GDPR Training | GDPR Foundation And Practitioner in Gothenburg

Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course Outline

Module 1: Introduction to GDPR

• GDPR in a Nutshell
• Generate Customer Confidence
• Focus of GDPR
• What is Personal Information?
• Who has Personal Data?
• Lawful Processing of Personal Data

Module 2: GDPR Terminology and Techniques

• Key Roles
• Data Set
• Subject Access Request (SAR)
• Data Protection Impact Assessments (DPIA)
• What Triggers a Data Protection Impact Assessment?
• A DPIA is Not Required in the Following Cases
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified By the DPIA
• Privacy by Design and Default
• Privacy by Design
• External Transfers
• Profiling
• Pseudonymisation
• Principles, User Rights, Obligations
• One Stop Shop

Module 3: Structure of the Regulation

• The Parts of the GDPR
• Format of the Articles
• Articles

Module 4: Principles and Rights

• Introduction
• Legality Principle
• How the Permissions Work Together
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• Criminal Offence Data
• Consent
• Transparency Principle
• Fairness Principle
• Rights of Data Subjects
• Purpose Limitation Principle
• Minimisation Principle
• Accuracy Principle
• Storage Limitation Principle
• Integrity & Confidentiality Principle
• Accountability Principle

Module 5: Demonstrating Compliance

• UK Data Transfers Post-Brexit
• UK Representative Requirements
• ICO Compliance and Enforcement
• Data Breach Notification in the UK
• Legal Bases for Processing Personal Data

Module 6: Incident Response & Data Breaches

• What is a Personal Data Breach?
• Notification Obligations
• What Breaches Do I Need to Notify the Relevant Supervisory Authority About?
• What Information Must Be Provided to the SA?
• How Do I Report a Breach to the SA?
• Notifying Data Subjects
• What Should I do to Prepare for Breach Reporting?
• Updating Policies and Procedures
• Ways to Minimise the Breach Impact
• Incident Response Protocols
• Compliance Strategies

Module 7: Understanding the Principle Roles

• What the GDPR Makes Businesses Responsible For
• Difference Between a Data Controller and a Data Processor
• How the Roles Split Between Controllers and Processors
• Joint Controllers
• Main Obligations of Data Controllers
• Main Obligations of the Data Processor
• Controller-Processor Contracts: Contractual Implications
• Sub-Processor Appointment
• EU Representative
• Maintaining Records and Cooperating with Supervisory Authorities
• Keeping PII Secure and Confidential
• Data Breach Transparency and Notification
• WARNING: It is Easy to Become a Controller Without Recognising the Situation
• Appointing a DPO – If Necessary
• Transferring Data Outside the EEA

Module 8: Role of the DPO

• UK GDPR: Roles of Data Controllers vs. Data Processors

Module 9: Subject Access Requests and How to Deal with them?

• Subject Access Requests (SAR)
• Dealing with SAR
• Handling SARs in the UK

Module 10: UK Implementation

• Introduction to UK GDPR
• Data Protection Act 2018
• Role of the Information Commissioner's Office (ICO)
• Cross-Border Data Transfers Post-Brexit
• UK's Role in the Global Data Protection Landscape

Module 11: Key Features

• Key Features of GDPR
  • Specific Permission
  • Privacy by Design
  • Data Portability
  • Right to be Forgotten
  • Definitive Consent
  • Information in Clear Readable Language
  • Limits on the Use of Profiling
  • Everyone Follows the Same Law
  • Adopting Techniques

Module 12: Data Subject Rights

• Rights of the Data Subject
• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Class Exercise
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling

Module 13: Subject Access Requests

• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject's Identity
• Class Exercise
• Scope
• Electronic Records
• Non-Electronic Records
• SARs involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs

Module 14: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• UK ICO has a Tool
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from the ICO
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• ICOs View of a Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• ICOs Examples of Record Keeping
• Key Points when Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis can be used for Processing Marketing PII?

Module 15: Third Country Data Transfers

• Adequacy
• Adequate Ways to Safeguard Transfers of PII
• UK-EU Data Adequacy
• UK Mechanisms for International Data Transfers
• International Data Transfers & Schrems II
• EU-US/UK-US Data Bridge Implications

Module 16: Protecting Data

• Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team

Module 17: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by The DPIA

Module 18: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology

Module 19: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• Myths of Cloud
• Cloud Challenges
• Controller-Processor Contract
• Checklist
• Data Controller – Summary
• Data Processor - Summary

Module 20: Practical Implications: GDPR

• Legal Requirements of the GDPR
• Incident Response Protocols
• Compliance Strategies

Module 21: Legal Requirements of the GDPR

• Legal Requirements
  • Lawful, Fair, and Transparent Processing
  • Limitation of Purpose, Data and Storage
  • Data Subject Rights
  • Consent
  • Personal Data Breaches
  • Privacy by Design
  • Data Protection Impact Assessment
  • Data Transfers
  • Data Protection Officer
  • Awareness and Training

Module 22: Privacy Principles in GDPR

• Privacy Principles in the GDPR
  • Lawfulness, Fairness, and Transparency
  • Purpose Limitation is the Second Principle
  • Data Minimisation
  • Accuracy is the Fourth Principle
  • Fifth Principle is the Storage Limitation
  • Sixth Principle of Integrity and Confidentiality

Module 23: Common Data Security Failures, Consequences, and Lessons to be Learnt

• Common Data Security Failures
• Consequences
• Lesson Learned

General Data Protection Regulation (GDPR) Foundation & Practitioner Exams

To achieve the Certified General Data Protection Regulation (GDPR) Foundation, candidates will need to sit for an examination. The exam format is as follows: 

GDPR Foundation Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Foundation, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 45 
• Total Marks: 45 Marks 
• Pass Mark: 65%, or 29/45 Marks 
• Duration: 60 Minutes
• Open Book/ Closed Book: Closed Book

GDPR Practitioner Exam Information

To achieve the Certified General Data Protection Regulation (GDPR) Practitioner, candidates will need to sit for an examination. The exam format is as follows: 

• Question Type: Multiple Choice 
• Total Questions: 30 
• Total Marks: 30 Marks 
• Pass Mark: 57%, or 17/30 Marks 
• Duration: 90 Minutes
• Open Book/ Closed Book: Closed Book

Who Should Attend this Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course?

This course is suitable for professionals who handle personal data or support data protection and GDPR compliance activities within an organisation. It is particularly beneficial for individuals looking to develop both foundational knowledge and practical GDPR skills, including:

• Data Protection Officers
• Compliance Officers
• Data Protection Managers
• Privacy Professionals
• Information Security Professionals
• Risk Managers
• Data Controllers and Processors
• Legal and Compliance Professionals

Prerequisites for the Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course

There are no formal prerequisites to attend this Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course. However, a basic understanding of data protection concepts will be beneficial for delegates.
 

Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course Overview

The Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course provides delegates with a structured understanding of GDPR principles, requirements, and responsibilities. It covers how personal data should be processed, protected, and managed in line with data protection requirements.

Delegates will develop skills in handling data subject rights, managing Subject Access Requests (SARs), conducting DPIAs, and responding to personal data breaches. They will also build knowledge of lawful processing, data transfers, and organisational data protection practices.

This 4-Day course by The Knowledge Academy enables delegates to apply GDPR requirements within organisational settings. They will be better equipped to manage personal data, work with third parties, respond to privacy-related requirements, and support effective GDPR compliance.

Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course Objectives

• To understand the fundamental principles and requirements of GDPR
• To understand key responsibilities for handling and protecting personal data
• To manage data subject rights and Subject Access Requests effectively
• To conduct Data Protection Impact Assessments and address identified risks
• To understand lawful processing and data transfer requirements
• To apply appropriate data protection practices within an organisation

Learning Outcomes of this Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course

Upon completing this course, delegates will have a structured understanding of GDPR and its practical application. They will be better equipped to manage personal data, respond to data protection requirements, and support GDPR compliance activities within their organisation.

What’s Included in this Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Course?

• Certified General Data Protection Regulation (GDPR) Foundation and Practitioner Examination
• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack