New data protection laws will require many more data protection officers, but there are strict rules about who can and who can't do the job.