Data Protection Officer (DPO) Training Bundle

Certified Information Privacy Professional/Europe (CIPP/E)

The Principles of Data Protection in Europe covers the essential pan-European and national data protection laws, as well as industry-standard best practices for corporate compliance with these laws. Those taking this course will gain an understanding of the European model for privacy enforcement, key privacy terminology and practical concepts concerning the protection of personal data and trans-border data flows.

The training is based on the body of knowledge for the IAPP’s ANSI accredited Certified Information Privacy Professional/Europe (CIPP/E) certification program.

What will you learn?

• Define the key concepts of European data protection, including controller and processor roles or data protection principles;
• Describe EU data protection legislation and regulatory bodies, including an overview of the advisory and supervisory authorities and their enforcement powers;
• Explain the application of the GDPR and other compliance obligations to European and international entities, including the rules governing the controller/processor contract, lawful grounds for processing personal data, data subjects’ rights, technical and organizational measures for safeguarding data, data breach notifications, accountability to regulators and data subjects or rules for transferring data outside the EU.

Certified Information Privacy Professional/Europe (CIPP/E)

Module 1: Data Protection Laws

Introduces key European data protection laws and regulatory bodies, describing the evolution toward a harmonized legislative framework and discussing privacy versus data protection, as well as differentiating between various types of privacy

Module 2: Personal Data

Defines and differentiates between types of data, including personal, anonymous, pseudo-anonymous and special categories, while also covering the criteria under the GDPR for identifying personal data.

Module 3: Controllers and Processors

Describes the roles and relationships of controllers and processors, as well as the basic configurations of control over personal data.

Module 4: Processing Personal Data

Defines data processing and GDPR processing principles, explains the application of the GDPR and outlines the legitimate bases for processing personal data. It also determines the application of the GDPR based on territorial and material scope and if a data processing activity is legal under the GDPR based on legitimate processing criteria.

Module 5: Data Subjects' Rights

Describes data subject rights regarding the processing of their personal data and recognizes controller and processor obligations regarding data subject rights.

Module 6: Information Provision Obligations

Defines transparency and lists the information that should be provided by the controller to the data subject when personal data is collected both directly and indirectly.

Module 7: International Data Transfers

Describes the options for international data transfers, lists the European Commission’s adequacy decisions, summarizes the current status of U.S. adequacy, and details controller and processor obligations and restrictions regarding international data transfers.

Module 8: Compliance Considerations

• Discusses the legal basis and data protection considerations for employers processing employees’ personal data
• Determines the applicability of EU data protection law and compliance requirements for surveillance, particularly communications data, CCTV, location data, and biometric data
• Determines the applicability of EU data protection law and compliance requirements for direct marketing, particularly online behavioral advertising
• Determines the applicability of EU data protection law and compliance requirements for internet technology and communications, particularly cloud computing, web cookies, search engines, social networking services, and artificial intelligence.

Module 9: Security of Processing

Summarizes the considerations and duties of controllers and processors for ensuring the security of personal data, and outlines the requirements related to informing the supervisory authority and data subjects of a data breach.

Module 10: Accountability

Recognizes the accountability implications for controllers and processors, outlines steps for designing a data protection programme, including a data protection impact assessment and data protection policy.
Summarizes record-keeping requirements of controllers and processors and describes the protections, tasks, and responsibilities for data protection officers.

Module 11: Supervision and Enforcement

• Describes the role, powers, and procedures of the supervisory authorities, as well as of the EDPB and EDPS.
• Summarizes the remedies against, liabilities of, and potential penalties for controllers and processors, particularly regarding administrative fines.