Certified General Data Protection Regulation (GDPR) Practitioner - Hong Kong

Certified General Data Protection Regulation (GDPR) Practitioner Course Outline

Module 1: Data Subject Rights

• Rights of the Data Subject
• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Class Exercise
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling

Module 2: Subject Access Requests

• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject’s Identity
• Class Exercise
• Scope
• Electronic Records
• Non-Electronic Records
• SARs involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs

Module 3: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• UK ICO has a Tool
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from the ICO
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• ICOs View of a Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• ICOs Examples of Record Keeping
• Key Points when Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis can be used for Processing Marketing PII?

Module 4: Third Country Data Transfers

• Adequacy
• Adequate Ways to Safeguard Transfers of PII
• UK-EU Data Adequacy
• UK Mechanisms for International Data Transfers
• International Data Transfers & Schrems II
• EU-US/UK-US Data Bridge Implications

Module 5: Protecting Data

• Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team

Module 6: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by The DPIA

Module 7: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology

Module 8: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• Myths of Cloud
• Cloud Challenges
• Controller-Processor Contract
• Checklist
• Data Controller – Summary
• Data Processor - Summary

Module 9: Practical Implications: GDPR

• Legal Requirements of the GDPR
• Incident Response Protocols
• Compliance Strategies

Module 10: Legal Requirements of the GDPR

• Legal Requirements
  • Lawful, Fair, and Transparent Processing
  • Limitation of Purpose, Data and Storage
  • Data Subject Rights
  • Consent
  • Personal Data Breaches
  • Privacy by Design
  • Data Protection Impact Assessment 
  • Data Transfers
  • Data Protection Officer
  • Awareness and Training

Module 11: Privacy Principles in GDPR

• Privacy Principles in the GDPR
  • Lawfulness, Fairness, and Transparency
  • Purpose Limitation is the Second Principle
  • Data Minimisation
  • Accuracy is the Fourth Principle
  • Fifth Principle is the Storage Limitation
  • Sixth Principle of Integrity and Confidentiality

Module 12: Common Data Security Failures, Consequences, and Lessons to be Learnt

• Common Data Security Failures
• Consequences
• Lesson Learned

Who Should Attend this Certified General Data Protection Regulation (GDPR) Practitioner Course?

The Certified General Data Protection Regulation (GDPR) Practitioner Course is ideal for professionals responsible for implementing and managing GDPR compliance. It helps strengthen practical knowledge of data protection and privacy. This course can benefit the following professionals:

• Data Protection Officers
• IT Security Managers
• Legal Counsel & Compliance Lawyers
• Senior HR Managers
• Risk and Compliance Managers
• Chief Information Officers (CIOs)
• Digital Marketing Directors
• Database and System Administrators

Prerequisites for the Certified EU General Data Protection Regulation (EU GDPR) Practitioner Course

There are no formal prerequisites required for the Certified EU General Data Protection Regulation (EU GDPR) Practitioner Course. However, a basic understanding of GDPR principles and data protection concepts can be beneficial.

Certified General Data Protection Regulation (GDPR) Practitioner Course Overview

Certified General Data Protection Regulation (GDPR) Practitioner Course introduces delegates to the practical application of GDPR requirements and data protection compliance. It explains data subject rights, lawful processing, and privacy obligations. The course builds practical GDPR implementation skills.

Delegates develop skills in Subject Access Requests, Data Protection Impact Assessments, and breach management. The course strengthens understanding of lawful processing and data governance. These skills support effective GDPR compliance.

This 2-Day course by The Knowledge Academy enables delegates to apply GDPR requirements confidently in the workplace. Delegates manage compliance activities, support data protection programmes, and respond to data subject requests. These skills strengthen organisational privacy practices.

Certified GDPR Practitioner Course Objectives

• To understand data subject rights and Subject Access Requests
• To apply lawful processing requirements under GDPR
• To conduct Data Protection Impact Assessments
• To manage data breaches and incident response activities
• To apply GDPR requirements for international data transfers
• To support GDPR compliance within organisations

Upon completing this Certified General Data Protection Regulation (GDPR) Practitioner Course, delegates will be able to apply GDPR requirements, manage compliance activities, and support data protection programmes. They will also contribute to effective privacy management within their organisations.

What’s Included in this Certified General Data Protection Regulation (GDPR) Practitioner Course?

• Certified General Data Protection Regulation (GDPR) Practitioner Examination
• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack

GDPR Practitioner Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Practitioner, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 30 
• Total Marks: 30 Marks 
• Pass Mark: 57%, or 17/30 Marks 
• Duration: 90 Minutes
• Open Book/ Closed Book: Closed Book