. Treatment: profile drafting; privacy-technologist certification or equivalent; supervised performance build.

Pitfall 6, The LMS-as-evidence fallacy. Training-attendance records from the LMS are presented as effectiveness evidence. The LMS evidences delivery, not effectiveness. Treatment: four-method effectiveness-evaluation programme.

Pitfall 7, The stale profile. The profiles were drafted for the initial certification cycle and never refreshed. Treatment: annual review cadence; event-trigger reviews.

Pitfall 8, The lapsed certification. The credential expired; the renewal was missed. Treatment: certification-expiry tracking; renewal-reminder cadence.

Pitfall 9, The top-down profile. The DPO drafted the profiles alone with no role-holder or line-manager review. Treatment: three-signature review (role-holder, line manager, DPO).

Pitfall 10, The single-point-of-failure. The Privacy Lead leaves; no deputy profile; no succession plan. Treatment: succession plan; deputy profile; cross-training.

Pitfall 11, The SDF-designation scramble. The organisation crosses the section 10 threshold without the SDF officer profile in place. Treatment: SDF-designation analysis on the annual-review agenda; SDF officer profile drafted ahead of designation.

Pitfall 12, The algorithmic-software review gap. AI-driven processing activities without the algorithmic-software reviewer competence engaged. Treatment: AI-fairness qualification; external advisor engagement.

Pitfall 13, The budget cut mid-cycle. The training-and-certification line is cut in a cost cycle; the competence build stalls. Treatment: ring-fence the line; board-level protection.

Pitfall 14, The "5 years in privacy" generic experience record. The experience axis is recorded as a generic years-of-experience figure rather than a specific portfolio. Treatment: count of artefacts (DPIAs led, DSARs fulfilled, breach tabletops run).

Pitfall 15, The cert-body mistake. The organisation picks a credential because the cert body recommended it, not because it fits the role profile. Treatment: the credential-landscape evaluation is the organisation's own; the cert body does not prescribe.

Pitfall 16, The training-as-onboarding-only. Effectiveness evaluation happens at hire and never again. Treatment: annual effectiveness re-evaluation; scenario-interview cadence.

Pitfall 17, The integrated-with-distinction misapplication. Pattern A is invoked but the privacy-specific profiles are not actually drafted, the register is shared but the privacy sub-section is empty. Treatment: draft the seven profiles; populate the privacy sub-section.

Pitfall 18, The event-trigger amnesia. A material event fires (a new AI-driven processing activity, a new jurisdiction, a post-incident) and the profiles are not re-opened. Treatment: Change-Monitoring Log; Pattern B event-trigger discipline.

Pitfall 19, The vendor-training-as-competence fallacy. The organisation sends a role-holder to a vendor's product-training session and records it as competence evidence. Vendor product training is one input; competence is the demonstrable ability to perform the role. Treatment: complement vendor training with the four-method evaluation.

Pitfall 20, The SDF-DPO as a non-expert. The SDF DPO is a senior manager with no privacy expertise; the section 10 obligation is treated as a governance formality. Treatment: SDF-DPO competence attestation; recognised privacy-management certification; portfolio build.

Pitfall 21, The processor-side privacy contact as contract-manager. The processor-side privacy contact is a contract-manager with no Annex A.2 exposure. Treatment: Annex A.2 training; infringing-instruction process walk-through.

Pitfall 22, The credential-landscape neglect. The credential landscape is never evaluated; the organisation picks the credential it has always picked. Treatment: credential-landscape evaluation at each renewal cycle.

Illustrative Scenario 1: Failure, Kalakar Studio with a Phantom DPO and a Credential-Shaped Privacy Team (Illustrative)

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome. It is set after 13 May 2027, when the DPDP Act's duties and the Board's inquiry and penalty powers take effect.

Illustrative scenario. Kalakar Studio is a fictional Mumbai-based creative-tech studio with 220 staff and approximately 1.2 million user principals; the facts are composite from publicly reported sector patterns and should not be attributed to any real organisation.

Kalakar Studio built its PIMS in 2024, ahead of an ISO/IEC 27701:2019 certification push. The competence register was a single spreadsheet, a list of names with one credential column. The DPO (the Head of Legal wearing a second hat at 0.2 FTE) held a recognised privacy-management certification acquired in 2022; no effectiveness evaluation had ever been run. The Privacy Lead (a compliance analyst) held no privacy credential. The Grievance Officer was a customer-support inbox shared with general complaints. The Consent Manager operator did not exist (the Consent Manager integration was not scoped). The DPIA practitioner was an external advisor who drafted the DPIAs without Kalakar-side competence transfer. The profiles themselves did not exist; the credential column was the register.

Between 2024 and 2028 the regulatory landscape shifted materially. The DPDP Rules 2025 (notified 13 November 2025) operationalised the section 13 Grievance Officer response period; the section 2(1)(g) Consent Manager ecosystem began to emerge; the section 10 SDF thresholds became a live question for Kalakar as the user base grew. The competence envelope did not adjust.

In March 2028 a published investigation alleged that Kalakar's Grievance Officer was systematically non-responsive, principal complaints about access requests going unanswered for 40+ days, well beyond the section 13 period. The "Grievance Officer" inbox had accumulated approximately 280 unaddressed privacy grievances. The DPO had no operational familiarity with the section 13 workflow; the Privacy Lead had no training to step in. The effectiveness of the credential held by the DPO was, in this scenario, not supported by any demonstrated ability to discharge the section 13 oversight obligation.

The Data Protection Board of India preliminary inquiry (under section 18) identified the under-competent privacy team as the root cause. The DPO's certification was current but the effectiveness evaluation had never been run; the Grievance Officer was not competent; the Consent Manager operator did not exist; the seven privacy-role profiles had never been drafted.

The certification body issued a major nonconformity on Clause 7.2 at the next surveillance audit, cascading into nonconformities on 5.3 (Grievance Officer as inbox; DPO with no documented expertise profile), 6.1 (risks not competently treated), 7.1 (training-and-certification budget underallocated), 7.3 (awareness programme unfunded), 8.2 (DPIA practitioner external-only with no internal competence transfer), Annex A.1.3.x (grievance-handling controls not competently operated), and A.1.2.3/A.1.2.4 (consent controls not competently operated because the Consent Manager operator was absent). The certificate was suspended pending remediation.

The lessons: a credential column is not a competence register; the Grievance Officer is a real role with a competence requirement; the Consent Manager operator is a distinctive Indian competence line; effectiveness evidence is the load-bearing test; the seven privacy-role profiles are the operational heart of 7.2.

Illustrative Scenario 2: Success, Saffron Logistics Builds a Bench-Marked Privacy-Competence Programme (Illustrative)

Illustrative scenario. Saffron Logistics is a fictional Gurugram-based supply-chain-tech firm with 1,400 staff, an international cross-border footprint, and approximately 3.6 million shipper and consignee principals; the facts are composite from publicly reported sector patterns and should not be attributed to any real organisation. (Saffron also appears in the Move 2.6 worked example; the full illustrative scenario is consistent with that worked example.)

Saffron Logistics ran an integrated ISO/IEC 27001:2022 + ISO/IEC 27701:2019 programme with a single combined competence register. The DPO wore three hats (privacy, legal, company secretary) at a nominal 0.3 FTE on privacy work. The competence register was the ISMS register with a privacy column. The Grievance Officer was a customer-support lead with no formal privacy training. The Privacy Lead had a recognised privacy-management certification acquired in 2021 but no effectiveness evaluation since.

In Q4 2025 the executive sponsor commissioned a 7.2 refresh ahead of the 27701:2025 transition. The competence-discovery workshop surfaced six material shifts. First, the pattern was effectively Pattern C (reskin), the integrated register had no privacy-specific sub-section. The decision was to migrate to Pattern A (integrated-with-distinction). Second, the seven privacy-role profiles did not exist. Third, the Grievance Officer was a customer-support lead with no privacy training and no effectiveness evaluation. Fourth, the Consent Manager operator did not exist; the integration was scoped for 2026. Fifth, the DPO's effectiveness evaluation had never been run; the certification alone was being treated as the competence evidence. Sixth, the DPIA practitioner was an external advisor with no internal competence transfer; the AI-driven route-optimisation feature had no internal DPIA owner.

Saffron rebuilt the competence programme: a Pattern A integrated register with ISMS-relevant and PIMS-relevant sub-sections; the seven privacy-role competency profiles (DPO with a recognised privacy-management certification plus a region-specific EU credential given the cross-border footprint; Privacy Lead with a recognised privacy-management certification; Consent Manager operator at 0.5 FTE with a recognised privacy-technologist certification; DPIA practitioner at 1 FTE with a recognised privacy-management certification; processor-side privacy contact at 0.5 FTE with a recognised privacy-management certification; Grievance Officer at 1 FTE with formal DPDP training and a recognised privacy-management certification; SDF officer at 0.5 FTE, the DPO wearing a second hat pending the SDF designation analysis); a TNA refreshed annually per role-holder; a four-method effectiveness-evaluation programme (test piece for the DPIA practitioner and the Grievance Officer; supervised performance for the Consent Manager operator; scenario interview for the DPO; certification outcome for the Privacy Lead combined with the test piece); an Evidence / Training Records Register seeded with education, training, experience, qualification and effectiveness records per role-holder.

The outcome: the integrated-with-distinction posture cut parallel-register reconciliation overhead and shared-LMS licensing; the Grievance Officer capability build, completed before the section 13 obligation became live, avoided the Kalakar-style failure pattern (avoiding penalty exposure on a single grievance complaint to the Board); the Consent Manager operator build, completed ahead of ecosystem maturation, positioned Saffron to integrate with the first registered Consent Managers without scrambling (an estimated 6 to 10 weeks of avoided timeline slippage); the effectiveness-evaluation programme, run on the DPO and the Privacy Lead, identified a scenario-interview gap on the cross-border transfer dimension that prompted a targeted training intervention before any operational incident exposed it; the DPIA practitioner internal hire, replacing the external-only model, internalised the competence and cut the cost of each of the 18 DPIAs a year.

The lessons: the seven privacy-role profiles are the operational heart of 7.2; the integrated-with-distinction posture is the highest-use decision for most Indian growing companies; the effectiveness-evaluation programme is the load-bearing test (not the credential column); the Grievance Officer capability build, completed before the section 13 obligation becomes live, is cheap insurance against the most common post-complaint failure pattern; the Consent Manager operator build, completed ahead of ecosystem maturation, is the distinctive Indian competence investment.

Multi-Framework Mapping

The densest cross-framework mappings are at the DPO-competence row (GDPR Art 37(5); DPDP s.10 SDF; ISO/IEC 27001 Clause 5.3 + 7.2), the Grievance-Officer row (DPDP s.13, uniquely Indian in its prescription), the Consent-Manager-operator row (DPDP s.2(1)(g), uniquely Indian), and the SDF-officer row (DPDP Rule 13(3) algorithmic-software review, uniquely Indian in its combination).

The unique-to-India rows are the Grievance Officer, the Consent Manager operator and the SDF officer, none has a direct GDPR, NIST or SOC 2 analogue at the level of prescription the DPDP carries. The Indian competency profiles must address all three head-on.

Implementation Roadmap

30 days

• Decide the pattern (Move 1, Pattern A integrated-with-distinction is the recommended default); stand up the role-discovery workshop (executive sponsor, DPO, Head of HR, CISO, top privacy-role holders); issue the pre-read (current competence register, current role-holder roster, current credential inventory, the risk register from 6.1, the SoA from 6.1.3, the Clause 5.3 charter); begin drafting the DPO and Grievance Officer competency profiles (the two highest-priority profiles).

90 days

• Complete the seven privacy-role competency profiles (Move 2); run the Training Needs Analysis per role-holder (Move 3); design the effectiveness-evaluation programme (Move 4); begin seeding the Evidence / Training Records Register (toolkit doc 12); run the credential-landscape evaluation; begin the Pattern A migration where the current state is Pattern B or C.

180 days

• Complete the Pattern A migration where applicable; operationalise the effectiveness-evaluation programme (run the first cycle for each role); run the first DPO scenario interview and the first Grievance Officer test piece; build the Consent Manager operator profile (where the integration is in scope); engage the algorithmic-software reviewer (Rule 13(3)); wire the competence programme into the management-review cycle; deliver the SDF-DPO competence attestation to the board (where the organisation is an SDF).

12 months

• Run the first full annual review at the management review; update the profiles and the TNA to reflect the year's changes; run an internal-audit test against the Section 11 checklist; calibrate the metrics against the Section 12 targets; reassess the SDF-designation analysis; for SDFs, complete the first SDF-DPO annual attestation cycle and the first algorithmic-software review cycle.

FAQ

Q1. We already have an ISO/IEC 27001:2022 Clause 7.2 competence register. Can we reuse it for 27701?

Yes, with the integrated-with-distinction migration (Pattern A). The ISMS register covers the security-role competence; the PIMS register adds the seven privacy-role profiles, the DPO, the Privacy Lead, the Consent Manager operator, the SDF officer, the DPIA practitioner, the processor-side privacy contact, the Grievance Officer. Most Indian growing companies run a single combined register with two clearly labelled sub-sections.

Q2. Our DPO holds a recognised privacy-management certification. Is that sufficient for 7.2?

A certification is one input to competence evidence; it is not the only input. The test is the demonstrable ability to perform the role, measured against the competency profile. Combine the certification outcome with at least one of the other effectiveness-evaluation methods (test piece, supervised performance, scenario interview). For the SDF DPO under DPDP section 10, the expert-knowledge threshold is demonstrated through the combined evidence set (certification plus portfolio plus scenario-interview outcome plus continuing-education currency).

Q3. Our Grievance Officer is a senior customer-support lead. Is that acceptable?

Yes, with formal privacy training and effectiveness evaluation. The Grievance Officer under DPDP section 13 is a statutory role with a competence requirement. The customer-support lead must be trained on the DPDP rights regime (sections 11 to 14), the organisation's privacy policy, the DSAR workflow, the escalation protocol. The effectiveness evaluation (typically a scenario interview on a difficult-complaint fact pattern) is the evidence. The customer-support inbox pattern is non-competent on section 13.

Q4. Do we need a dedicated Consent Manager operator?

Where the organisation operates the API integration with registered Consent Managers under DPDP section 2(1)(g), the operator role is required. The operator may be a dedicated FTE or a fractional allocation; the test is competence (the operator must understand the registered-Consent-Manager ecosystem, the API contract, the consent-record data model, the withdrawal-signal honouring logic). For growing companies the operator may be the Privacy Lead with a privacy-technologist certification; for mid-sized and enterprise the operator is typically a dedicated role.

Q5. How do we evaluate the credential landscape without picking a specific provider?

Use the five-category framework (privacy-management certifications, region-specific privacy professional credentials, privacy-technologist certifications, PIMS Lead Auditor / Lead Implementer programmes, national Indian data-protection certification streams). For each role, identify the recommended category (or categories). For each category, evaluate the specific credentials offered by established credentialing bodies on the criteria: syllabus coverage (does it cover the DPDP, the GDPR, the ISO/IEC 27701:2025 framework, the operational disciplines); examination rigour; continuing-education requirement; geographic recognition; cost-to-value. The choice is the organisation's, calibrated to the role and the regulatory context.

Q6. We are not yet designated an SDF. Do we need the SDF officer profile?

The SDF officer role applies to Significant Data Fiduciaries. The discipline is to run the SDF-designation analysis annually; if the thresholds are approachable, draft the SDF officer profile ahead of designation. For most organisations the SDF officer is the DPO wearing a second hat; the dedicated deputy follows as the SDF load grows.

Q7. How often should we run the effectiveness evaluation?

Annually per role-holder as the baseline. The four-method menu (test piece, supervised performance, scenario interview, certification outcome) rotates across years, for instance, the DPO might have a scenario interview in year 1, a test piece in year 2, a scenario interview in year 3. Event-trigger re-evaluation after a material event (post-incident; new processing activity class; new technology; SDF designation).

Q8. Our DPO is also the Head of Legal. Is that acceptable?

Yes, with the documented time allocation and the effectiveness evaluation. The 7.2 test is competence and adequacy, not exclusivity. For non-SDFs the DPO can wear multiple hats; for SDFs under DPDP section 10 the statutory DPO obligation is more demanding but the statute does not say "full-time", the test is whether the role has the time, the competence, the team and the authority to do the job.

Q9. What is the credential vs effectiveness distinction?

A credential evidences that the role-holder passed an assessment at a point in time. Effectiveness evidence demonstrates that the role-holder can perform the role now. Both are inputs to the competence record. A credential without effectiveness evidence is the "credential-only profile" pitfall; an effectiveness evaluation without a credential is acceptable for senior practitioners with a defensible portfolio. The combined set is the strong evidence.

Q10. How do we handle the algorithmic-software reviewer competence?

For SDFs under DPDP section 10, the algorithmic-software review is mandatory for AI-driven processing. The competence is either internal (an AI/ML specialist with fairness-metric literacy, demographic parity, equalised odds, calibration) or external (a specialist advisor). For most growing companies the external advisor is the entry point; the internal hire follows as the AI-driven processing volume grows. The SDF officer (Role 4) coordinates the algorithmic-software reviewer; the reviewer's competence is a specialist line, not the SDF officer's integrative competence.

Q11. Can we outsource the DPO role entirely?

For non-SDFs, the DPO-as-a-service model is widely used and acceptable. The test is competence and adequacy: the external DPO must have the time, the competence, the authority and the organisational access to do the job. For SDFs under DPDP section 10, the statutory DPO obligation (India-based, board-accountable) constrains the model but does not forbid it, a contracted DPO can be India-based and board-accountable.

Q12. How do we avoid the Pattern C reskin?

The Pattern C reskin is the single most common 7.2 finding in the Indian growing-company segment. The treatment is the Pattern A integrated-with-distinction migration: a single competence register with two clearly labelled sub-sections (ISMS-relevant and PIMS-relevant), co-authored by the CISO and the DPO, with the seven privacy-role profiles explicitly drafted and populated. The test is whether the privacy-specific roles (DPO, Consent Manager operator, DPIA practitioner, Grievance Officer) are visible in the register with the four-axis profiles and the effectiveness evidence.

Q13. How do we record the experience axis specifically?

Avoid the generic "5 years in privacy" record. Use the specific portfolio: count of DPIAs led; count of DSARs fulfilled; count of breach tabletops run; count of cross-border transfer assessments completed; count of Grievance Officer complaints handled. The portfolio is the experience evidence; the years-of-experience figure is the summary, not the substance.

Q14. What is the relationship between 7.2 (competence) and 7.3 (awareness)?

7.2 covers the privacy team and the privacy-adjacent process owners, the role-holders whose work affects the PIMS's performance (the seven privacy-role profiles). 7.3 covers the wider staff whose work touches personal data but who are not privacy specialists (the engineer who writes code that processes personal data; the marketing analyst who handles consent records; the HR officer who handles employee data). The demarcation is the load-bearing line, the privacy team is in 7.2; the wider staff is in 7.3. Most growing companies run a single combined programme with two clearly labelled populations.

Q15. How do we scope the Consent Manager operator role ahead of the ecosystem maturation?

Stage the build. Stage 1, the profile drafting (the role, the four axes, the regulatory anchors). Stage 2, the credential acquisition (privacy-technologist certification or equivalent). Stage 3, the API-integration scoping (the data model for the consent artefact, the withdrawal signal, the synchronisation protocol). Stage 4, the operationalisation (the actual integration with one or more Consent Managers once registered; the interoperation testing). The budget for Stages 1 and 2 is committed even where Stages 3 and 4 are pending the ecosystem emergence.

Industry-Specific Requirements

BFSI

Banks, NBFCs, payment aggregators, payment gateways, insurers. The BFSI competence envelope carries the heaviest regulatory load: DPDP sections 8(5), 8(6) and 10 (SDF); the RBI Storage of Payment System Data directive (6 April 2018); the RBI Digital Lending Guidelines (2 September 2022); the RBI Tokenisation circular (22 September 2021); the RBI Cybersecurity Directions 2026 (31 July 2026); the SEBI CSCRF (20 August 2024); the IRDAI Information and Cyber Security Guidelines 2023 (24 April 2023). The competence programme must produce role-holders competent on the dual-clock pattern (CERT-In 6 hours, DPDP without delay plus a 72-hour detailed report, RBI and SEBI six hours, IRDAI per its own guidelines) and the BFSI-specific operational load (high-volume DSAR, high-volume grievances, the algorithmic-software review on credit-scoring and fraud-detection engines). SDF-readiness is critical. Indicative credential set per role: DPO with a recognised privacy-management certification plus a region-specific EU credential where cross-border; Privacy Lead with a recognised privacy-management certification; DPIA practitioner with a recognised privacy-management certification; algorithmic-software reviewer with an AI-fairness qualification; Grievance Officer with formal DPDP and RBI-customer-grievance training.

Healthcare

Hospitals, telemedicine platforms, healthtech, insurers processing health data. The competence programme must address the heightened sensitivity of health data (the DPDP section 9 analog for vulnerable data subjects; the SPDI Rules' explicit inclusion of health data; clinical-data-confidentiality expectations; the IRDAI framework where insurance is involved). The DPIA practitioner competence is central, most material processing activities trigger a DPIA. The algorithmic-software reviewer must be competent on the AI-driven diagnostic engines and recommendation engines. The role declaration is complex (controller for patient data; processor for some insurance-claim data; joint controller with referring physicians in some cases) and the competence programme must address each role. Indicative credential set per role: DPO with a recognised privacy-management certification plus health-data-specific training; DPIA practitioner with the ISO/IEC 29134 methodology plus health-data exposure; Grievance Officer with formal DPDP plus clinical-grievance training.

IT-ITeS and SaaS

IT services firms, BPOs, SaaS providers, cloud processors. The competence programme is almost always "both", the customer's principals (processor-side) and the organisation's own employees, marketing-lead contacts and beta-test users (controller-side). The processor-side privacy contact profile (Role 6) is the densest single load, the infringing-instruction process, the sub-processor change-notification pipeline, the return / deletion workflow, the breach-notification-to-controller capability. The standalone-PIMS scoping decision lets SaaS firms scope a PIMS to the customer-data plane only, separate from the ISMS-scoped engineering plane; the competence programme must mirror the scoping. Indicative credential set per role: DPO with a recognised privacy-management certification; processor-side privacy contact with a recognised privacy-management certification plus processor-specific training (Annex A.2 / Article 28); DPIA practitioner with a recognised privacy-management certification; Consent Manager operator with a recognised privacy-technologist certification (for the customer-facing SaaS features).

E-commerce and Retail

D2C brands, marketplaces, e-commerce platforms, omni-channel retailers. The competence programme must address the consumer-facing consent infrastructure (the CMP, the Consent Manager integration, the preference centre), the marketing-lead consent regime, the supplier-ecosystem processor chains, the payment-data overlays (RBI Tokenisation, the Payment Aggregator obligations), and the children's-data regime where minors are in the user base. The Grievance Officer competence is particularly critical, the consumer-principal grievance volume is typically the highest of any sector. The Consent Manager operator competence is the load-bearing line for the section 2(1)(g) integration. Indicative credential set per role: DPO with a recognised privacy-management certification; Consent Manager operator with a recognised privacy-technologist certification; Grievance Officer with formal DPDP training plus consumer-grievance experience.

Edtech

K-12 platforms, higher-edtech, skilling platforms, test-prep. The children's-data regime (DPDP section 9) is the central competence issue, the principal is a minor, the consent dynamic is parental, and the section 9 verifiable-parental-consent + no-behavioural-monitoring-or-targeted-advertising regime requires specific operator competence (age-assurance, parental-identity-verification, the no-targeted-advertising control on the marketing engine). The DPIA practitioner competence is central, most material processing activities trigger a DPIA. The algorithmic-software reviewer competence is critical for the adaptive-learning features. Indicative credential set per role: DPO with a recognised privacy-management certification plus children's-data training (section 9); DPIA practitioner with a recognised privacy-management certification plus children's-data exposure; algorithmic-software reviewer with an AI-fairness qualification.

Manufacturing

Discrete and process manufacturing, automotive, chemicals, pharma manufacturing. The competence programme must address the OT-IT convergence (operational technology systems increasingly connected, with PII exposure in HR, contractor and visitor data), the supply-chain processor ecosystem, and the geopolitical context for cross-border manufacturing data flows. The principal set includes employees, contractors, visitors, customers (where direct-to-customer), and patients (for pharma with patient-level pharmacovigilance data). The DPIA practitioner competence typically covers the employee-monitoring tools, the contractor-management systems, the pharmacovigilance reporting (for pharma). Indicative credential set per role: DPO with a recognised privacy-management certification plus OT-IT exposure; processor-side privacy contact with a recognised privacy-management certification plus supply-chain experience.

Cross-sector patterns

Three patterns recur across sectors. The processor-side scale pattern: Indian ITeS, BPO, SaaS and cloud-processor firms typically process personal data at volumes that easily cross the DPDP SDF thresholds even though their consumer brand is small; the competence programme must use the volume of data processed (not the headcount) as the SDF-trigger input. The dual-regulator pattern: BFSI and listed entities carry dual-regulator exposure, DPDP via the Data Protection Board plus the sector regulator (RBI, SEBI, IRDAI); the competence programme must address both regulatory streams. The AI-driven profiling pattern: AI-driven processing activities (credit-scoring, marketing-lead scoring, recommendation engines, fraud detection, adaptive learning, algorithmic hiring) require the algorithmic-software reviewer regardless of sector; the competence programme must surface these activities explicitly and the algorithmic-software reviewer profile must be populated.

Maturity Model

Emerging Trends

The SDF designation wave (2026–2027). The Central Government is expected to designate the first wave of Significant Data Fiduciaries through 2026 and 2027 as the DPDP Rules 2025 phased commencement completes. Designated SDFs must operationalise the section 10 DPO expert-knowledge threshold. The competence programme for any organisation approaching the threshold should include the SDF-DPO profile uplift; the operationalisation window before designation is typically 6 to 12 months.

The Consent Manager ecosystem emergence. The DPDP Rules 2025 prescribe Consent Manager registration conditions; the first Consent Managers are expected to be registered through 2026 and 2027. As the ecosystem emerges, the Consent Manager operator competence becomes the timeline-critical path. Profiles should be drafted and credentialed ahead of the ecosystem emergence so the integration can complete within 3 to 6 months of the first Consent Manager registrations.

DPBI operational emergence. The Data Protection Board of India, constituted under DPDP section 18, is emerging through 2026 and 2027. Its early orders, its interpretation of the Schedule penalty maxima, its engagement patterns on breach notifications and grievances, and its precedent on competence expectations will reshape the 7.2 landscape. The SDF-DPO attestation and the Grievance Officer capability statement should track the DPBI's emerging expectations.

AI-driven processing and the algorithmic-software reviewer. The Rule 13(3) algorithmic-software review, the 2025 edition's callout of AI-driven profiling, and the parallel development of ISO/IEC 42001:2023 (AI Management System) are reshaping the competence landscape. For organisations using AI/ML on personal data, the algorithmic-software reviewer is the highest-use 7.2 addition. The role is increasingly internalised as the AI-driven processing volume grows; the external advisor is the entry point for most growing companies.

Indian privacy-profession maturation. The Indian privacy-profession market is maturing rapidly through 2026 and 2027. India-focused credentials on the DPDP are emerging; the recognition of privacy-role profiles in the Indian labour market is strengthening; the senior-practitioner bench is deepening. The credential-landscape evaluation should be refreshed annually.

Cross-border transfer regime evolution. The DPDP negative list under section 16, the EU–US Data Privacy Framework adequacy decision (10 July 2023), the UK IDTA / Addendum, the China PIPL cross-border mechanisms, and the geopolitical risk environment are all in flux. The DPIA practitioner and the processor-side privacy contact must keep their transfer-impact-assessment competence current.

Integrated management systems. The harmonized structure enables integrated 27001 + 27701 + 42001 + 22301 governance. The competence register is the natural point of integration, a single combined register that serves all four management systems with clearly labelled sub-sections. The integrated-with-distinction posture (Pattern A) is the foundation.

Generative AI in PIMS operations themselves. The use of generative AI inside the PIMS function (for ROPA automation, DPIA drafting support, DSAR fulfilment assistance) is a 7.2 consideration, the competence programme must include the governance of the generative-AI use; the principal-impact axis from Clause 6.1 applies to internal use as much as to customer-facing use. The role-holders operating generative-AI-assisted processes must be competent on the limitations and the failure modes.

Privacy-technologist competence mainstreaming. The Consent Manager operator, the DPIA practitioner with a technical dimension, and the privacy engineer in a SaaS or product organisation increasingly need the privacy-technologist qualification, not just the privacy-management qualification. The credential landscape is responding; the competence programme should track the response.

Sector-regulator convergence on privacy competence. RBI, SEBI and IRDAI are each tightening their privacy-adjacent rules (RBI Digital Lending, SEBI CSCRF, IRDAI ICS 2023); the DPDP Act sits as a horizontal layer above these sectoral instruments and the competence programme must address both streams.

Effectiveness-evaluation methodology evolution. The four-method menu (test piece, supervised performance, scenario interview, certification outcome) is the established baseline; emerging methodologies (work-product analytics, peer-review scoring, behavioural-event interviewing) are maturing. The competence programme should refresh the methodology at each cycle.

References and Further Reading

Primary instruments (India). Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, enacted 11 August 2023), MeitY, in particular sections 8 (general obligations, the duty to be competent to discharge), 8(6) (breach notification, competent dual-clock capability), 8(7) (erasure), 9 (children, competent verifiable-parental-consent operators), 10 (SDF, DPO expert knowledge, SDF DPIA practitioner, independent data auditor, algorithmic-software reviewer), 11 (access, competent DSAR fulfilment), 12 (correction and erasure), 13 (Grievance Officer with capability to discharge), 14 (nomination), 16 (cross-border negative list, competent TIA practitioner), 2(1)(g) (Consent Manager, operator competence on the Data Fiduciary side), 33 + Schedule (penalty maxima up to 250 crore for s.8(5) failure; 200 crore for ss.8(6) and 9; 150 crore for s.10). Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), MeitY, Rule 7 (the breach-notification clock, competent dual-clock operators); SDF designation thresholds (driving the SDF-officer competency profile); Consent Manager registration conditions (driving the operator competency profile); verifiable-parental-consent mechanism; grievance-redressal response periods. Information Technology Act, 2000, sections 43A, 72A, 70B. IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (notified 11 April 2011). CERT-In Directions 20(3)/2022-CERT-In (28 April 2022), the 6-hour clock, the competent Point of Contact. RBI Storage of Payment System Data (6 April 2018); RBI Digital Lending Guidelines (2 September 2022); RBI Tokenisation (22 September 2021); RBI Cybersecurity Directions 2026 (31 July 2026). SEBI Cybersecurity and Cyber Resilience Framework (20 August 2024). IRDAI Information and Cyber Security Guidelines 2023 (24 April 2023). Companies Act 2013, sections 134(3)(n), 177; SEBI LODR Regulation 21.

Primary jurisprudence (India). K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (nine-judge Bench, 24 August 2017). Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), (2019) 1 SCC 1 (five-judge Bench, 26 September 2018).

Primary instruments (global). Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, p. 1; application from 25 May 2018, Articles 24 (controller responsibility, appropriate measures), 32 (security of processing, appropriate technical and organisational measures; Art 32(1)(d) regular testing, evaluating effectiveness), 35 (DPIA, competent DPIA practitioner), 35(7) (DPIA content), 37(5) (DPO expert knowledge), 38 (DPO position), 39 (DPO tasks). EDPB Guidelines 9/2022 on personal data breach notification (competent breach-response competence). CJEU, Schrems II, C-311/18, 16 July 2020 (the transfer-impact-assessment duty, competent TIA practitioner). European Commission Implementing Decision (EU) 2021/914 (modernised SCCs). EU–US Data Privacy Framework adequacy decision (10 July 2023). NIST Privacy Framework v1.0, NIST.CSWP.01162020, 16 January 2020, the Communicate-P function (the training and authorisation subcategory). AICPA, 2017 Trust Services Criteria (with 2022 Points of Focus update), CC1.5 (competence and accountability) and the Privacy category P8.0. Brazil LGPD, Lei nº 13.709/2018. China PIPL, Article 55 (mandatory PIA, competent practitioner).

ISO/IEC standards. ISO/IEC 27701:2025 (2nd ed., published 14 October 2025), Clause 7.2 (Competence), Annex B (normative in 2025). ISO/IEC 27701:2019 (1st ed., for transition reference). ISO/IEC 27001:2022 Clause 7.2 (infosec competence, the integrated-with-distinction partner). ISO/IEC 27002:2022, control 6.2 (terms and conditions of employment, the People cluster) plus only 5.34 is PII-specific. ISO/IEC 27005:2022 (infosec risk management, the practitioner-competence backdrop). ISO/IEC 29134:2017 (DPIA guidelines, the methodology the DPIA-practitioner competence must support). ISO/IEC 27018:2019 (cloud PII processor, the processor-side privacy-contact competence reference). ISO/IEC 27017:2015 (cloud security). ISO/IEC 29100:2011 (privacy framework, 11 principles, the conceptual ancestor of the A.1 / A.2 control themes the DPO must master). ISO/IEC 29151 (PII protection code). ISO/IEC 42001:2023 (AI Management System, the algorithmic-software reviewer competence reference). ISO/IEC 23894 (AI risk management). ISO/IEC 27706:2025 (PIMS cert-scheme competence, the auditor-side reference). ISO 31000:2018 (risk management). ISO/IEC 27001:2022 Amendment 1:2024 (climate-change addition to 4.1; mirrored in 27701:2025 for 4.1/4.2, intersects with 7.2 climate-resilience competence).

Credential landscape (categorised). This guide describes the credential landscape by category, not by issuing body. The five categories: recognised privacy-management certifications (covering privacy-programme management, natural fit for the DPO and Privacy Lead); recognised region-specific privacy professional credentials (EU-focused, UK-focused, India-focused as the market matures); recognised privacy-technologist certifications (covering privacy-by-design, privacy-enhancing technologies, natural fit for the Consent Manager operator, the DPIA practitioner with a technical dimension, the privacy engineer); PIMS Lead Auditor / Lead Implementer programmes (focused on ISO/IEC 27701:2025, natural fit for the internal auditor and the DPO/Privacy Lead); national Indian data-protection certification streams (focused on the DPDP, emerging market). Specific credentials are evaluated by the organisation on the criteria: syllabus coverage (DPDP, GDPR, ISO/IEC 27701:2025, operational disciplines); examination rigour; continuing-education requirement; geographic recognition; cost-to-value.

Edition-transition and practitioner sources (used as research input). ANAB Heads Up #550 (transition timeline). The 2025 edition's structure, the standalone-PIMS framing, the consolidated Annex A, the normative Annex B, and the harmonized-structure Clause 7.2 inheritance are confirmed from the official 2025 PDF (OCR) and corroborated by tier-1 practitioner commentary. The common-nonconformity patterns (the ISMS-competence reskin; the phantom DPO; the credential-only profile; the Grievance Officer as inbox; the LMS-as-evidence fallacy) are drawn from tier-1 cert-body practitioner commentary. All clause text in this guide is paraphrased; the official text is copyrighted by ISO/IEC and has not been reproduced.

Singahi references. The Singahi Clause 7.2 toolkit (17 docs + README) accompanies this guide. The Singahi 27701:2025 series covers all MSS clauses (4 to 10) and Annex A.1 / A.2 / A.3 controls; sibling guides for 4.1, 4.2, 4.3, 4.4, 5.x, 6.x, 7.1, 7.3 to 7.5 and the rest of the standard are available.

This guide is published by Singahi. The ISO/IEC 27701:2025 clause text is copyrighted by ISO/IEC and has not been reproduced; all requirements are paraphrased. Brand names of competitors, cert bodies, credential issuing bodies (as recommendations) and reference books are intentionally omitted. Scenarios are illustrative and should not be attributed to any real organisation.