Day 1: Understanding Privacy Principles and Personal Data

Data Protection and Privacy Principles

• Review privacy implications before implementation
• Differentiate public internal restricted information
• Apply retention and deletion requirements
• Review access to sensitive information

Personal Data Classification

• Classify personal data by sensitivity
• Apply handling rules by category
• Limit access by operational need
• Review classification when usage changes

Lawful Basis for Processing

• Define each processing activity purpose
• Match processing with lawful basis
• Document rationale for selected basis
• Reassess basis when purposes change

Day 2: Managing Transparency, Rights, and Privacy by Design

Transparency and Privacy Notices

• Explain processing purposes plainly
• State data categories and recipients
• Describe retention and rights clearly
• Review notices when processing changes

Data Subject Rights

• Recognize common data subject requests
• Verify identity before data disclosure
• Coordinate responses within required timelines
• Apply checklist to rights requests

Privacy by Design

• Embed privacy during solution design
• Minimize collected and retained data
• Assess privacy risks before implementation
• Use privacy-by-design checklist for review

Day 3: Controlling Third Parties and Responding to Breaches

Third-Party Data Sharing

• Verify purpose before data sharing
• Limit disclosure to necessary information
• Confirm recipient safeguards and responsibilities
• Map partner responsibilities and controls

Breach Reporting and Response

• Recognize events requiring incident escalation
• Preserve essential facts and evidence
• Coordinate containment communication and recovery
• Prepare breach decision summary

Privacy Improvement Program

• Phase privacy priorities into actions
• Match privacy activities with capacity
• Set milestones exposing delays early
• Establish privacy program review cycles

• Cases examining data protection and privacy principles within realistic organizational constraints
• Hands-on exercises applying transparency and privacy notices to a defined workplace problem
• Small-group review of third-party data sharing using evidence and peer challenge
• A final workshop producing a privacy improvement program with accountable owners