This ten-day programme prepares professionals to protect personal data, respect privacy, and meet regulatory expectations in organisations that depend on digital products, platforms, data sharing, and cross-border services. It connects legal principles with the operating controls needed to apply them: governance, records, consent and transparency, vendor management, security, risk assessment, and breach response.
The course is principle-based and practical. It uses widely recognised approaches reflected in regimes such as the GDPR and similar data protection laws, together with common digital-economy issues such as online services, cloud processing, marketing, cookies and tracking, international transfers, and the use of analytics and artificial intelligence. It builds professional judgement for compliance and privacy operations. It is not a substitute for legal advice on a specific law, contract, or enforcement matter.
Why privacy and data protection matter to trust, regulation, and business value
Personal data, special categories, and data that can identify someone indirectly
Digital-economy contexts: platforms, apps, cloud, marketplaces, and data-driven services
Controllers, processors, joint roles, and accountability
Mapping where personal data is collected, used, shared, and stored
Purpose limitation, minimisation, accuracy, storage limitation, security, and accountability
Lawful bases and when each is appropriate, including consent and legitimate interests
Transparency and fair notice in digital journeys
Using data only for compatible purposes
Workshop: Testing a digital service against core principles
Individual rights: access, correction, deletion, objection, portability, and restriction
Designing notices, preference centres, and request-handling processes
Children, vulnerable users, and higher-risk contexts
Marketing, profiling, and automated decision-making at a compliance level
Workshop: Designing a rights and transparency process for an online service
Privacy governance: leadership, data protection officer or equivalent, and decision rights
Policies, standards, and procedures that staff can follow
Records of processing and data inventories
Training, awareness, and accountability in business teams
Linking privacy with information security, risk, and legal functions
Websites, apps, cookies, pixels, and similar tracking technologies
Consent and transparency for analytics, advertising, and communications
Direct marketing rules at a principles level
Data sharing with advertising, analytics, and platform partners
Workshop: Reviewing a digital marketing and tracking setup
• Processor due diligence and contractual clauses
Shared responsibility in cloud and software-as-a-service
International transfers and appropriate safeguards
Sub-processors, localisation, and access by third parties
Ongoing vendor monitoring, not only contract signature
Workshop: Assessing a cloud or supplier arrangement
Building protection into products, processes, and projects
When a data protection impact assessment is needed
Risk to individuals versus risk to the organisation
Mitigations: minimisation, access control, retention, and human review
Analytics, artificial intelligence, and new data uses
Workshop: Completing a structured impact assessment for a sample initiative
Security measures expected for personal data
Access, encryption, monitoring, and supplier security at a governance level
Retention schedules, deletion, and records that must be kept
Evidence regulators and auditors expect to see
Common control failures in digital businesses
Recognising a personal data breach and other privacy incidents
Containment, assessment, notification considerations, and communication
Handling complaints and rights requests under time pressure
Working with regulators: cooperation, remediation, and documentation
Lessons learned and control improvement
Workshop: Managing a breach scenario from detection to decision
Compliance monitoring, internal review, and assurance
Metrics for governance, rights handling, vendors, incidents, and training
Prioritising remediation in a complex digital business
Reporting to executives and oversight bodies
Capstone: Build a privacy and regulatory compliance programme covering governance, high-risk processing, vendors, rights, incidents, and reporting
Training a team? Request private delivery at your workplace or online, tailored to your priorities. We’ll confirm the scope, dates and fees in your proposal.
Tell us what your organisation needs. The Komatek Academy team can discuss group pricing, preferred dates, delivery format and tailored course content.
Typically replies within a day