The GDPR (General Data Protection Regulation) provides a single, harmonised data privacy law across the EU, and Guernsey has updated its own law to reflect these new rules. All organisations need to respond to fast changing risk in this area – with cyber-attacks and poor information governance featuring heavily in recent times.

The GDPR tightens up on rules around data security and information handling and will require a comprehensive risk-based approach by all those handling personal data.

This Foundation element of the course provides a complete introduction to the EU GDPR and an overview of the key implementation and compliance activities.

Topics include:

• Bands of penalties for breaches
• Lawfulness of processing and consent
• The six data protection principles
• Special categories of personal data
• The rights of data subjects, including data access requests
• Controllers and processors
• Data protection by design
• Securing personal data
• How to perform a DPIA
• Reporting data breaches
• The DPO role
• Transferring personal data outside the EU
• Certification against the GDPR
• The powers of supervisory authorities
• Lead supervisory authorities
• The role of the EDPB (European Data Protection Board)

Who should attend this course:

Business Directors or Managers who want to understand how the requirements of the GDPR will affect their organisation, such as:

• Those employed in a risk or compliance department
• Information Security Managers
• IT Managers
• Data Analysts
• Project Managers
• General or privacy counsels
• Individuals with a basic knowledge of data protection regulation and practices who want to develop their career with a professional qualification

Read the States of Guernsey's draft legislation document The Data Protection (Bailiwick of Guernsey) Law, 2017 (published in November 2017).