The GDPR created an industry around data protection, and a lure to some of perceived easy money. Anyone can “do data protection”!

Anyone can say that they are a “data protection consultant” or a “privacy professional”, and even the expensive certs mean relatively little in terms of actual competence, IME.

There are loads of talented, amazing data protection people, and I love working with them.

The bandwagon is, however, rather long…

*grumbles* 

 I don't have any IAPP certs, fwiw.

I know people who do who I wouldn't trust to give data protection advice.

I know many people who don't who I would readily trust, and to whom I happily refer work.

It is a shame that, for some privacy roles, the gating criteria includes an IAPP cert, but I guess it is seen as an easy, if ineffective, filter. 

 certs mean nothing? Say it ain’t so! *eyes up all of ISO*