Data Protection and Privacy Course

Lesson 1 • Core Concepts and Terminology

Defines essential terms used throughout the field. Provides a shared language for analysing any data protection scenario.

Lesson 2 • The Data Lifecycle

Maps how data moves from collection through deletion. Anchors protection obligations to each lifecycle stage.

Lesson 3 • Key Actors and Their Roles

Identifies every party involved in data processing and their responsibilities. Clarifies accountability chains within organisations.

Lesson 1 • Individual Rights Under the Law

Details the rights data subjects hold and the timelines for fulfilling them. Prepares teams to handle rights requests operationally.

Lesson 2 • Lawful Bases for Processing

Identifies the legal grounds that justify processing personal data. Guides practitioners in selecting and documenting the correct basis.

Lesson 3 • Core Legal Principles

Examines the foundational principles shared across major frameworks. Translates legal text into operational requirements.

Lesson 4 • Global Regulatory Landscape

Compares regional approaches to data protection regulation. Reveals common principles underlying diverse legal systems.

Lesson 1 • Designing Consent Mechanisms

Covers practical methods for collecting and recording consent. Links mechanism design to user experience and legal defensibility.

Lesson 2 • Elements of Valid Consent

Defines what makes consent freely given, specific, informed, and unambiguous. Distinguishes valid consent from coercive or bundled practices.

Lesson 3 • Withdrawing and Refreshing Consent

Addresses the right to withdraw and the need to renew consent over time. Ensures ongoing compliance as purposes or contexts change.

Lesson 1 • Retention Schedules and Deletion

Guides creation of retention policies aligned with legal and business needs. Ensures data is deleted securely when no longer needed.

Lesson 2 • Conducting Data Audits

Provides a structured method for inventorying all data an organisation holds. Identifies redundant, obsolete, and trivial data for remediation.

Lesson 3 • Purpose Specification and Compatibility

Explains how to define purposes clearly and assess secondary use compatibility. Prevents scope creep in data processing activities.

Lesson 1 • Pseudonymisation and Anonymisation Techniques

Explains how de-identification reduces privacy risk while preserving data utility. Evaluates when each technique is appropriate.

Lesson 2 • Risk-Based Security Approach

Introduces the principle that security measures must match the risk to data subjects. Frames all subsequent safeguard decisions within a risk context.

Lesson 3 • Security Testing and Assurance

Covers methods for verifying that safeguards work as intended. Builds a culture of continuous security improvement.

Lesson 4 • Technical Safeguards

Covers encryption, access controls, and other technical controls for personal data. Connects each control to specific threat scenarios.

Lesson 1 • Notifying Affected Individuals

Guides communication with data subjects when a breach poses high risk to them. Balances legal obligation with reputational sensitivity.

Lesson 2 • Post-Breach Review and Improvement

Structures a lessons-learned process to prevent recurrence. Embeds breach insights into ongoing security and compliance programmes.

Lesson 3 • Containment and Investigation

Provides steps to stop ongoing harm and gather evidence about the breach. Balances speed of containment with preservation of forensic evidence.

Lesson 4 • Identifying and Classifying Breaches

Defines what constitutes a personal data breach and how to assess its severity. Enables rapid triage to prioritise response resources.

Lesson 1 • Privacy in Procurement and Vendor Management

Extends privacy-by-design thinking to third-party relationships and procurement. Ensures vendors meet the same privacy standards as internal teams.

Lesson 2 • Privacy Impact Assessments

Teaches how to conduct a structured assessment of privacy risks in new projects. Connects assessment findings to design decisions and risk mitigation.

Lesson 3 • Default Privacy Settings in Products

Explains how to configure products so the most privacy-protective option is the default. Reduces reliance on user action to achieve privacy.

Lesson 4 • Embedding Privacy in Development

Applies privacy requirements to software development and agile workflows. Ensures developers treat privacy as a functional requirement.

Lesson 1 • Policies, Standards, and Procedures

Guides creation of a coherent policy hierarchy for data protection. Ensures policies are actionable, current, and consistently applied.

Lesson 2 • Records of Processing Activities

Explains the legal requirement to maintain processing records and how to build them. Turns records into a living compliance asset.

Lesson 3 • Programme Governance and Structure

Defines the roles, committees, and reporting lines needed to govern a privacy programme. Establishes accountability at every organisational level.

Lesson 4 • Compliance Monitoring and Metrics

Establishes key performance indicators and audit processes to measure programme health. Enables data-driven decisions about privacy investment.