GDPR and Global Privacy Programme Management: DPO, DPIAs, Transfers and Breaches – Barcelona, 15–19 Mar 2027

Programme overview

Introduction:

Organisations that serve customers in several jurisdictions often run GDPR work as scattered projects: a privacy notice here, a vendor contract there, and no single programme that shows accountability when a supervisory authority or client asks for evidence. This Core Concept course gives privacy and compliance managers a practical GDPR and global privacy programme method, from lawful bases and principles through DPIAs, rights requests, transfers and breach notices, set against other major data protection laws. Participants build a Global Privacy Programme Roadmap for their own organisation.

Course Objectives:

• Apply the GDPR principles and the six lawful bases to real processing purposes and document the chosen basis
• Compare GDPR obligations with CCPA, CPRA, LGPD, PIPL, PIPEDA and the Digital Personal Data Protection Act to scope a multi-jurisdiction programme
• Set up the DPO function, policy suite and accountability evidence a supervisory authority expects to see
• Operate the processing register, DPIA screening, privacy by design checks and data subject request workflow
• Manage international transfers, processor onboarding and personal data breach notices within the required time limits
• Build a Global Privacy Programme Roadmap with metrics for executive reporting

Target Audience:

• Managers responsible for running an organisation's privacy or data protection programme
• Managers acting as or supporting the data protection officer function
• Legal and compliance managers accountable for GDPR and other data protection obligations
• Information security and incident managers who handle personal data breaches
• Procurement and vendor managers who contract processors that handle personal data
• Product and digital service managers who must build privacy into new systems

Course Outline:

Day 1: GDPR Foundations and the Global Privacy Law Landscape

• GDPR Article 5 Principles from Lawfulness and Transparency to Storage Limitation
• GDPR Article 6 Lawful Bases: Consent, Contract, Legal Obligation, Vital Interests, Public Task and Legitimate Interests
• Controller and Processor Role Screening Worksheet
• Global Law Comparison Grid: GDPR, CCPA and CPRA, LGPD, PIPL, PIPEDA and DPDP Act
• Multi-Jurisdiction Privacy Exposure Heat Map for Current-State Review

Day 2: Privacy Programme Architecture and the DPO Function

• GDPR Articles 37 to 39: DPO Designation Triggers, Independence and Tasks
• Accountability Evidence Pack: Policies, Notices and Senior Management Reporting
• Privacy Policy Suite Design: Retention Schedule, Notice Wording and Staff Awareness Plan
• Global Privacy Programme Charter and Multi-Jurisdiction Responsibility Matrix
• Supervisory Authority Contact Protocol and Enquiry Log

Day 3: Operating GDPR Controls Day to Day

• GDPR Article 30 Processing Register: Purposes, Data Categories, Recipients and Retention Periods
• GDPR Article 35 DPIA Screening Questions, Risk Scoring and Mitigation Log
• GDPR Article 25 Data Protection by Design and by Default Checklist with Pseudonymisation
• Data Subject Request Workflow: Access, Portability, Erasure and Objection
• Consent Withdrawal Handling and Lawful Basis Reassessment Log

Day 4: International Transfers, Vendors and Breach Incidents

• Transfer Mechanism Selection: Adequacy Decisions, Standard Contractual Clauses and Binding Corporate Rules
• Vendor Privacy Questionnaire and Processor Onboarding Scorecard
• GDPR Articles 33 and 34 Breach Triage: 72-Hour Authority Notice and Data Subject Communication
• Breach Severity Matrix and Encryption Exemption Test
• Privacy Metrics Dashboard: Request Turnaround, DPIA Coverage and Incident Trends

Day 5: Case Work and the Global Privacy Programme Roadmap

• Retail Case Study: Loyalty Analytics and Legitimate Interests Weighed Against Data Subject Rights
• Technology Case Study: Cloud Vendor Onboarding and Transfer Clause Review
• Financial Services Case Study: Breach Notification Decision under Time Pressure
• Global Privacy Programme Roadmap Drafting with Twelve-Month Milestones
• Roadmap Defence before a Mock Executive Privacy Committee

Skills You Will Gain:

• Lawful Basis Selection
• Multi-Jurisdiction Law Comparison
• DPO Function Design
• Processing Register Maintenance
• DPIA Screening and Scoring
• Transfer Mechanism Selection
• Breach Notification Triage
• Privacy Metrics Reporting

Why Attend This Course:

• Return with a Global Privacy Programme Roadmap tested by peers and ready for executive sign-off
• Answer client and authority questions with an accountability evidence pack instead of scattered documents
• Decide faster in a breach by using a severity matrix and the 72-hour notice workflow
• Benchmark GDPR practice with privacy managers from retail, technology, finance and public services

Conclusion:

A privacy programme earns trust when its lawful bases, records, assessments, transfer choices and breach decisions can be shown on request. The course moves from GDPR principles and a comparison of major data protection laws, through DPO and policy design, to daily controls, transfers, vendors, incidents and metrics. The final day applies these tools to sector cases and produces a Global Privacy Programme Roadmap that participants take back to their organisation as the plan for the next twelve months.