Data Protection - Certified Data Protection Officer - DSGVO/GDPR (PECB-Zertifizierung)

Lehrplan

In dieser CDPO Schulung erlernen Sie folgende Inhalte:

General Data Protection Regulation (GDPR)

• The purpose of the GDPR
• Structure of the regulation
• Supervisory authority
• Impact on the EU and beyond
• The General Data Protection Regulation

Core considerations for the GDPR

• Key concepts
• Personal information categories
• Data protection principles
• The rights of the data subject
• Analysing challenges and issues

Roles, obligations, and processing activities

• Designation of the Data Protection Officer
• Data Protection Officer
• DPO and DPIA
• DPO and processing activities
• Responsibilities of the controller
• Processors under the GDPR
• Records of processing activities
• Cooperation with the supervisory authority

Once the fundamentals of GDPR are covered, the course then focuses on the implementation, operation and maintenance of a programme to ensure GDPR compliance and to allow the organisation to fulfil multiple legal and regulatory requirements.

Initiating the GDPR compliance program

• Applicability guideline
• Approach to Implementing the GDPR Compliance Program
• Approach and methodology
• Alignment with best practices
• Choose a methodological framework

Prepare for the implementation of the GDPR compliance program

• What is the organisation missing?
• Performing a gap analysis

Management approval

• Business case
• GDPR compliance project team
• Determine the resources
• Project plan
• Management approval

Data protection policy

• Creating policy models
• Policy drafting process
• Drafting the data protection policy
• Management approval
• Publication of the data protection policy
• Training, communication, and awareness
• Control, evaluation, and review

Data mapping

• What is data mapping?
• Data mapping process
• Data mapping recommended practices
• Data mapping flows

Risk assessment

• Risk assessment
• Selecting a risk analysis approach
• Risk identification
• Risk analysis
• Risk evaluation

Privacy Impact Assessment (PIA)

• Risk assessment & PIA
• Necessity for a PI
• Specific steps in the PIA process
• Prior consultation

Documentation management

• Documentation management
• Value of documentation
• Implementing a document management system
• Control of records
• Master list of documents
• Documentation to demonstrate compliance with the GDPR

Awareness and communication

• Awareness and communication
• Awareness program
• Data protection communication process
• Establish communication objectives
• Identify interested parties
• Conduct communication activities
• Evaluate communication

Data protection controls

• Data protection/Privacy controls
• Data protection controls

Incident reporting and management

• GDPR and incident management
• Incident management
• Breach notification
• Event vs incidents
• Incident types
• Incident management structure
• Incident response plan

Consent and subject access request

• Consent
• Alternatives to consent
• Consent requests
• Explicit and implied consent
• Withdrawal of consent
• Record the consent
• Subject access requests
• Confirming the requester's identity

Transfer of data

• General principles for data transfers
• Transfers on the basis of an adequacy decision
• Transfers to international organisations
• Transfers subject to appropriate safeguards
• Standard Contractual Clauses (SCC)
• Binding Corporate Rules (BRC)
• Transfers or disclosures not authorised by Union law
• Derogations for specific situations

Data protection and technology

• Privacy by design & default
• Data processing
• Data security
• Encryption
• Application lifecycle security
• Data disposal
• Data storage
• Physical security

Monitoring, measurement, analysis, and evaluation

• Main definitions
• Determining of measurement objectives
• Monitoring and measuring process
• Reporting the results
• Operational dashboard
• Tactical dashboard
• Strategic dashboard
• What minimally needs to be monitored and measured under the GDPR

Corrective actions

• Personal data breach
• Notification of a personal data breach
• Communication of a personal data breach to the data subject
• Root-cause analysis tool
• Corrective action procedure
• Preventive action procedure

Continual improvement and maintenance of compliance

• Continuous monitoring process of change factors
• Maintenance and improvement of processes and compliance position
• Continual update of documentation and records
• Documenting the improvements