Certified EU GDPR Practitioner Course in Gibraltar

Certified EU GDPR Practitioner Course Outline

Module 1: Data Subject Rights

• Rights of the Data Subject
• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Class Exercise
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling

Module 2: Subject Access Requests

• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject's Identity
• Class Exercise
• Scope
• Electronic Records
• Non-Electronic Records
• SARs Involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs

Module 3: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• The EDPB Guidance Toolkit
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from National Supervisory Authorities
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• A Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should Go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• Examples of Record Keeping
• Key Points When Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis Can Be Used for Processing Marketing PII?

Module 4: International Data Transfers

• Adequacy Decisions Under Article 45
• Adequate Ways to Safeguard Transfers of PII
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (BCRs)
• Conducting a Transfer Risk Assessment
• International Data Transfers & Schrems II
• The EU–US Data Privacy Framework
• Ongoing Legal Challenges to the EU–US Data Privacy Framework

Module 5: Protecting Data

• Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team

Module 6: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct a DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by the DPIA

Module 7: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology

Module 8: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• Myths of Cloud
• Cloud Challenges
• Controller-Processor Contract
• Checklist
• Data Controller – Summary
• Data Processor – Summary

Module 9: Data Protection Policies and Programme Management

• Purpose and Structure of a Data Protection Policy
• Organising the Data Protection Function
• Roles and Responsibilities Within a Privacy Programme
• Building a Data Protection Governance Framework
• Awareness and Training Programmes
• Measuring Compliance Maturity
• Maintaining a Compliance Roadmap
• Reviewing and Updating Policies

Module 10: Engaging with Supervisory Authorities and the One-Stop-Shop

• Role of the Lead Supervisory Authority
• The One-Stop-Shop Mechanism in Practice
• Cross-Border Case Cooperation Between Supervisory Authorities
• Supervisory Authority Powers
• Corrective Measures Available to Supervisory Authorities
• What to Expect During a Regulatory Investigation
• Responding to Supervisory Authority Enquiries
• The EDPB's Consistency Mechanism

Module 11: Applying EU GDPR in Practice

• Identifying Personal Data and Processing Activities
• Determining Controller and Processor Roles
• Applying GDPR Principles to Everyday Processing
• Creating and Maintaining Privacy Notices
• Managing Data Retention and Secure Deletion
• Managing Third Parties and Data Processors
• Practical GDPR Compliance Checklist

Module 12: Common Data Security Failures, Consequences and Lessons to be Learnt

• Common Data Security Failures
• Consequences of Non-Compliance
• Notable EU GDPR Enforcement Actions and Fines
• How Fine Levels Are Determined Under Article 83
• Lessons Learned from Real Cases

GDPR Practitioner Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Practitioner, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 30 
• Total Marks: 30 Marks 
• Pass Mark: 57%, or 17/30 Marks 
• Duration: 90 Minutes
• Open Book/ Closed Book: Closed Book

Who Should Attend this Certified EU GDPR Practitioner Course?

The Certified General Data Protection Regulation (GDPR) Practitioner Course is ideal for professionals responsible for implementing and managing GDPR compliance. It helps strengthen practical knowledge of data protection and privacy. This course can benefit the following professionals:

• Data Protection Officers
• IT Security Managers
• Legal Counsel & Compliance Lawyers
• Senior HR Managers
• Risk and Compliance Managers
• Chief Information Officers (CIOs)
• Digital Marketing Directors
• Database and System Administrators

Prerequisites for the Certified EU GDPR Practitioner Course

There are no formal prerequisites required for the Certified General Data Protection Regulation (GDPR) Practitioner Course. However, a basic understanding of GDPR principles and data protection concepts can be beneficial.

Certified EU GDPR Practitioner Course Overview

Certified General Data Protection Regulation (GDPR) Practitioner Course introduces delegates to the practical application of GDPR requirements and data protection compliance. It explains data subject rights, lawful processing, and privacy obligations. The course builds practical GDPR implementation skills.

Delegates develop skills in Subject Access Requests, Data Protection Impact Assessments, and breach management. The course strengthens understanding of lawful processing and data governance. These skills support effective GDPR compliance.

This 2-Day course by The Knowledge Academy enables delegates to apply GDPR requirements confidently in the workplace. Delegates manage compliance activities, support data protection programmes, and respond to data subject requests. These skills strengthen organisational privacy practices.

Certified EU GDPR Practitioner Course Objectives

• To understand data subject rights and Subject Access Requests
• To apply lawful processing requirements under GDPR
• To conduct Data Protection Impact Assessments
• To manage data breaches and incident response activities
• To apply GDPR requirements for international data transfers
• To support GDPR compliance within organisations

Upon completing this Certified General Data Protection Regulation (GDPR) Practitioner Course, delegates will be able to apply GDPR requirements, manage compliance activities, and support data protection programmes. They will also contribute to effective privacy management within their organisations.

What’s Included in this Certified EU GDPR Practitioner Course?

• Certified General Data Protection Regulation (GDPR) Practitioner Examination
• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack