Data Protection and Privacy Training Course

Participants can identify applicable privacy obligations and record jurisdiction-specific requirements.

• GDPR, UK GDPR and CCPA obligations compared
• Applicability assessments consider residents, establishments, thresholds and processing activities
• Definitions of sale, sharing and targeted advertising distinguished
• Privacy notices mapped to jurisdiction-specific disclosure requirements
• Individual rights matrices compare access, deletion, correction and opt-out rights
• Regulatory monitoring registers track legal changes, guidance and enforcement themes

Participants can select, document and review lawful bases for processing activities.

• Article 5 principles translated into measurable operational control requirements
• Lawful basis decision trees for customer, employee and prospect processing
• Consent records: granularity, withdrawal, evidence and child-consent thresholds
• Legitimate interests assessments balancing purpose, necessity and individual impact
• Purpose limitation controls for secondary use, analytics and product development
• Accountability evidence linked to policies, records and approval decisions

Participants can define additional safeguards for sensitive and vulnerable data subjects.

• Article 9 conditions identified for health, biometric and equality data
• Criminal-offence data processing controlled through legal authority and safeguards
• Children's data designs address age assurance, consent and parental responsibility
• Biometric processing assessments examine necessity, accuracy and discriminatory impact
• Research exemptions tested against safeguards, compatibility and ethics review
• Sensitive-data access restrictions use role profiles and approval records

Participants can create an accurate processing inventory and map personal data flows.

• Record of Processing Activities fields required by Article 30
• Data discovery interviews identifying systems, datasets, owners and transfers
• Information asset registers linked to processing purposes and retention rules
• Data-flow diagrams showing collection points, processors, recipients and jurisdictions
• RACI matrices assigning accountable owners for each processing activity
• Processing inventory quality checks for completeness, duplication and stale records

Participants can create transparent privacy communications and manage valid consent evidence.

• Layered privacy notices structured around Articles 13 and 14
• Just-in-time notices for mobile applications, cookies and location collection
• Plain-language drafting tested against readability and audience comprehension
• Employee monitoring notices addressing proportionality, transparency and consultation
• Cookie banners configured for prior consent and equal refusal choices
• Notice change controls documenting material updates and communication triggers

Participants can manage data subject requests through consistent, documented workflows.

• Data subject request intake, identity verification and case classification
• One-month deadline calculations, extensions and refusal grounds under GDPR
• Search protocols across structured, unstructured, archived and processor-held records
• Redaction methods protecting third-party rights, confidentiality and privileged material
• Rectification, erasure, restriction, objection and portability decision criteria
• Request metrics tracking volumes, timeliness, outcomes and recurring root causes

Participants can set defensible retention and deletion controls for personal data.

• Retention schedules aligned to legal obligations, business need and limitation periods
• Deletion standards for production systems, backups, archives and paper records
• Anonymisation, pseudonymisation and aggregation tests for re-identification risk
• Data minimisation reviews removing unnecessary fields from forms and databases
• Retention exceptions governed through legal holds and documented approvals
• Disposal certificates and deletion logs retained as accountability evidence

Participants can assess privacy risks and contractual requirements for processors.

• Processor due diligence covering security, subprocessor, location and audit evidence
• Article 28 data processing agreement clauses and instructions
• Vendor risk tiers based on data sensitivity, volume and access
• Subprocessor approval workflows, change notices and contractual flow-down obligations
• Audit rights, assurance reports and remediation tracking for processors
• Exit plans covering data return, deletion certification and service transition

Participants can assess and document lawful safeguards for restricted data transfers.

• Transfer mapping identifies exporter, importer, onward recipients and destination countries
• Standard Contractual Clauses selected for controller and processor transfer scenarios
• Transfer impact assessments document laws, access risks and supplementary measures
• Encryption, key management and pseudonymisation as supplementary transfer measures
• Adequacy decisions, derogations and binding corporate rules compared
• Remote access and support arrangements assessed as restricted transfers

Participants can specify privacy requirements for systems, projects and technical controls.

• Privacy-by-design requirements integrated into project initiation and architecture reviews
• ISO 27701 control mapping for privacy information management systems
• Access control design using least privilege, segregation and periodic recertification
• Encryption requirements defined for data at rest, transit and removable media
• Logging, monitoring and audit trails supporting accountability and investigations
• Secure development gates covering test data, code review and release approval

Participants can complete a DPIA and obtain appropriate risk decisions.

• Screening criteria identify processing likely to create high individual risk
• DPIA scope defines purpose, data flows, stakeholders and affected populations
• Necessity and proportionality assessments challenge proposed processing design choices
• Risk scoring evaluates likelihood, severity and vulnerable data-subject groups
• Mitigation plans assign controls, owners, deadlines and residual-risk acceptance
• Prior consultation triggers and documentation requirements for supervisory authorities

Participants can manage breach assessment, notification and accountability decisions.

• Personal data breach triage distinguishes confidentiality, integrity and availability events
• Incident playbooks assign containment, investigation, legal and communications responsibilities
• 72-hour supervisory notification assessments based on risk to individual rights
• Individual notification decisions consider high-risk thresholds and protective advice
• Evidence preservation, timelines and decision logs support post-incident accountability
• Breach response readiness metrics cover escalation speed, notification quality and closure

Participants can apply privacy controls to marketing, profiling and automated decisions.

• Direct marketing permissions, opt-outs and suppression-list controls for each channel
• PECR cookie and electronic marketing requirements alongside GDPR obligations
• Preference centres record channel choices, purposes and withdrawal timestamps
• Profiling disclosures explain logic, consequences and meaningful information rights
• Automated decision safeguards address human review, contestability and discrimination
• Campaign approval workflows prevent unlawful audience selection and message deployment

Participants can assess privacy controls for employee data and workplace monitoring.

• Employee data inventories cover recruitment, performance, payroll and offboarding
• Monitoring assessments test necessity, proportionality, transparency and less intrusive alternatives
• Background checks, health data and equality monitoring require defined safeguards
• Works council and union consultation considerations documented before monitoring changes
• BYOD and remote-work controls separate business data from personal content
• Whistleblowing case handling restricts access, retention and disclosure

Participants can assess privacy risks in digital products, applications and AI uses.

• Privacy engineering patterns apply data minimisation, separation and user control
• Mobile application permissions assessed against stated purposes and collection necessity
• AI training data governance covers provenance, lawful basis and bias testing
• Data sharing APIs enforce authentication, purpose binding and rate limits
• Test-data management replaces live personal data with masked datasets
• Product release checklists capture privacy acceptance criteria and sign-offs

Participants can govern personal data sharing through documented decisions and safeguards.

• Data-sharing agreements define purposes, roles, security and retention commitments
• Joint-controller arrangements allocate transparency, rights handling and contact responsibilities
• Disclosure review boards assess necessity, proportionality and recipient safeguards
• Research data access uses de-identification, secure environments and disclosure controls
• Public-sector sharing considers statutory gateways, confidentiality and records duties
• Data-sharing registers record approvals, datasets, recipients and review dates

Participants can organise a privacy programme with defined ownership, priorities and escalation.

• Privacy operating models define DPO independence, escalation and decision rights
• Annual privacy plans prioritise regulatory duties, risks and control improvements
• Policy hierarchies connect enterprise rules, standards, procedures and technical baselines
• Exception registers capture deviations, compensating controls, expiry and approvals
• Change-management triggers route new products, vendors and markets for review
• Privacy champion networks coordinate local ownership and issue escalation

Participants can test privacy controls and report material risks to management.

• Privacy management system objectives, policies and annual review cycle
• ISO 27701 internal audit evidence, findings and corrective-action records
• Control testing samples access reviews, consent logs and deletion evidence
• Key risk indicators report request timeliness, incidents and overdue assessments
• Training matrices map role-based privacy duties and completion records
• Management reporting escalates material risks, trends and resource decisions

Participants can build, review and present a complete privacy compliance plan for a defined service.

• Processing inventory and data-flow map assembled for a defined service
• Lawful basis, notice and retention decisions justified with documented evidence
• DPIA identifies risks, mitigations, owners and residual-risk acceptance
• Processor, transfer and security controls incorporated into the implementation plan
• DSAR and breach workflows tested against realistic operational scenarios
• Executive presentation communicates priorities, decisions, milestones and assurance measures