Certified General Data Protection Regulation (GDPR) Practitioner Training in Virtual

Certified General Data Protection Regulation (GDPR) Practitioner Course Outline

Module 1: Data Subject Rights

• Rights of the Data Subject
• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Class Exercise
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling

Module 2: Subject Access Requests

• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject's Identity
• Class Exercise
• Scope
• Electronic Records
• Non-Electronic Records
• SARs involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs

Module 3: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• UK ICO has a Tool
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from the ICO
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• ICOs View of a Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• ICOs Examples of Record Keeping
• Key Points when Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis can be used for Processing Marketing PII?

Module 4: Third Country Data Transfers

• Adequacy
• Adequate Ways to Safeguard Transfers of PII
• UK-EU Data Adequacy
• UK Mechanisms for International Data Transfers
• International Data Transfers & Schrems II
• EU-US/UK-US Data Bridge Implications

Module 5: Protecting Data

• Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team

Module 6: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by The DPIA

Module 7: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology

Module 8: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• Myths of Cloud
• Cloud Challenges
• Controller-Processor Contract
• Checklist
• Data Controller – Summary
• Data Processor - Summary

Module 9: Practical Implications: GDPR

• Legal Requirements of the GDPR
• Incident Response Protocols
• Compliance Strategies

Module 10: Legal Requirements of the GDPR

• Legal Requirements
  • Lawful, Fair, and Transparent Processing
  • Limitation of Purpose, Data and Storage
  • Data Subject Rights
  • Consent
  • Personal Data Breaches
  • Privacy by Design
  • Data Protection Impact Assessment
  • Data Transfers
  • Data Protection Officer
  • Awareness and Training

Module 11: Privacy Principles in GDPR

• Privacy Principles in the GDPR
  • Lawfulness, Fairness, and Transparency
  • Purpose Limitation is the Second Principle
  • Data Minimisation
  • Accuracy is the Fourth Principle
  • Fifth Principle is the Storage Limitation
  • Sixth Principle of Integrity and Confidentiality

Module 12: Common Data Security Failures, Consequences, and Lessons to be Learnt

• Common Data Security Failures
• Consequences
• Lesson Learned

GDPR Practitioner Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Practitioner, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 30 
• Total Marks: 30 Marks 
• Pass Mark: 57%, or 17/30 Marks 
• Duration: 90 Minutes
• Open Book/ Closed Book: Closed Book

Who Should Attend this General Data Protection Regulation (GDPR) Practitioner Course?

This GDPR Practitioner Course is suitable for professionals responsible for handling personal data, supporting data protection activities, or maintaining GDPR compliance within an organisation. It is particularly beneficial for:

• Data Protection Officers
• Compliance Officers
• Information Security Professionals
• Risk and Governance Professionals
• Legal and Privacy Professionals
• IT and Data Management Professionals

Prerequisites for the General Data Protection Regulation (GDPR) Practitioner Course

There are no formal prerequisites for attending this GDPR Practitioner Course. However, a basic understanding of GDPR principles and data protection concepts can be beneficial for following the practical topics covered during the training.

General Data Protection Regulation (GDPR) Practitioner Course Overview

Certified General Data Protection Regulation (GDPR) Practitioner provides practical knowledge of applying data protection requirements within organisational environments. It helps professionals understand how GDPR responsibilities can be managed effectively while supporting lawful, secure, and accountable handling of personal data.

Delegates will develop practical skills for interpreting GDPR requirements, assessing data protection risks, supporting compliance activities, and making informed decisions when handling personal data. The course also strengthens their ability to respond appropriately to privacy-related responsibilities within the workplace.

This 2-Day course offered by The Knowledge Academy enables delegates to apply GDPR principles confidently in professional settings. By the end of the training, they will be better prepared to support organisational compliance, manage data protection risks, and contribute to effective privacy practices.

General Data Protection Regulation (GDPR) Practitioner Course Objectives

• To understand how GDPR requirements apply within organisational environments
• To manage data subject rights and related requests effectively
• To apply lawful processing requirements when handling personal data
• To assess data protection risks and support suitable mitigation measures
• To manage responsibilities involving third parties and international data transfers
• To strengthen organisational compliance through practical data protection practices

Learning Outcomes of this General Data Protection Regulation (GDPR) Practitioner Course

Upon completion of this course, delegates will be able to apply GDPR requirements more confidently within organisational settings. They will be better prepared to manage data subject rights, support lawful processing, assess privacy risks, handle third-party and data transfer responsibilities, and contribute to effective data protection and compliance practices.

What’s Included in this General Data Protection Regulation (GDPR) Practitioner Course?

• Certified General Data Protection Regulation (GDPR) Practitioner Examination  
• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack