IT

Prerequisites

We advise learners to have some prior practical Data Protection experience, although not essential. Attending the QA Data Protection Foundation (QACDPF) course is recommended but not mandatory.

Target audience

This Data Protection Foundation & Practitioner course is primarily aimed at DPOs and professionals working with IT, Risk, Security, Governance and Compliance roles across public and private sectors. It is also aimed at Human Resource and Marketing Professionals, Product Owners, Business Analysts and Project Managers.

Certified Data Protection Practitioner Course Content

Module 1: Data Protection Management Maturity

By the end of this module, learners will:

• Be able to establish their current level of compliance.
• Be able to conduct a self-assessment and create an improvement plan.
• Understand what data mapping is and why it is used.
• Be able to carry out a data mapping exercise.

Exercise: Accountability Framework and Implementation Plan Document

Module 2: Useful steps to compliance

By the end of this module, learners will be able to:

• Identify useful steps to take to achieve / maintain GDPR compliance.

Module 3: Data Protection by Design, by Default and DPIAs

By the end of this module, learners will:

• Understand what is meant by privacy by design.
• Know what a DPIA is.
• Understand how DPIAs are linked to the risk management approach.
• Understand how data mapping and creating information flows facilitate DPIAs.
• Be familiar with the ICO DPIA template and what the expected outputs of that framework are.
• Understand how DPIAs are used to check for and demonstrate compliance with the principles.
• Understand how DPIAs are used as part of the prior consultation process.

Exercise: DPIA

Module 4: Risk Management, Assurance and Appropriate Security

By the end of this module, learners will:

• Be able to determine what appropriate security is, using a risk-based approach.
• Understand what information assurance is and why an information assurance plan is required.
• Be able to create an information assurance plan.
• Understand what is meant by baseline control sets.
• Be able to implement a baseline control set for personal data.

Exercise: Baseline Control Sets and Risk Assessment for the process

Module 5: Obligations on Controllers and Processors

By the end of this module, learners will:

• Understand the obligations GDPR puts on controllers and processors.
• Understand the impact of the Data (Use and Access) Act 2025.
• Be able to identify ways their organisations can maintain compliance with these obligations.

Exercise: Breach Reporting

Exercise: Subject Access Requests

Module 6: Direct Marketing and Online Profiling

By the end of this module, learners will:

• Understand how the e-privacy review may potentially impact their organisation.
• Understand how the GDPR consent impacts on direct marketing operations.
• Understand the impact of the Data (Use and Access) Act 2025.
• Understand why consent clarification emails may not be legal.
• Understand why GDPR impacts how an organisations website works.
• Understand how GDPR consent applies for cookies and profiling.

Module 7: Transfers to Third Countries

By the end of this module, learners will:

• Understand how transferring data to processors or international organisations is impacted by GDPR.
• Understand what arrangements apply where no safeguards or adequacy agreements exist.
• Understand the impact of the Data (Use and Access) Act 2025.
• Understand international transfers.

Module 8: Privacy & Monitoring

By the end of this module, learners will:

• Be aware of privacy and monitoring aspects relating to GDPR.
• Be able to identify areas where DPIAs are necessary and critical to compliance.
• Be aware of relevant ICO guidance.

Module 9: Information Commission & Staying Compliant

By the end of this module, learners will:

• Understand the impact of the Data (Use and Access) Act 2025.
• Understand the new role of the Information Commission.
• Be aware of different approaches they can take to become and remain compliant.
• Be aware of useful privacy resources.

Exercise: Case Studies

Module 10: AI, Data Protection & Other Laws

By the end of this module, learners will:

• Understand how Data Protection & AI are related.
• Recognise the overlap between Data Protection & AI Governance.
• Explore key areas to consider AI under Data Protection.
• Recognise legislation related to AI & Data Protection.

Module 11: Introduction to AI Governance

By the end of this module, learners will:

• Be aware of AI Governance principles and strategies.
• Understand aims and objectives of EU AI Act.
• Introduction to the EU General Practice AI Code of Practice.

Module 12: Introduction to Privacy impact of Generative AI & AI Agents

By the end of this module, learners will:

• Understand the differences between Generative AI and AI Agents.
• Understand some of the risks and benefits of AI Agents and the privacy impact.

Module 13: Implementing AI Systems and Privacy

By the end of this module, learners will:

• Explore strategies and steps to addressing privacy risk when implementing AI.

Exams and assessments

Learners will be prepared for the independent APMG Data Protection Practitioner exam. The exam is administered separately and is not included as part of the teaching delivery. Exercises, reviews, and scenario-based work support exam readiness throughout the programme.

Hands-on learning

The course includes practical exercises, case studies, and real-world scenario analysis. Learners develop hands-on capability in DPIAs, breach reporting, information assurance planning, international transfers, and applying GDPR requirements.