Corporate GDPR Training Course

1. GDPR in a nutshell
   • Key concepts of the GDPR
   • Impact of the GDPR on businesses and organizations
2. Generate customer confidence
   • How the GDPR can help businesses build customer trust
   • Practical steps to implement GDPR compliance
3. Focus of GDPR
   • Protecting the personal information of individuals
   • Ensuring that personal information is processed fairly and lawfully
4. What is personal information?
   • Definition of personal information under the GDPR
   • Types of personal information that are covered by the GDPR
5. Who has PII?
   • Organizations that collect, store, or process personal information
   • Individuals who have their personal information processed by organizations
6. Lawful processing of personal data
   • Principles for lawful processing of personal data under the GDPR
   • Legal bases for processing personal data under the GDPR

1. Introduction
   • Overview of Binding Corporate Rules (BCRs)
   • Benefits of using BCRs for international data transfers
2. Scope
   • Organizations that can use BCRs
   • Types of personal data that can be transferred under BCRs
3. UK ICO’s view of the scope
   • The UK Information Commissioner's Office's (ICO) guidance on BCRs
   • Practical considerations for UK organizations using BCRs
4. Processing GDPR definition
   • Definition of processing under the GDPR
   • Examples of processing activities covered by the GDPR
5. Who processes PII?
   • Data controllers
   • Data processors
   • Third-party processors
6. What is special data?
   • Definition of special categories of personal data under the GDPR
   • Processing of special categories of personal data requires additional safeguards
7. Legal framework
   • Legal framework for BCRs under the GDPR
   • Role of supervisory authorities in approving and monitoring BCRs
8. Timeline and derogations
   • Timeline for implementation of BCRs
   • Derogations from the GDPR for BCRs
9. Some key areas for derogation
   • Areas where the GDPR allows for derogations
   • Considerations for using derogations under the GDPR
10. Data breaches/personal data breach
    • Notification requirements for personal data breaches under the GDPR
    • Steps to take in the event of a personal data breach
11. Consequences of failure
    • Consequences of non-compliance with the GDPR
    • Enforcement actions by supervisory authorities
12. Governance framework
    • Importance of implementing a robust governance framework for BCRs
    • Key components of a BCR governance framework

1. Key roles
   • Data controllers
   • Data processors
   • Data protection officers (DPOs)
2. Data set
   • Definition of a data set under the GDPR
   • Processing of data sets under the GDPR
3. Subject Access Request (SAR)
   • Right of access to personal data under the GDPR
   • How to handle subject access requests (SARs)
4. Data Protection Impact Assessments (DPIA)
   • When a DPIA is required under the GDPR
   • How to conduct a DPIA
5. Processes to be considered for a DPIA
   • Types of processing activities that may require a DPIA
   • Factors to consider when determining whether a DPIA is necessary
6. Responsibilities
   • Responsibilities of data controllers and data processors in relation to DPIAs
   • Role of the DPO in DPIA process
7. DPIA decision path
   • Steps involved in the DPIA decision path
   • Documentation of DPIA findings
8. DPIA content
   • Key information that should be included in a DPIA
   • Recommendations for mitigating risks identified in a DPIA
9. Privacy by design and default
   • Principles of privacy by design and default
   • Implementing privacy by design and default in organizations
10. External transfers
    • Transfer of personal data to third parties or countries outside the EU/EEA
    • Safeguards for transferring personal data outside the EU/EEA
11. Profiling
    • Definition of profiling under the GDPR
    • Requirements for lawful profiling under the GDPR
12. Pseudonymisation
    • Definition of pseudonymisation under the GDPR
    • Benefits of pseudonymisation for data protection
13. Principles, user rights, and obligations
    • Key principles of the GDPR
    • Rights of data subjects under the GDPR
    • Obligations of data controllers and data processors under the GDPR
14. One stop shop
    • The concept of the one-stop shop under the GDPR
    • When the one-stop shop mechanism applies

1. Lawful bases for data processing
   • Consent as a lawful basis
   • Contractual necessity and legal obligations
   • Legitimate interests as a lawful basis
2. Consent management and withdrawal
   • Obtaining valid consent
   • Managing and documenting consent
   • Procedures for consent withdrawal
3. Assessing lawful bases for different processing activities
   • Determining the most appropriate lawful basis for processing personal data

1. Parts of the GDPR
• Overview of the structure of the GDPR
• Key elements of each part of the GDPR
2. Format of the articles
• Structure of individual articles in the GDPR
• Understanding the numbering and terminology of articles
3. Articles
• Summary of the key provisions of each article in the GDPR
• Cross-references to related articles and provisions

1. Introduction
   • Overview of the principles and rights enshrined in the GDPR
   • Importance of adhering to these principles and rights
2. Legality principle
   • Principle of legality and its requirements for data processing
   • Legal bases for processing personal data under the GDPR
3. Lawfulness of processing conditions
   • Conditions for lawful processing of personal data under the GDPR
   • Balancing of interests in data processing activities
4. Consent
   • Definition and requirements for valid consent under the GDPR
   • Documentation and withdrawal of consent
5. Transparency principle
   • Principle of transparency and its implications for data processing
   • Providing clear and accessible information to data subjects
6. Fairness principle
   • Principle of fairness and its requirements for data processing
   • Ensuring that data processing is fair and non-discriminatory
7. Rights of data subjects
   • Overview of the rights granted to data subjects under the GDPR
   • Empowering individuals to control their personal data
8. Purpose limitation principle
   • Principle of purpose limitation and its requirements for data processing
   • Collecting and processing data for specified, explicit, and legitimate purposes
9. Minimisation principle
   • Principle of data minimization and its requirements for data processing
   • Collecting and processing only the minimum amount of personal data necessary
10. Accuracy principle
    • Principle of accuracy and its requirements for data processing
    • Ensuring that personal data is accurate and up-to-date
11. Storage limitation principle
    • Principle of storage limitation and its requirements for data processing
    • Retaining personal data for no longer than necessary
12. Integrity and confidentiality principle
    • Principle of integrity and confidentiality and its requirements for data processing
    • Protecting personal data from unauthorized access, alteration, or destruction
13. Accountability principle
    • Principle of accountability and its requirements for data controllers
    • Being able to demonstrate compliance with the principles of the GDPR

1. Impact of compliance failure
   • Consequences of non-compliance with the GDPR
   • Potential administrative fines and other penalties
2. Administrative fines
   • Structure and levels of administrative fines under the GDPR
   • Factors considered when determining the amount of a fine
3. Joint controllers
   • Concept of joint controllership and its implications under the GDPR
   • Responsibilities and obligations of joint controllers
4. Processor liability under GDPR
   • Liability of data processors under the GDPR
   • Specific obligations and responsibilities of processors
5. PIMS (Personal Information Management System)
   • Role of a personal information management system (PIMS) in GDPR compliance
   • Key components of an effective PIMS
6. Cyber essentials
   • Overview of the cyber essentials scheme
   • Benefits of implementing cyber essentials for GDPR compliance
7. ISO 27017 Code of Practice for Information Security Controls
   • Overview of ISO 27017 and its alignment with the GDPR
   • Implementing ISO 27017 as part of a GDPR compliance strategy
8. Risk management
   • Importance of risk management for GDPR compliance
   • Identifying, assessing, and mitigating data protection risks

1. What is a personal data breach?
   • Definition of a personal data breach under the GDPR
   • Types of incidents that can constitute a personal data breach
2. Notification obligations
   • Requirements for notifying personal data breaches to supervisory authorities and data subjects
   • Timeframes for breach notification under the GDPR
3. Notifying data subjects
   • Content and delivery of notifications to data subjects
   • Providing clear and concise information about the breach
4. Breach reporting and responses
   • Steps to take in response to a personal data breach
   • Containing the breach, mitigating its impact, and preventing future breaches
5. Ways to minimize the breach impact
   • Implementing proactive measures to minimize the risk of data breaches
   • Preparing for and responding effectively to breaches

1. Difference between a data controller and a data processor

• Key distinctions between data controllers and data processors under the GDPR
• Responsibilities and obligations of each role

2. Main obligations of data controllers and processors

• Specific obligations for data controllers and data processors under the GDPR
• Ensuring compliance with the principles of data protection

3. Cooperation with supervisory authorities

• Requirements for cooperation with supervisory authorities in relation to data processing
• Responding to inquiries and providing access to information

4. Data breach transparency

• Obligations related to data breach transparency under the GDPR
• Communicating breaches in a timely and effective manner

5. Security

• Implementing appropriate security measures to protect personal data
• Risk-based approach to security implementation

1. Role of a data protection officer
   • Responsibilities and tasks of a data protection officer (DPO)
   • Contributing to data protection compliance within an organization
2. Main responsibilities of the DPO
   • Key responsibilities of a DPO under the GDPR
   • Advising on data protection matters, monitoring compliance, and conducting DPIAs
3. Skills required
   • Essential skills and qualifications for a DPO
   • Knowledge of data protection law, IT security, and risk management
4. Monitoring compliance
   • Role of the DPO in monitoring data protection compliance
   • Identifying and addressing potential compliance issues
5. Training and awareness
   • Importance of data protection training and awareness for employees
   • Role of the DPO in raising awareness and providing training
6. Data Protection Impact Assessments (DPIAs)
   • Involvement of the DPO in the DPIA process
   • Providing expertise and guidance on DPIA

1. Key differences between the Data Protection Act and the GDPR
   • Major differences between the UK Data Protection Act (DPA) and the GDPR
   • Alignment of the DPA with the GDPR and key changes
2. Age of consent
   • Age of consent for processing personal data under the DPA and the GDPR
   • Specific exceptions and considerations for parental consent
3. Exemptions for freedom of expression
   • Exemptions for processing personal data for journalistic, artistic, or literary purposes
   • Balancing the right to freedom of expression with data protection principles
4. Research and statistics
   • Specific provisions for processing personal data for research and statistical purposes
   • Safeguards and anonymization techniques for research data
5. Archiving in the public interest
   • Conditions for processing personal data for archiving and historical research purposes
   • Ensuring accessibility and appropriate safeguards

1. Specific permission
   • Requirement for explicit consent for certain types of data processing activities
   • Obtaining clear and informed consent from data subjects
2. Privacy by design
   • Integrating privacy considerations into the design of products, services, and processes
   • Implementing data protection by default
3. Data portability
   • Right of data portability and its implications for organizations
   • Enabling individuals to easily transfer their personal data to another provider
4. Right to be forgotten
   • Right to erasure and its exceptions
   • Requesting the removal of personal data from records
5. Definitive consent
   • Requirements for obtaining valid and revocable consent
   • Documenting and managing consent records
6. Information in clear readable language
   • Providing clear and accessible privacy notices to data subjects
   • Using plain language and avoiding technical jargon
7. Limits on the use of profiling
   • Restrictions on the use of automated profiling
   • Ensuring that profiling is fair, transparent, and non-discriminatory
8. Everyone follows the same law
   • Global applicability of the GDPR for organizations processing personal data of EU residents
   • Consistency and harmonization of data protection laws across the EU
9. Adopting techniques
   • Implementing technical and organizational measures to protect personal data
   • Using encryption, pseudonymization, and anonymization techniques

1. Subject Access Requests (SAR)
   • Right of access to personal data under the GDPR
   • Scope and limitations of the right of access
2. Recognizing the request
   • Identifying and acknowledging subject access requests (SARs)
   • Understanding the details of the request and the requestor's identity
3. Time limitations
   • Timeframes for responding to SARs under the GDPR
   • Extensions to the response deadline in certain circumstances
4. Fees and excessive requests
   • Charging fees for excessive or unfounded SARs
   • Assessing the reasonableness of the request and applying fees accordingly
5. Identifying, searching, and gathering data
   • Locating and retrieving relevant personal data for the SAR
   • Identifying data controllers and processors involved in the processing
6. Information withholding
   • Exceptions to the right of access and withholding information
   • Balancing the rights of the data subject with other legitimate interests
7. Developing and sending a response
   • Providing a clear and comprehensive response to the SAR
   • Including relevant information, explanations, and any withheld data

1. Rights and third parties
   • Exercising data subject rights in relation to third-party processors
   • Ensuring that processors comply with data subject requests
2. Requests on behalf of other data subjects
   • Submitting SARs and other data subject requests on behalf of others
   • Acting as a representative for an individual who cannot exercise their rights
3. Children's maturity guidelines
   • Considerations for handling data subject requests from children
   • Assessing the maturity of the child and obtaining parental consent when necessary
4. Rights request flow chart
   • Step-by-step guide to handling data subject requests
   • Identifying the relevant right, processing the request, and providing a response
5. Right to be informed
   • Right to be informed about the processing of personal data
   • Providing clear and accessible information about data collection, use, and sharing
6. Right of access
   • Right to access personal data and obtain a copy of the data
   • Enabling individuals to review their personal data and verify its accuracy
7. Right to rectification
   • Right to rectify inaccurate or incomplete personal data
   • Enabling individuals to correct and update their personal data records
8. Right to erasure
   • Right to erasure or the "right to be forgotten"
   • Requesting the deletion of personal data under certain conditions
9. Right to restrict processing
   • Right to restrict the processing of personal data in certain circumstances
   • Limiting the use of personal data while restrictions are in place
10. Right to data portability
    • Right to data portability and its implications for organizations
    • Enabling individuals to transfer their personal data to another provider
11. Right to object
    • Right to object to the processing of personal data under certain grounds
    • Opposing the use of personal data for specific purposes, such as profiling or marketing
12. Rights related to automated decision making and profiling
    • Rights related to automated decision-making and profiling
    • Challenging automated decisions and obtaining human intervention

1. Overview of SARs
   • Understanding subject access requests (SARs) and their significance
   • Scope of the right of access and the information that can be requested
2. How SARs can be submitted
   • Methods for submitting SARs, such as in writing, electronically, or verbally
   • Providing clear instructions and making the process accessible
3. Information in SAR responses
   • Content and format of SAR responses
   • Providing the requested information in a structured and understandable manner
4. Confirming data subject identity
   • Verifying the identity of the data subject making the SAR
   • Preventing unauthorized access to personal data
5. Scope and fees
   • Determining the scope of the SAR and identifying relevant data
   • Assessing the reasonableness of the request and considering fees for excessive or unfounded SARs
6. Refusing a SAR
   • Grounds for refusing a SAR and exceptions to the right of access
   • Notifying the data subject of the refusal and providing reasons
7. Employee access requests
   • Handling SARs from employees and considerations for workplace data
   • Balancing the rights of employees with the organization's legitimate interests
8. Credit reference agencies
   • Specific requirements for SARs related to credit reference agencies
   • Providing clear and accessible information about credit data
9. Best practices for SARs
   • Implementing effective procedures for handling SARs in a timely and compliant manner
   • Protecting data subject rights and building trust with individuals

1. Lawful processing overview
   • Understanding the concept of lawful processing under the GDPR
   • Principles and requirements for lawful processing
2. User rights and justifications
   • Balancing user rights with the legitimate interests of organizations
   • Justifying processing activities based on specific legal bases
3. Lawfulness of processing conditions
   • Conditions for lawful processing under the GDPR
   • Demonstrating compliance with the principles of data protection
4. Consent mechanisms
   • Obtaining valid and informed consent from data subjects
   • Revoking consent and managing consent records
5. ICO guidelines on consent
   • Guidance from the UK Information Commissioner's Office (ICO) on consent
   • Practical considerations for implementing consent mechanisms
6. Processing for marketing
   • Specific requirements for processing personal data for marketing purposes
   • Obtaining consent and providing clear opt-out options
7. Legitimate interests
   • Processing personal data based on legitimate interests
   • Conducting a legitimate interests assessment (LIA)

1. Cross border transfers
   • Transferring personal data to third countries or international organizations
   • Ensuring adequate safeguards for cross-border data transfers
2. Transfer mechanisms and derogations
   • Mechanisms for transferring personal data to third countries under the GDPR
   • Derogations from the general prohibition on transfers to third countries
3. Adequacy of data transfers
   • Adequacy decisions and their implications for data transfers
   • Assessing the adequacy of data protection in third countries
4. Binding Corporate Rules (BCRs)
   • Implementing Binding Corporate Rules (BCRs) for data transfers
   • Establishing a global framework for data protection compliance
5. EU-US privacy shield
   • The EU-US Privacy Shield framework and its impact on data transfers
   • Invalidation of the Privacy Shield and alternative mechanisms for data transfers to the US
6. Model clauses
   • Using Standard Contractual Clauses (Model Clauses) for data transfers
   • Incorporating appropriate safeguards into data transfer agreements
7. Public authority agreements
   • Data transfers between public authorities under the GDPR
   • Specific requirements and considerations for public authority transfers

1. Need for data security
   • Importance of data security in protecting personal data
   • Consequences of data breaches and security failures
2. Appropriate protection measures
   • Implementing appropriate technical and organizational measures to protect personal data
   • Risk-based approach to determining appropriate security measures
3. Incident response
   • Preparing for and responding to personal data breaches
   • Identifying, containing, and mitigating data security incidents
4. Data breach reporting requirements
   • Requirements for notifying personal data breaches to supervisory authorities and data subjects
   • Timeframes and content of breach notifications
5. Incident response team
   • Establishing an incident response team and defining roles and responsibilities
   • Ensuring effective communication and coordination during incident response

1. DPIA triggers and benefits
   • When a DPIA is required under the GDPR
   • Benefits of conducting DPIAs for identifying and mitigating data protection risks
2. DPIA process and responsibilities
   • Steps involved in the DPIA process and responsibilities of stakeholders
   • Identifying the data processing activity, assessing risks, and implementing measures
3. DPIA content and decision path
   • Key elements of a DPIA and the decision path for determining appropriate measures
   • Documenting the DPIA findings and recommendations
4. Risk mitigation strategies
   • Strategies for mitigating data protection risks identified in a DPIA
   • Implementing technical, organizational, and procedural safeguards

1. Concept and methodology
   • Understanding the concept of Need-Want-Drop and its application in data management
   • Critically evaluating the need, want, and drop principles for data processing
2. Categorizing data
   • Classifying data based on its level of sensitivity and importance
   • Identifying data that is truly essential for the organization's purposes
3. Applying Need-Want-Drop to Data Management
   • Implementing Need-Want-Drop principles in data governance frameworks
   • Reducing data collection, storage, and processing to the minimum necessary

1. Cloud computing overview
   • Understanding cloud computing models and their impact on data protection
   • Shared responsibility model and security considerations in the cloud
2. Challenges and myths of cloud data
   • Addressing common concerns and misconceptions about data security in the cloud
   • Utilizing cloud computing while maintaining data protection compliance
3. Controller-processor contracts
   • Establishing clear contractual arrangements with cloud providers
   • Defining roles, responsibilities, and data protection obligations
4. Data controller responsibilities
   • Key responsibilities of data controllers in cloud environments
   • Ensuring compliance with data protection principles throughout the cloud lifecycle

1. Brexit and GDPR
   • Impact of Brexit on the GDPR and data protection regulations in the UK
   • Ongoing compliance requirements and adaptations to the UK data protection landscape
2. Adequacy decisions
   • Adequacy decisions for data transfers to non-EU countries
   • Understanding the process and implications of adequacy decisions
3. EU and UK representatives
   • Appointing EU and UK representatives for organizations outside the EU and UK
   • Facilitating communication with supervisory authorities and ensuring compliance
4. One-stop shop
   • The one-stop shop mechanism and its applicability under the GDPR
   • Identifying the lead supervisory authority for cross-border data processing
5. Exemption rules
   • Exemption rules and derogations from certain GDPR requirements
   • Understanding the conditions and limitations of exemptions

1. Lawful, fair, and transparent processing
   • Ensuring that data processing activities are lawful, fair, and transparent
   • Providing clear and accessible information to data subjects
2. Purpose, data, and storage limitation
   • Processing data for specified, explicit, and legitimate purposes
   • Limiting the collection, storage, and use of personal data to what is necessary
3. Data subject rights
   • Respecting and upholding the rights of data subjects under the GDPR
   • Implementing mechanisms for individuals to exercise their rights
4. Personal data breaches
   • Notifying supervisory authorities and data subjects about personal data breaches
   • Taking appropriate measures to mitigate and prevent breaches
5. Privacy by design
   • Embedding data protection principles into the design of products, services, and processes
   • Implementing privacy-enhancing technologies and data minimization strategies
6. Data protection impact assessment
   • Conducting DPIAs for high-risk data processing activities
   • Identifying and mitigating potential data protection risks
7. Data transfers
   • Ensuring that data transfers to third countries are compliant with the GDPR
   • Implementing appropriate safeguards for cross-border data transfers
8. Data protection officer responsibilities
   • Appointing a DPO if required under the GDPR
   • Ensuring that the DPO has the necessary resources and support to carry out their duties
9. Awareness and training
   • Providing data protection awareness and training to employees
   • Promoting a culture of data protection within the organization

1. Evolving data landscape
   • Trends and developments in the data landscape that impact data protection
   • Increasing volume, complexity, and sensitivity of personal data
2. Emerging technologies
   • Impact of emerging technologies, such as artificial intelligence and big data, on data protection
   • Challenges and opportunities arising from technological advancements
3. Regulatory developments
   • Global trends in data protection regulation and the evolution of the GDPR
   • Potential for harmonization and standardization of data protection laws
4. Enforcing data protection
   • Role of supervisory authorities in enforcing data protection laws and ensuring compliance
   • Increasing focus on cross-border cooperation and enforcement
5. Building trust
   • Importance of building trust with individuals through transparency, accountability, and responsible data handling
   • Fostering a data protection mindset within organizations

1. Data governance and privacy programs
   • Implementing comprehensive data governance and privacy programs
   • Embedding data protection principles into organizational culture and processes
2. Data protection by design and default
   • Integrating data protection by design and default principles into product development and service delivery
   • Minimizing data collection and maximizing privacy by default
3. Risk management
   • Establishing a robust risk management framework for data protection
   • Identifying, assessing, and mitigating data protection risks
4. Data subject engagement
   • Engaging with data subjects and empowering them to control their personal data
   • Providing clear and accessible information and facilitating the exercise of data subject rights
5. Continuous monitoring and improvement
   • Continuously monitoring data protection compliance and adapting to evolving requirements
   • Embracing a culture of continuous improvement in data protection practices