GDPR Training | Certified EU GDPR Foundation & Practitioner Course in Worcester

Certified EU GDPR Foundation & Practitioner Course Outline

Module 1: Introduction to the EU GDPR

• The EU GDPR in a Nutshell
• Generate Customer Confidence Across the EU
• Focus of the EU GDPR
• History of European Data Protection
• Why the GDPR Replaced the 1995 Data Protection Directive
• Purpose and Objectives of the Regulation
• Key GDPR Terminology
• What is Personal Information?
• Who Processes Personal Data?
• Lawful Processing of Personal Data

Module 2: GDPR Terminology, DPIAs and Core Techniques

• Key Roles: Controller, Processor, DPO, Data Subject
• Data Set
• Subject Access Request (SAR): Overview
• Data Protection Impact Assessments (DPIA)
• What Triggers a Data Protection Impact Assessment?
• A DPIA is Not Required in the Following Cases
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct a DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by the DPIA
• Privacy by Design and by Default
• Privacy by Design in Practice
• International Transfers: Overview
• Profiling
• Pseudonymisation
• Principles, User Rights and Obligations
• The One-Stop-Shop Mechanism
• EDPB Guidance on Key Concepts

Module 3: Structure and Territorial Scope of the Regulation

• The Parts of the EU GDPR
• Format of the Articles
• Articles and Recitals
• Material Scope of the Regulation
• Territorial Scope Under Article 3
• Application to EU-Established Organisations
• Application to Non-EU Organisations Offering Goods or Services to the EU
• Application to Non-EU Organisations Monitoring Individuals in the EU
• Extraterritorial Effect in Practice
• The Article 27 EU Representative Requirement

Module 4: Principles and Rights

• Introduction to GDPR Principles
• Legality Principle
• How the Lawful Bases Work Together
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• Criminal Offence Data
• Consent
• Transparency Principle
• Fairness Principle
• Rights of Data Subjects
• Purpose Limitation Principle
• Minimisation Principle
• Accuracy Principle
• Storage Limitation Principle
• Integrity & Confidentiality Principle
• Accountability Principle

Module 5: Demonstrating Compliance Across the EU

• International Data Transfers From the EU
• The Article 27 EU Representative Requirement
• National Supervisory Authority Compliance and Enforcement
• Data Breach Notification Requirements Across the EU
• Legal Bases for Processing Personal Data
• Demonstrating Accountability to Multiple National Authorities

Module 6: Incident Response & Data Breaches

• What is a Personal Data Breach?
• Notification Obligations
• What Breaches Do I Need to Notify the Relevant Supervisory Authority About?
• What Information Must Be Provided to the Supervisory Authority?
• How Do I Report a Breach to the Supervisory Authority?
• Notifying Data Subjects
• What Should I Do to Prepare for Breach Reporting?
• Updating Policies and Procedures
• Ways to Minimise the Breach Impact
• Incident Response Protocols
• Compliance Strategies

Module 7: Understanding the Principal Roles

• What the GDPR Makes Businesses Responsible For
• Difference Between a Data Controller and a Data Processor
• How the Roles Split Between Controllers and Processors
• Joint Controllers
• Main Obligations of Data Controllers
• Main Obligations of the Data Processor
• Controller-Processor Contracts: Contractual Implications
• Sub-Processor Appointment
• EU Representative
• Maintaining Records and Cooperating with Supervisory Authorities
• Keeping PII Secure and Confidential
• Data Breach Transparency and Notification
• WARNING: It is Easy to Become a Controller Without Recognising the Situation
• Appointing a DPO – If Necessary
• Transferring Data Outside the EEA

Module 8: Role of the DPO

• When a DPO is Mandatory Under Article 37
• Public Authorities and the DPO Requirement
• Large-Scale, Regular and Systematic Monitoring
• Large-Scale Special Category Data Processing
• Independence and Reporting Line of the DPO
• Tasks and Responsibilities of the DPO
• DPO vs Article 27 EU Representative: Key Differences
• Appointing a DPO: Practical Considerations

Module 9: Subject Access Requests and How to Deal With Them

• Subject Access Requests (SAR)
• Dealing with a SAR
• Handling SARs Across EU Member States
• Statutory Response Timeframes

Module 10: The EU Regulatory Framework

• Introduction to the EU's Data Protection Framework
• The European Data Protection Board (EDPB)
• National Supervisory Authorities (e.g. CNIL, Garante, AEPD, BfDI)
• The One-Stop-Shop Mechanism and Lead Supervisory Authority
• The EU's Role in the Global Data Protection Landscape

Module 11: Key Features

• Key Features of the EU GDPR
• Specific Permission
• Privacy by Design
• Data Portability
• Right to be Forgotten
• Definitive Consent
• Information in Clear, Readable Language
• Limits on the Use of Profiling
• Everyone Follows the Same Law Across the EU
• Adopting Compliance Techniques

Module 12: Data Subject Rights

• Rights of the Data Subject
• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Class Exercise
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling

Module 13: Subject Access Requests

• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject's Identity
• Class Exercise
• Scope
• Electronic Records
• Non-Electronic Records
• SARs Involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs

Module 14: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• The EDPB Guidance Toolkit
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from National Supervisory Authorities
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• A Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should Go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• Examples of Record Keeping
• Key Points When Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis Can Be Used for Processing Marketing PII?

Module 15: International Data Transfers

• Adequacy Decisions Under Article 45
• Adequate Ways to Safeguard Transfers of PII
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (BCRs)
• Conducting a Transfer Risk Assessment
• International Data Transfers & Schrems II
• The EU–US Data Privacy Framework
• Ongoing Legal Challenges to the EU–US Data Privacy Framework

Module 16: Protecting Data

• Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team

Module 17: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct a DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by the DPIA

Module 18: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology

Module 19: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• Myths of Cloud
• Cloud Challenges
• Controller-Processor Contract
• Checklist
• Data Controller – Summary
• Data Processor – Summary

Module 20: Data Protection Policies and Programme Management

• Purpose and Structure of a Data Protection Policy
• Organising the Data Protection Function
• Roles and Responsibilities Within a Privacy Programme
• Building a Data Protection Governance Framework
• Awareness and Training Programmes
• Measuring Compliance Maturity
• Maintaining a Compliance Roadmap
• Reviewing and Updating Policies

Module 21: Engaging with Supervisory Authorities and the One-Stop-Shop

• Role of the Lead Supervisory Authority
• The One-Stop-Shop Mechanism in Practice
• Cross-Border Case Cooperation Between Supervisory Authorities
• Supervisory Authority Powers
• Corrective Measures Available to Supervisory Authorities
• What to Expect During a Regulatory Investigation
• Responding to Supervisory Authority Enquiries
• The EDPB's Consistency Mechanism

Module 22: Applying EU GDPR in Practice

• Identifying Personal Data and Processing Activities
• Determining Controller and Processor Roles
• Applying GDPR Principles to Everyday Processing
• Creating and Maintaining Privacy Notices
• Managing Data Retention and Secure Deletion
• Managing Third Parties and Data Processors
• Practical GDPR Compliance Checklist

Module 23: Common Data Security Failures, Consequences and Lessons to be Learnt

• Common Data Security Failures
• Consequences of Non-Compliance
• Notable EU GDPR Enforcement Actions and Fines
• How Fine Levels Are Determined Under Article 83
• Lessons Learned from Real Cases

Who Should Attend this Certified EU GDPR Foundation & Practitioner Course?

This General Data Protection Regulation Foundation and Practitioner Training Course is designed for professionals who handle, manage, or oversee personal data and are responsible for ensuring compliance with data protection regulations. It is particularly beneficial for:

• Data Protection Officer (DPO)
• Compliance Manager
• Information Security Analyst
• Privacy Consultant
• Legal and Regulatory Advisor
• IT Risk and Governance Specialist
• Data Governance Manager

Prerequisites for the Certified EU GDPR Foundation & Practitioner Course

There are no formal prerequisites to attend this General Data Protection Regulation Foundation and Practitioner Training Course. However, a basic understanding of data protection or information governance can be beneficial.

Certified EU GDPR Foundation & Practitioner Course Overview

Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course introduces GDPR principles and data protection compliance. It explains personal data management and regulatory requirements. The course builds practical GDPR knowledge.

Delegates develop skills in DPIAs, lawful processing, and breach management. The course strengthens understanding of GDPR compliance and data governance. These skills support effective data protection practices.

This 4-Day course by The Knowledge Academy enables delegates to apply GDPR requirements confidently. Delegates support compliance activities and manage personal data responsibly. These skills strengthen organisational privacy practices.

Certified EU GDPR Foundation & Practitioner Course Objectives

• To understand GDPR principles and legal requirements
• To explain the responsibilities of data controllers and processors
• To conduct Data Protection Impact Assessments
• To apply lawful processing and data subject rights
• To manage personal data breaches and compliance activities
• To support GDPR implementation across organisations

Upon completing this Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course, delegates will be able to apply GDPR requirements, support compliance activities, and contribute to effective data protection within their organisations.

What’s included in this Certified EU GDPR Foundation & Practitioner Course

• Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Examination
• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack

GDPR Foundation Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Foundation, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 45 
• Total Marks: 45 Marks 
• Pass Mark: 65%, or 29/45 Marks 
• Duration: 60 Minutes 
• Open Book/ Closed Book: Closed Book