Data Protection Act Training (DPA 2018) - India

Data Protection Act (DPA 2018) Course Outline

Module 1: Six Data Protection Principles

• Introducing Data Protection
• Six Data Protection Principles

Module 2: DPA’s Alignment with GDPR

• What are the Penalties?
• What can We Get an Administrative Fine for?
• What Influences the Size of an Administrative Fine?
• Staff Member Responsibilities
• Personal Information
• Sensitive Data

Module 3: Conditions for Sensitive Processing

• Judicial and Statutory Purposes
• Safeguarding of children and individuals at risk
• Individual’s vital interests
• Archiving
• Preventing Fraud

Module 4: Safeguards for Sensitive Processing

• Information Commissioner's Office (ICO)
• Law Enforcement

Module 5: Individual Rights Under the DPA 2018

• Right to Be Informed

• Right to Be Informed: When Should Information Be Provided?
• Best Practice Guidance: Selling/Sharing PII
• Best Practice Guidance: Purchasing PII
• Best Practice Guidance: Publicly Derived PII
• Best Practice Guidance: Artificial Intelligence (AI)

• Right of Access
• Right to Rectification
• Right to Erasure (The Right to Be Forgotten)

• When Can I Refuse to Comply with a Request for Erasure?
• Erasing Children's Data

• Right to Restrict Processing

• When Processing Should be Restricted
• Other Issues about Restricting Processing

• Right to Data Portability
• Right to Object

• Complying with the Right to Object
• Rejecting the Right to Object
• Right to Object: Processing for Direct Marketing Purposes
• Right to Object: Processing for Research Purposes
• Rights Related to Automated Decision Making and Profiling (1)
• Rights Related to Automated Decision Making and Profiling (2)
• Rights Related to Automated Decision Making and Profiling (3)
• When does the Right not apply?

Module 6: Documenting and Logging Data

• Documenting and Logging Data
• What Must Be Recorded?
• Maintaining Records

Module 7: Categorizing Individuals and Retaining Personal Data

• What is Personal Information?
• Who Has PII?
• Who Processes PII?
• Demonstrating Compliance
• Protecting PII

Module 8: Appointing a Data Protection Officer

• Role of a Data Protection Officer
• Involvement of the DPO
• Main Responsibilities of the DPO
• Working Environment for the DPO
• Must We Have a DPO?

Module 9: Reporting and Responding to Data Breaches

• Overview: Incident Response Plan
• Developing an Incident Response Plan
• Preparation
• Identification
• Containment
• Eradication
• 5 Whys
• How to Complete The 5 Whys
• Fishbone Diagram
• Recovery
• Lessons Learned
• Incidence Response: DPOs role

Module 10: International Data Transfers and Relevant Authorities

• External Transfers
• Cross Border Transfers
• Transfer Mechanisms
• Derogations
• Adequacy
• Adequate Ways to Safeguard Transfers of PII
• One-Off or Infrequent Transfers
• Transferring PII Between EEA Members
• Adequate Countries Outside of the EEA
• EU-US Privacy Shield
• Privacy Shield Overview
• Privacy Shield: Mechanics
• Model Clauses
• Public Authority Agreements