Data Governance and Privacy Masterclass Training Course

Duration 10 days 17 modules · 65 contact hours
Level Advanced Certificate on completion
Who attends Data Protection Officers, Chief Data Officers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-CS-116

Before you join: Participants should have several years of professional experience in data, privacy, cyber security, risk, compliance, legal, audit or technology leadership.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Senior organisations depend on data for customer decisions, financial reporting, fraud detection, service delivery, research and automation. Yet many governance programmes fail because accountability is vague, data inventories are incomplete, privacy requirements are treated as legal paperwork, and controls are not connected to real data flows. This creates exposure to regulatory action, poor data quality, uncontrolled third-party sharing, delayed projects and loss of public trust.

This masterclass examines how to design and run an accountable data governance and privacy programme aligned with GDPR expectations. Participants work through governance operating models, data ownership, critical data elements, data classification, records of processing, lawful bases, data protection impact assessments, data subject rights, cross-border transfers, retention, third-party controls and breach response. The course also addresses the practical relationship between privacy, cyber security, records management, information architecture, cloud services and AI-enabled processing.

Teaching combines focused instructor briefings with detailed cases from banking, government, healthcare, consumer services and multinational operations. Participants analyse realistic governance failures, make control decisions, review processing documentation and develop components of a working governance pack throughout both weeks. They leave with a reusable data governance and GDPR implementation pack, including an operating model, accountability matrix, processing inventory structure, DPIA template and improvement roadmap.

The course suits experienced privacy, security, risk, compliance, data management and technology professionals who need to lead or strengthen enterprise data governance rather than simply understand regulatory terminology.

What you will be able to do

  • Design a data governance operating model with defined decision rights and accountabilities
  • Establish critical data elements, data ownership and stewardship arrangements
  • Build a GDPR-aligned record of processing activities from real data flows
  • Conduct data protection impact assessments using risk-based evaluation criteria
  • Apply lawful basis, transparency and data subject rights requirements to processing decisions
  • Assess international data transfers, processor arrangements and third-party privacy controls
  • Develop privacy incident response procedures linked to cyber security escalation
  • Present a prioritised data governance and privacy improvement roadmap to senior stakeholders

Benefits of attending

For you

  • Lead data governance discussions using clear ownership, decision-rights and control models
  • Assess GDPR obligations beyond policy wording and basic awareness training
  • Produce defensible DPIAs, processing records and privacy risk recommendations
  • Challenge supplier, cloud and AI processing proposals with structured questions
  • Build credibility with legal, security, data, audit and executive stakeholders

For your organisation

  • Clearer accountability for high-risk data assets, processing decisions and remediation actions
  • Better evidence for GDPR accountability, internal audit and regulatory examination
  • Earlier identification of privacy risks in projects, cloud migrations and AI initiatives
  • More consistent third-party due diligence, contract controls and transfer assessments
  • A prioritised governance roadmap tied to material business, security and regulatory risks

Course modules

17 modules over 10 days

Participants can define a data governance mandate, operating model and decision-rights structure.

  • Data governance operating model linking value, risk, accountability and decision rights
  • Distinguishing data governance, data management, security, privacy and records management
  • EDM Council DCAM capability areas used for maturity diagnosis
  • Defining scope through critical data elements and priority use cases
  • Assessing governance failure patterns in banking, public services and multinationals
  • Setting measurable governance objectives, tolerances, milestones and ownership

Participants can assign practical accountability for data assets, processing and control decisions.

  • RACI matrices for data owners, stewards, custodians and processors
  • Separating business accountability from technical custody and operational administration
  • Data owner responsibilities for quality, access, retention and permitted use
  • Stewardship workflows for issue triage, metadata maintenance and remediation
  • Governance council charters, escalation thresholds and decision records
  • Mapping executive sponsorship to material data risks and business outcomes

Participants can create an inventory approach that supports governance and privacy obligations.

  • Data inventory fields covering systems, datasets, owners, purposes and recipients
  • Classifying personal, special-category, confidential and regulated business information
  • Critical data element selection using risk, materiality and decision dependence
  • Logical data flows from collection through use, disclosure, retention and deletion
  • Metadata standards for definitions, lineage, quality rules and sensitivity labels
  • Reconciling business glossaries, data catalogues and records of processing

Participants can design data quality controls and evidence suitable for governance reporting.

  • Data quality dimensions: accuracy, completeness, timeliness, validity, consistency and uniqueness
  • Profiling methods that identify nulls, duplicates, outliers and invalid values
  • Business rules translated into measurable data quality control tests
  • Issue logs capturing root cause, impact, owner, deadline and closure evidence
  • Control design using preventive, detective, corrective and compensating measures
  • Quality scorecards linked to risk appetite and management reporting

Participants can apply GDPR accountability principles to operational processing decisions.

  • GDPR principles applied to identifiable business processing decisions
  • Accountability evidence: policies, decisions, training, reviews and documented controls
  • Controller, joint-controller and processor roles determined from actual activities
  • Purpose limitation tested against secondary use, analytics and product development
  • Data minimisation decisions for collection fields, access and retention
  • Privacy by design requirements embedded in project governance gates

Participants can select and document lawful bases and transparency measures for processing.

  • Lawful basis analysis for customer, employee, supplier and public-service processing
  • Consent validity tested through choice, granularity, withdrawal and evidence
  • Legitimate interests assessment using purpose, necessity and balancing tests
  • Contractual necessity distinguished from business convenience and anticipated benefit
  • Privacy notices mapped to collection channels, purposes, recipients and retention
  • Layered notice design for websites, mobile applications and service interactions

Participants can build and maintain a useful record of processing activities.

  • Article 30 record fields mapped to operational processing evidence
  • Interview methods for discovering shadow systems, spreadsheets and informal sharing
  • Processing purposes connected to categories of people and personal data
  • Capturing recipients, processors, international transfers, retention and security measures
  • Reconciling records with procurement registers, architecture inventories and data catalogues
  • Change-control triggers for new processing, integrations, vendors and purposes

Participants can conduct a DPIA and determine proportionate risk treatment actions.

  • DPIA screening criteria for high-risk processing and systematic monitoring
  • Describing processing necessity, proportionality, data flows and affected individuals
  • Privacy threat modelling using misuse cases, harms and control failures
  • Assessing likelihood and severity against rights and freedoms
  • Residual risk decisions, consultation thresholds and approval authority
  • DPIA review triggers following material changes, incidents or new technologies

Participants can design controlled workflows for data subject rights requests.

  • Subject access request workflow from intake, identity verification and search
  • Locating personal data across production systems, archives, backups and suppliers
  • Applying exemptions, redaction, third-party privacy and legal privilege considerations
  • Rectification, erasure, restriction, objection and portability decision criteria
  • Statutory deadlines, extension notices and evidence of timely handling
  • Rights metrics identifying recurring causes, bottlenecks and control weaknesses

Participants can establish retention and deletion controls for personal and business data.

  • Retention schedules linked to legal, regulatory, contractual and operational requirements
  • Retention periods justified through purpose, risk and records obligations
  • Deletion standards for live data, replicas, archives, backups and devices
  • Legal holds overriding routine destruction and automated deletion schedules
  • Disposition certificates evidencing authorised deletion and destruction exceptions
  • Testing retention controls through sample tracing and configuration review

Participants can connect privacy obligations to technical and organisational control design.

  • Privacy engineering patterns: pseudonymisation, tokenisation, aggregation and access segregation
  • Data protection by default translated into system configuration requirements
  • Access control models using least privilege, role design and recertification
  • Encryption decisions for stored data, transmitted data and key management
  • Logging and monitoring requirements supporting accountability, investigations and rights requests
  • NIST Privacy Framework profiles aligned with security control ownership

Participants can assess privacy risks and controls across suppliers and cloud services.

  • Processor due diligence covering security, confidentiality, resilience and subcontractors
  • Article 28 contract terms translated into operational assurance requirements
  • Data processing agreements defining instructions, assistance, deletion and audit rights
  • Cloud shared-responsibility models tested against processing and security controls
  • Supplier risk tiering based on data sensitivity, volume and processing purpose
  • Ongoing assurance through attestations, audit reports, incidents and performance reviews

Participants can evaluate international transfers and controlled data-sharing arrangements.

  • Transfer mapping identifies exporter, importer, destination, access and onward transfers
  • Adequacy decisions, standard contractual clauses and binding corporate rules
  • Transfer impact assessments considering local law, access risk and safeguards
  • Supplementary measures covering encryption, key control and data minimisation
  • Data-sharing agreements defining purpose, roles, access, retention and liability
  • Government and research sharing assessed against necessity and proportionality

Participants can govern personal data breach assessment, notification and corrective action.

  • Personal data breach definition distinguished from general cyber security events
  • Incident triage captures affected data, people, systems, recipients and containment
  • Risk assessment for notification to regulators and affected individuals
  • Seventy-two-hour notification planning, evidence collection and decision logging
  • Communications drafted for regulators, executives, customers, employees and partners
  • Post-incident reviews convert root causes into accountable remediation actions

Participants can assess governance and privacy controls for analytics and AI processing.

  • Automated decision-making requirements assessed for eligibility, pricing and recruitment models
  • Profiling risks linked to fairness, transparency, contestability and human intervention
  • Training-data provenance, purpose compatibility and sensitive attribute handling
  • Model governance controls for access, versioning, monitoring and approval
  • Privacy-enhancing techniques considered for analytics, testing and model development
  • AI impact assessment integrated with DPIA and information security review

Participants can measure governance performance and plan risk-based assurance activity.

  • Governance KPIs covering ownership, quality, requests, incidents and remediation
  • Key risk indicators linked to risk appetite and escalation thresholds
  • Three-lines model applied to operational controls, oversight and assurance
  • Internal audit testing of design effectiveness, operation and evidence retention
  • Maturity assessments prioritising capability gaps, dependencies and investment decisions
  • Board reporting that explains residual risk, decisions and required action

Participants can build, review and present a complete data governance and privacy implementation pack for a defined processing environment.

  • Scoping a priority processing environment, data assets, stakeholders and objectives
  • Producing governance operating model, ownership matrix and decision escalation route
  • Building processing inventory, data flow map and classification scheme
  • Completing lawful basis assessment, transparency plan and DPIA summary
  • Defining security, retention, supplier and rights-management control actions
  • Prioritising roadmap actions through risk, effort, dependency and value criteria
  • Presenting recommendations, residual risks, evidence requirements and executive decisions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Data governance operating model template
  2. Data ownership and stewardship RACI matrix
  3. GDPR record of processing activities template
  4. Data protection impact assessment template
  5. Third-party privacy due diligence checklist
  6. Data governance and privacy improvement roadmap

Who should attend

  • Data Protection Officers — responsible for establishing defensible privacy accountability and controls
  • Chief Data Officers — accountable for enterprise data ownership, quality and governance decisions
  • Information Security Managers — need privacy controls integrated with security risk management
  • Risk and Compliance Managers — oversee regulatory obligations, assurance and remediation priorities
  • Data Governance Leads — build operating models, stewardship structures and governance forums
  • Technology and Cloud Managers — make processing, architecture and supplier decisions affecting personal data

Skills and tools covered

Data governance designGDPR compliance managementPrivacy risk assessmentData accountabilityThird-party assuranceIncident response governance

Tools and standards

GDPR, EDM Council DCAM, NIST Privacy Framework, ISO/IEC 27701

How the course runs

Training methodology

The instructor uses short technical briefings followed by case analysis, facilitated group work, decision simulations and structured peer review. Cases include customer analytics, public-service data sharing, cloud outsourcing, employee monitoring, security incidents and AI-assisted decisions. Participants apply each method to their own organisational context through guided planning tasks, using templates that accumulate into a governance and privacy implementation pack. Instructor feedback focuses on defensible decisions, evidence quality, stakeholder communication and workable control design.

Requirements and prerequisites

Participants should have several years of professional experience in data, privacy, cyber security, risk, compliance, legal, audit or technology leadership. They should understand their organisation’s main data sources, business processes or technology services and be comfortable discussing risk and control decisions with senior colleagues. Familiarity with GDPR concepts, information security controls or data management is useful, but specialist legal training is not required. Coding, database administration, formal audit qualifications and prior Data Protection Officer experience are not required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

This is an advanced course for professionals with practical responsibility for data, privacy, security, risk, compliance, audit or technology services. Participants do not need to be lawyers or certified Data Protection Officers, but should understand their organisation’s processes or data environment.

Bring a laptop for working with course templates and, where permitted, non-sensitive examples of governance, privacy or supplier issues from your organisation. Do not bring personal data, confidential customer records or restricted incident evidence.

It is best suited to senior practitioners who must design, challenge, assure or improve data governance and GDPR controls. It is also relevant for leaders preparing for a DPO, data governance or privacy programme role.

General GDPR courses explain core legal concepts and individual obligations. This masterclass focuses on operating models, control design, documentation, technical dependencies, assurance and decisions that senior practitioners must make.

Participants leave with reusable templates and a prioritised implementation pack that can be adapted to a business unit, programme, supplier arrangement or high-risk processing activity. The methods are designed for discussions with legal, security, technology, data and executive stakeholders.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes governance, GDPR and operational control foundations; the second week addresses suppliers, transfers, incidents, AI, assurance and the capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Cyber Security