GDPR Training Course

Lesson 1 • History of Privacy as a Right

Traces privacy from a philosophical concept to a legally enforceable right. Provides context for understanding why comprehensive data protection regulation became necessary.

Lesson 2 • Core Principles of Data Protection

Introduces the foundational principles that underpin modern privacy law. These principles recur throughout the course and govern every compliance decision.

Lesson 3 • Regulatory Authorities and Enforcement

Introduces supervisory authorities, their powers, and the consequences of non-compliance. Sets realistic expectations for enforcement risk throughout the course.

Lesson 4 • Scope and Territorial Reach

Defines which organizations and data activities fall under regulation. Students learn to assess whether their operations trigger compliance obligations.

Lesson 1 • Consent as a Lawful Basis

Examines the strict conditions that make consent valid under data protection law. Students learn to design compliant consent mechanisms and recognize invalid consent.

Lesson 2 • Special Category Data and Criminal Records

Addresses the heightened protection for sensitive data categories and the additional conditions required. Students apply these rules to health, biometric, and other sensitive data.

Lesson 3 • Legitimate Interests and Vital Interests

Analyzes the balancing test for legitimate interests and the narrow vital-interests basis. Students conduct a three-part legitimate-interests assessment.

Lesson 4 • Overview of Lawful Bases

Maps all six lawful bases and explains when each applies. Establishes a decision framework students will apply in later chapters.

Lesson 1 • Managing Rights Requests Operationally

Builds an end-to-end request management process covering verification, logging, and escalation. Connects individual rights to the organization's broader compliance program.

Lesson 2 • Rights to Rectification and Erasure

Covers the right to correct inaccurate data and the right to deletion under specific conditions. Students evaluate when erasure can be refused.

Lesson 3 • Right to Object and Automated Decisions

Addresses objections to processing and rights against solely automated decision-making. Students build processes to handle objections and provide human review.

Lesson 4 • Right of Access and Transparency

Explains the right to obtain a copy of personal data and the information that must accompany it. Students draft compliant subject access responses.

Lesson 1 • Maintaining and Updating Notices

Establishes a review cycle for keeping privacy notices accurate as processing changes. Students create a notice governance process tied to change management.

Lesson 2 • Notices for Indirect Data Collection

Covers disclosure obligations when data is obtained from third parties rather than directly. Students identify when and how to deliver indirect notices.

Lesson 3 • Designing Layered Privacy Notices

Introduces the layered notice model that balances legal completeness with readability. Students structure notices for web, mobile, and offline contexts.

Lesson 1 • Principles of Privacy by Design

Introduces the seven foundational principles of privacy by design and their practical implications. Students evaluate existing systems against each principle.

Lesson 2 • Integrating Privacy into Development Cycles

Shows how to embed privacy requirements into agile, waterfall, and DevOps workflows. Students produce privacy user stories and acceptance criteria.

Lesson 3 • Data Minimization Techniques

Covers technical and organizational methods to collect and retain only necessary data. Students redesign data collection forms and retention schedules.

Lesson 4 • Default Settings and Access Controls

Defines what privacy-by-default means for system configuration and user-facing settings. Students audit default configurations against the data-minimization principle.

Lesson 1 • Consulting the Supervisory Authority

Explains when residual high risk requires prior consultation with the regulator. Students prepare a consultation submission and understand the regulator's response process.

Lesson 2 • Integrating DPIAs into Project Governance

Embeds the DPIA process into project approval gates and procurement workflows. Students design a DPIA governance model for their organization.

Lesson 3 • When a DPIA Is Required

Identifies the processing activities that trigger a mandatory assessment and those that warrant one voluntarily. Students apply screening criteria to real scenarios.

Lesson 1 • Post-Breach Review and Remediation

Establishes a structured lessons-learned process to prevent recurrence and strengthen controls. Students produce a remediation action plan from a breach case study.

Lesson 2 • Defining and Classifying Data Breaches

Distinguishes confidentiality, integrity, and availability breaches and their risk implications. Students classify breach scenarios and determine notification obligations.

Lesson 3 • Regulatory Notification Requirements

Details the 72-hour notification deadline, required content, and phased reporting rules. Students draft a compliant authority notification for a simulated breach.

Lesson 4 • Notifying Affected Data Subjects

Explains when and how to communicate a breach to individuals and what information must be included. Students draft a subject notification and evaluate communication channels.

Lesson 1 • Controller-Processor Agreements

Details the mandatory contractual terms required when engaging a data processor. Students draft and review data processing agreements against regulatory requirements.

Lesson 2 • Restrictions on Cross-Border Data Transfers

Explains why transfers outside adequate jurisdictions require additional safeguards. Students map their organization's data flows to identify restricted transfers.

Lesson 3 • Transfer Mechanisms and Safeguards

Surveys the approved mechanisms for lawful international transfers and their practical requirements. Students select and implement the appropriate mechanism for each transfer scenario.

Lesson 4 • Vendor Due Diligence and Onboarding

Builds a risk-based process for assessing vendor privacy and security practices before engagement. Students create a vendor assessment questionnaire and scoring model.