Duration
GDPR - Certified Data Protection Officer (CDPO)
5 days
Introduction
- General information
Learning objectives
- Educational approach
- Examination and certification
- About PECB
Section 2: General Data Protection Regulation (GDPR)
- Structure of the GDPR
- GDPR subject-matter and objectives
- GDPR into EU, EEA, and EFTA countries
- European Data Protection Board
- Impact on the EU and beyond
- Supervisory authority
- Administrative fines
- GDPR in the United Kingdom
- UK GDPR and data protection act (DPA)
Section 3: Core considerations for the GDPR
- Personal data protection
- Key concepts
- Personal data categories
- Data protection principles
- The rights of the data subject
- Analysis of the GDPR challenges
Section 4: Designation of the DPO
- Qualification of the DPO
- Tasks of the DPO
- Position of the DPO
Section 5: Analysis of the GDPR compliance program
- Controllers and processors under the GDPR
- Cooperation with the supervisory authority
- Gap analysis
- The GDPR scope
Section 6: Relationship with the top management
- The DPO and the top management
- Promoting data protection to top management level
- Allocating resources
- Employment contract of the DPO
- Independence of the DPO in performing the tasks
- Reporting to the top management
Section 7: Data protection policy
- The structure of a policy
- The application of the data protection policy
- Data protection policy control, evaluation, and review
- Communicating the data protection policy
- Review of other policies related to data protection
Section 8: Register of processing activities
- Identification of processing activities
- Steps to create records
- Key elements of records of processing activities
- DPO’s role in keeping records of processing activities
- Monitoring the data processing records
Section 9: Risk management process
- Risk identification
- Risk analysis
- Risk evaluation
- Risk treatment
- Risk acceptance
Section 10: Data protection impact assessment
- Data protection impact assessment
- Need for a data protection impact assessment
- When is a data protection impact assessment not necessary?
- Role of the DPO in a data protection impact assessment
- Data protection impact assessment methodologies
Section 11: Documentation management
- Work documents
- Types of documents
- Value of documentation
- Common problems in documentation management
Section 12: Evaluation of the data protection controls
- The ISO/IEC 27701 standard
- Mapping of the GDPR to ISO/IEC 27701
- Data protection controls
Section 13: Data protection and technology
- Data protection by design and by default
- Anonymization
- Pseudonymization
- Access control
- Logging and monitoring
- Technical security measures
- Mobile and portable devices
- Software life cycle security
- Data erasure and storage
Section 14: Awareness, training, and communication
- Awareness program
- Training program
- Evaluation of the outcomes of the awareness and training sessions
- Communication
- DPO as a point of contact
Section 15: Incident management and personal data breaches
- Events vs. incidents
- Frequent threats and incidents
- Incident management
- Personal data breach
- Personal data breach response plan
- Personal data breach notification
- Examples of personal data breaches
Section 16: Monitoring and measuring compliance
- Determine measurement objectives
- Define what needs to be monitored and measured
- Monitor compliance
- Determine the frequency and method of monitoring and measurement
- Report the results
Section 17: Data protection internal audit
- What is an audit?
- Types of audits
- Differences between internal and external audits
- Data protection audit
- Collecting and verifying information
- Knowledge and competence to audit
- Following up on nonconformities
- Data protection external audit
Section 18: Treatment of nonconformities
- The eight disciplines problem-solving method
- Root cause analysis
- Corrective action process
- Preventive action process
- Evaluation of the action plan
Section 19: Continual improvement
- Continual monitoring of change factors
- Maintenance and improvement
- Continual update of documentation
- Documentation of improvements
Section 20: Closing the training course
- PECB GDPR certification scheme
- PECB certification process
- Other PECB services
- Other PECB training courses and certifications
Day 5
Revision
Programme scope, delivery arrangements and suitability are confirmed during enquiry.