Certified EU General Data Protection Regulation (EU GDPR) Foundation and Practitioner

This Certified EU GDPR Foundation and Practitioner Training provides a complete introduction to GDPR principles, legal duties, and practical compliance. It equips professionals to manage personal data responsibly, reduce organisational risks, and support strong privacy governance. Ideal for anyone involved in data protection, compliance, IT security, or information management. 
 

Learning Outcomes 

• Understand essential GDPR principles and regulatory requirements. 

• Identify responsibilities of data controllers, processors, and stakeholders. 

• Apply lawful processing methods and manage data subject rights. 

• Conduct effective Data Protection Impact Assessments. 

• Implement appropriate breach reporting and incident response processes. 

• Strengthen organisational compliance through structured privacy governance. 
   

Prerequisites for EU GDPR Foundation and Practitioner Training 
 

There are no formal prerequisites to attend this combined GDPR Foundation and Practitioner certification course. Delegates from all professional backgrounds can participate. A basic awareness of data handling or organisational compliance can be helpful but is not essential. 
 

Who Should Attend EU GDPR Foundation and Practitioner Training? 
 

This course is ideal for professionals involved in data protection, compliance, or information governance, including: 

• Data Protection Officers 

• IT Security Professionals 

• Compliance Officers 

• Privacy and Legal Professionals 

• Risk and Governance Managers 

• IT Consultants 
   

Course Duration 
 

This combined GDPR Foundation and Practitioner training is delivered over 4 days, covering essential concepts, practical applications, and exam preparation to help you successfully achieve both certifications. 

Module 1: Introduction to GDPR

• GDPR in a Nutshell
• Generate Customer Confidence
• Focus of GDPR
• What is Personal Information?
• Who has PII?
• Lawful Processing of Personal Data
   

Module 2: GDPR Terminology and Techniques

• Key Roles
• Data Set
• Subject Access Request (SAR)
• Data Protection Impact Assessments (DPIA)
• What Triggers a Data Protection Impact Assessment?
• A DPIA is Not Required in the Following Cases
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified By the DPIA
• Privacy by Design and Default
• External Transfers
• Profiling
• Pseudonymisation
• Principles, User Rights, Obligations
• One Stop Shop
   

Module 3: Structure of the Regulation

• The Parts of the GDPR
• Format of the Articles
• Quick Quiz
   

Module 4: Principles and Rights

• Introduction
• Legality Principle
• How the Permissions Work Together
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• Criminal Offence Data
• Consent
• Transparency Principle
• Fairness Principle
• Rights of Data Subjects
• Purpose Limitation Principle
• Minimisation Principle
• Accuracy Principle
• Storage Limitation Principle
• Integrity & Confidentiality Principle
   

Module 5: Demonstrating Compliance

• Demonstrating Compliance with the GDPR
• Impact of Compliance Failure
• Administrative Fines
• What Influences the Size of an Administrative Fine?
• Joint Controllers
• Processor Liability Under GDPR
• Demonstrating Compliance
• Protecting PII is Only Half the Job!
• What must be Recorded?
• Additional Ways of Demonstrating Compliance
• Demonstrating a Robust Process
• PIMS (Personal Information Management System)
• Cyber Essentials
• ISO 27017 Code of Practice for Information Security Controls
• Risk Management
   

Module 6: Incident Response & Data Breaches

• What is a Personal Data Breach?
• Notification Obligations
• What Breaches Do I Need to Notify the Relevant Supervisory Authority About?
• What Information Must Be Provided to the SA?
• How Do I Report a Breach to the SA?
• Notifying Data Subjects
• What Should I do to Prepare for Breach Reporting?
• Updating Policies and Procedures
• Breach Reporting and Responses
• Ways to Minimise the Breach Impact
   

Module 7: Understanding the Principle Roles

• What the GDPR Makes Businesses Responsible For?
• Difference Between a Data Controller and a Data Processor
• How the Roles Split
• Controllers and Processors
• Controllers: Key Points
• Main Obligations of Data Controllers
• Demonstrate Compliance
• Joint Controllers
• EU Representative
• Controller-Processor Contract
• Maintain Records
• Keeping Records for Small Businesses
• Cooperation with Supervisory Authorities
• Keeping PII Secure
• Data Breach Transparency
• Role of the Data Processor
• Controller-Processor Contract
• Main Obligations of the Processor
• Perform Only the Data Processing Defined by the Data Controller
• Update the Data Controller
• Sub-Processor Appointment
• Keep PII Confidential
• Maintaining Records
• Cooperate With Supervisory Authorities
• Security
• Notify Breaches
• Appoint a DPO – If Necessary
• Transferring Data Outside the EU
• Note: If You Have Staff You Will be a Data Controller
• Data Processors Key Points
   

Module 8: The Role of the DPO

• The Role of a Data Protection Officer
• Involvement of the DPO
• Main Responsibilities of the DPO
• Working Environment for the DPO
• Must We Have A DPO?
• Public Body
• What does Large Scale mean?
• Systematic Monitoring
• Who Can Perform the Role of DPO?
• Skills Required
• Training and Awareness
• Monitoring Compliance
• Data Protection Impact Assessments (DPIAs)
• Risk-Based Approach
• Business Support for the DPO
• DPO Independence
• DPO – Conflict of Interest

Module 9: UK Implementation

• Key Differences Between the Data Protection Act and the GDPR
• Definition of Controller
• Highlights from the Data Protection Bill
• Health, Social Work, Education, and Child Abuse
• Age of Consent
• Exemptions for Freedom of Expression
• Research and Statistics
• Archiving in the Public Interest
   

Module 10: Key Features

• Key Features of GDPR
• Specific Permission
• Privacy by Design
• Data Portability
• Right to be Forgotten
• Definitive Consent
• Information in Clear Readable Language
• Limits on the Use of Profiling
• Everyone Follows the Same Law
• Adopting Techniques
   

Module 11: Subject Access Requests and How to Deal with them?

• Subject Access Requests (SAR)
• Dealing with SAR
• Recognise the Request
• Understand the Time Limitations
• Dealing with Fees and Excessive Requests
• Identify, Search, and Gather the Requested Data
• What Information to Withhold?
• Developing and Sending a Response
   

Module 12: Data Subject Rights

• Must I Always Obey a Right?
• Rights and Third Parties
• Requests Made on Behalf of Other Data Subjects
• Guidelines for Children's Maturity
• Responding to a Rights Request
• What is a Month?
• Rights Request Flow Chart
• Right to Be Informed
• Right of Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Rights Related to Automated Decision Making and Profiling
   

Module 13: Subject Access Requests

• Provenance
• Overview: SARs
• A SAR is an Activity, not a Title
• How Can a SAR be Submitted?
• What Information Should the Response to a SAR Contain?
• Additional Information
• Replying to a SAR
• Confirming a Data Subject’s Identity
• Scope
• Electronic Records
• Non-Electronic Records
• SARs involving 3rd Party PII
• Fees
• Refusing a Subject Access Request
• Access Requests from Employees
• Credit Reference Agencies
• Best Practice for SARs
   

Module 14: Lawful Processing

• Lawful Processing: A Reminder
• User Rights Change Depending on the Justification
• Lawfulness of Processing Conditions
• Lawfulness for Special Categories of Data
• UK ICO has a Tool
• Consent
• Other Key Points about Consent
• Affirmative Action & Explicit Consent
• What is not Affirmative Action?
• Examples of Affirmative Action from the ICO
• Explicit Consent
• The Explicit Statement
• Obtaining Explicit Consent
• ICOs View of a Poor Form of Explicit Consent
• Obtaining Consent for Scientific Research Purposes
• Getting Consent
• What Should go into the Consent Request?
• Consent Granularity
• Right to Withdraw Consent
• Children
• Consent Records
• ICOs Examples of Record Keeping
• Key Points when Establishing Consent
• Legitimate Interests
• Getting the Balance Right
• Consent or Legitimate Interest?
• What Lawful Basis can be used for Processing Marketing PII?
   

Module 15: Third Country Data Transfers

• Cross Border Transfers
• Transfer Mechanisms
• Derogations
• Adequacy
• Adequate Ways to Safeguard Transfers of PII
• Consent
• One-Off or Infrequent Transfers
• Who is Responsible?
• Transferring PII Between EEA Members
• Adequate Countries Outside of the EEA
• Binding Corporate Rules (BCR)
• What a BCR Must Cover
• Authorisation for BCRs
• EU-US Privacy Shield
• Privacy Shield Overview
• Privacy Shield: Mechanics
• Model Clauses
• Public Authority Agreements
   

Module 16: Introduction to Protecting Personal Data

• The Need to Secure
• What is Appropriate?
• Protecting PII – 3 Key Areas
• Coverage
• Defensive Design
• Single Point of Failure (SPOF)
• Incident Response
• Data Breach Reporting Requirements
• Incident Response Team
   

Module 17: Data Protection Impact Assessments (DPIA)

• Data Protection Impact Assessments
• What Triggers a Data Protection Impact Assessment?
• A DPIA is Not Required in the Following Cases
• Benefits of DPIA
• Processes to be Considered for a DPIA
• Responsibilities
• DPIA Decision Path
• DPIA Content
• How Do I Conduct A DPIA?
• Signing Off the DPIA
• Mitigating Risks Identified by The DPIA
   

Module 18: Need Want Drop

• Need-Want-Drop
• Need-Want-Drop: Concept Diagram
• Need/Want/Drop Methodology
   

Module 19: Dealing with Third Parties and Data in the Cloud

• What is Cloud Computing?
• The Myths of Cloud
• Cloud Challenges
• The Controller-Processor Contract
• Checklist
• Data Controller – Summary
   

Module 20: Practical Implications: GDPR

• Brexit and its Impact on the GDPR
• One-Stop Shop
   

Module 21: Legal Requirements of the GDPR

• Legal Requirements
• Lawful, Fair, and Transparent Processing
• Limitation of Purpose, Data and Storage
• Data Subject Rights
• Consent
• Personal Data Breaches
• Privacy by Design
• Data Protection Impact Assessment
• Data Transfers
• Data Protection Officer
• Awareness and Training
   

Module 22: Privacy Principles in GDPR

• Privacy Principles in the GDPR
• Lawfulness, Fairness, and Transparency
• Purpose Limitation is the Second Principle
• One Should Refer to Data Minimisation
• Accuracy is the Fourth Principle
• The Fifth Principle is the Storage Limitation
• Sixth Principle of Integrity and Confidentiality
   

Module 23: Common Data Security Failures, Consequences, and Lessons to be Learnt

• Common Data Security Failures
• Consequences
• Lesson Learned