Programme overview
Introduction:
Organisations that serve customers in several jurisdictions often run GDPR work as scattered projects: a privacy notice here, a vendor contract there, and no single programme that shows accountability when a supervisory authority or client asks for evidence. This Core Concept course gives privacy and compliance managers a practical GDPR and global privacy programme method, from lawful bases and principles through DPIAs, rights requests, transfers and breach notices, set against other major data protection laws. Participants build a Global Privacy Programme Roadmap for their own organisation.
Course Objectives:
- Apply the GDPR principles and the six lawful bases to real processing purposes and document the chosen basis
- Compare GDPR obligations with CCPA, CPRA, LGPD, PIPL, PIPEDA and the Digital Personal Data Protection Act to scope a multi-jurisdiction programme
- Set up the DPO function, policy suite and accountability evidence a supervisory authority expects to see
- Operate the processing register, DPIA screening, privacy by design checks and data subject request workflow
- Manage international transfers, processor onboarding and personal data breach notices within the required time limits
- Build a Global Privacy Programme Roadmap with metrics for executive reporting
Target Audience:
- Managers responsible for running an organisation's privacy or data protection programme
- Managers acting as or supporting the data protection officer function
- Legal and compliance managers accountable for GDPR and other data protection obligations
- Information security and incident managers who handle personal data breaches
- Procurement and vendor managers who contract processors that handle personal data
- Product and digital service managers who must build privacy into new systems
Course Outline:
Day 1: GDPR Foundations and the Global Privacy Law Landscape
- GDPR Article 5 Principles from Lawfulness and Transparency to Storage Limitation
- GDPR Article 6 Lawful Bases: Consent, Contract, Legal Obligation, Vital Interests, Public Task and Legitimate Interests
- Controller and Processor Role Screening Worksheet
- Global Law Comparison Grid: GDPR, CCPA and CPRA, LGPD, PIPL, PIPEDA and DPDP Act
- Multi-Jurisdiction Privacy Exposure Heat Map for Current-State Review
Day 2: Privacy Programme Architecture and the DPO Function
- GDPR Articles 37 to 39: DPO Designation Triggers, Independence and Tasks
- Accountability Evidence Pack: Policies, Notices and Senior Management Reporting
- Privacy Policy Suite Design: Retention Schedule, Notice Wording and Staff Awareness Plan
- Global Privacy Programme Charter and Multi-Jurisdiction Responsibility Matrix
- Supervisory Authority Contact Protocol and Enquiry Log
Day 3: Operating GDPR Controls Day to Day
- GDPR Article 30 Processing Register: Purposes, Data Categories, Recipients and Retention Periods
- GDPR Article 35 DPIA Screening Questions, Risk Scoring and Mitigation Log
- GDPR Article 25 Data Protection by Design and by Default Checklist with Pseudonymisation
- Data Subject Request Workflow: Access, Portability, Erasure and Objection
- Consent Withdrawal Handling and Lawful Basis Reassessment Log
Day 4: International Transfers, Vendors and Breach Incidents
- Transfer Mechanism Selection: Adequacy Decisions, Standard Contractual Clauses and Binding Corporate Rules
- Vendor Privacy Questionnaire and Processor Onboarding Scorecard
- GDPR Articles 33 and 34 Breach Triage: 72-Hour Authority Notice and Data Subject Communication
- Breach Severity Matrix and Encryption Exemption Test
- Privacy Metrics Dashboard: Request Turnaround, DPIA Coverage and Incident Trends
Day 5: Case Work and the Global Privacy Programme Roadmap
- Retail Case Study: Loyalty Analytics and Legitimate Interests Weighed Against Data Subject Rights
- Technology Case Study: Cloud Vendor Onboarding and Transfer Clause Review
- Financial Services Case Study: Breach Notification Decision under Time Pressure
- Global Privacy Programme Roadmap Drafting with Twelve-Month Milestones
- Roadmap Defence before a Mock Executive Privacy Committee
Skills You Will Gain:
- Lawful Basis Selection
- Multi-Jurisdiction Law Comparison
- DPO Function Design
- Processing Register Maintenance
- DPIA Screening and Scoring
- Transfer Mechanism Selection
- Breach Notification Triage
- Privacy Metrics Reporting
Why Attend This Course:
- Return with a Global Privacy Programme Roadmap tested by peers and ready for executive sign-off
- Answer client and authority questions with an accountability evidence pack instead of scattered documents
- Decide faster in a breach by using a severity matrix and the 72-hour notice workflow
- Benchmark GDPR practice with privacy managers from retail, technology, finance and public services
Conclusion:
A privacy programme earns trust when its lawful bases, records, assessments, transfer choices and breach decisions can be shown on request. The course moves from GDPR principles and a comparison of major data protection laws, through DPO and policy design, to daily controls, transfers, vendors, incidents and metrics. The final day applies these tools to sector cases and produces a Global Privacy Programme Roadmap that participants take back to their organisation as the plan for the next twelve months.