The GDPR provides a single, harmonised data privacy law across the EU, and Guernsey has updated its own law to reflect these new rules. All organisations need to respond to fast changing risk in this area – with cyber-attacks and poor information governance featuring heavily in recent times.

The GDPR tightens up on rules around data security and information handling and will require a comprehensive risk-based approach by all those handling personal data.

This Foundation element of the course (day 1) provides a complete introduction to the EU GDPR, and an overview of the key implementation and compliance activities.

Day 1 focuses on:

• Bands of penalties for breaches
• Lawfulness of processing and consent
• The six data protection principles
• Special categories of personal data
• The rights of data subjects, including data access requests
• Controllers and processors
• Data protection by design
• Securing personal data
• How to perform a DPIA (Data Protection Impact Assessment)
• Reporting data breaches
• The DPO role
• Transferring personal data outside the EU
• Certification against the GDPR
• The powers of supervisory authorities
• Lead supervisory authorities
• The role of the EDPB (European Data Protection Board)

On the Practitioner element of the course (days 2-5) you will understand how to implement an effective privacy and information security compliance programme in line with the GDPR, which is essential for anyone involved in implementing and maintaining GDPR compliance in their organisation.

Days 2 – 5 focuses on:

• The role of the DPO (Data Protection Officer)
• What constitutes personal data
• Accountability, the privacy compliance framework and a PIMS (personal information management system)
• Lessons to be learned from common data security failures
• The six data protection principles – how to apply them and demonstrate compliance
• The security of personal data
• An organisational risk management framework
• Legal requirements for a DPIA
• How to conduct a DPIA with a DPIA tool
• Why and how to conduct a data mapping exercise
• The rights of data subjects
• Giving and withdrawing consent
• Handling DSARs (data subject access requests)
• The roles of controllers and processors, and the relationships between them
• Transferring personal data outside the EU and the mechanisms for compliance
• How to become GDPR compliant using a compliance gap assessment tool

Who should attend this course:

• Privacy Managers
• Data Protection Managers
• Information Security Managers
• IT Managers
• Project Managers
• Corporate Governance Managers
• Risk and Compliance Managers
• General or privacy counsels
• Individuals with little experience but who wish to enter the field of data protection with a professional qualification

Read the States of Guernsey's draft legislation document The Data Protection (Bailiwick of Guernsey) Law, 2017 (published in November 2017)