GDPR - Certified Data Protection Officer

Core GDPR principles and legal bases

Participants explore the foundational principles of the GDPR, including lawfulness, purpose limitation, data minimisation, and accountability, establishing the regulatory baseline for the rest of the course.

Scope, territorial reach, and key definitions

This module examines who and what falls within the GDPR's scope, covering data controller and processor distinctions, categories of personal data, and the regulation's extraterritorial applicability.

Relationship with other regulatory frameworks and standards

Participants map the GDPR against ISO/IEC 27701, ISO/IEC 27001, and NIST Frameworks to understand how privacy and security standards complement and reinforce each other.

When and how to designate a DPO

This module covers the mandatory and voluntary designation criteria under Articles 37 to 39, including the DPO's required qualities, position within the organisation, and publication requirements.

Structuring a GDPR compliance programme

Participants learn how to scope, design, and document a compliance programme, identifying the policies, procedures, and records of processing activities needed to demonstrate accountability.

Roles and responsibilities of accountable parties

This module examines how accountability is distributed among controllers, joint controllers, processors, and sub-processors, clarifying contractual and operational obligations at each level.

Daily advisory and monitoring tasks

Participants examine the DPO's ongoing obligations to inform and advise the organisation, monitor compliance activities, and maintain appropriate records without assuming managerial liability.

Data subject rights management

This module covers procedures for handling access, rectification, erasure, portability, and objection requests within statutory timeframes, including escalation paths for complex cases.

Privacy impact assessments and high-risk processing

Participants practice conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities and learn when prior consultation with a supervisory authority is required.

Cooperation with supervisory authorities

This module outlines the DPO's role as the contact point for supervisory authorities, covering communication protocols, audit cooperation, and handling regulatory inquiries.

Technical and organisational measures for data protection

Participants review the categories of technical controls, such as encryption and pseudonymisation, and organisational measures, such as staff training and access policies, that satisfy Article 32 obligations.

Personal data breach detection and notification

This module addresses how to identify a reportable breach, apply the 72-hour notification rule to supervisory authorities, and communicate with affected data subjects proportionately.

Auditing and reviewing the compliance programme

Participants learn how to plan and execute internal compliance reviews, interpret audit findings, and translate results into corrective actions that support continual improvement.

Applying the GDPR toolkit in practice

Participants work through practical toolkit components, including templates for records of processing activities, DPIA forms, and consent mechanisms, applying them to realistic organisational scenarios.

Assisted compliance programme review exercise

This module uses a case-study format to help participants identify compliance gaps, propose remediation steps, and present findings in a manner suitable for senior management.

Exam domain review and knowledge consolidation

Participants revisit the three assessed competency domains covering data protection concepts, accountable-party responsibilities, and technical and organisational measures to consolidate course learning before the exam.