Introduction to GDPR

About this package

Introduction to GDPR explains how data protection requirements affect the collection, use, storage and sharing of personal data in everyday work. It introduces the scope of the General Data Protection Regulation, including its application to organisations outside the EU in certain circumstances. Learners consider what counts as personal data, from names and addresses to IP addresses, cookie identifiers and location data, and why transparency and accountability matter.

The package examines the seven GDPR principles and the six lawful bases for processing, connecting legal requirements with practical decisions. It covers individuals’ rights, including access, rectification, erasure, portability and objection, alongside response deadlines and grounds for refusing requests. Privacy notices are another focus: learners are expected to explain processing purposes, lawful bases, retention periods, rights and international transfer safeguards clearly. The distinction between controllers, joint controllers and processors helps learners understand who makes decisions and who carries out processing.

The compliance content moves from understanding the rules to assessing organisational arrangements. Topics include data mapping, special-category and children’s data, Data Protection Impact Assessments (DPIAs), records of processing activities, the Data Protection Officer role, security measures and breach notifications. Supplier relationships and processor contracts are considered alongside consent records and legitimate interests assessments. The package also explains regulatory enforcement and the two-tier administrative fine structure, supporting risk-based decisions about which compliance gaps to address first.

The later sections focus on implementing and maintaining data protection practices rather than treating compliance as a one-off policy exercise. Learning outcomes include developing a 90-day implementation plan covering governance, policies, request handling, training and audit measures. The final section considers changing data protection expectations, including AI, international transfers and evolving UK rules. With video included, the package combines an introduction to key concepts with planning and evaluation outcomes for learners who have responsibilities for personal data.

Who it’s for

This package suits staff who handle personal data and learners developing an understanding of workplace data protection. Its compliance assessment and implementation planning outcomes also make it relevant to managers and those supporting organisational GDPR responsibilities.

What’s covered

1. Introduction to GDPR

   Introduces GDPR, its purpose and its territorial scope, including when it applies to organisations outside the EU. Explains personal data using examples such as names, IP addresses, cookie identifiers and location data.

2. Key Principles of GDPR

   Explains the seven Article 5 principles, including accountability, and what they require in practice. Covers the six lawful bases for processing, with examples linking different activities to an appropriate basis.

3. Rights of Data Subjects

   Covers individuals’ rights over their personal data, including being informed, access, rectification, erasure, portability and objection. Explains privacy notice requirements, response timelines and lawful grounds for refusing requests.

4. GDPR Compliance

   Examines five practical compliance mechanisms: DPIAs, record-keeping, the Data Protection Officer role, security measures and breach notifications. Supports identifying when these mechanisms apply and the actions organisations need to take.

5. Responsibilities of Data Controllers and Processors

   Distinguishes organisations that decide why and how data is used from those processing it on another organisation’s behalf. Considers controller, joint controller and processor relationships, including accountability and contractual responsibilities.

6. Penalties and Enforcement

   Explains regulatory enforcement and the two tiers of administrative fines under Article 83. Covers how fixed monetary limits and percentages of worldwide annual turnover are used to assess maximum fines.

7. Implementing GDPR in Organisations

   Sets out practical steps for building data protection into everyday operations, supported by staff training and ongoing review. Includes implementation planning across governance, policies, processing records, supplier checks, consent management, request workflows and breach procedures.

8. Future of Data Protection

   Explores changing regulatory expectations and their implications for organisational compliance. Topics include AI governance, international data transfers, evolving UK rules and developments affecting individual rights.

Learning outcomes

By completing this package, learners can:

• List the seven GDPR principles in Article 5 and the six lawful bases for processing in Article 6, defining each in one sentence with the correct Article reference.
• Describe data subject rights under Articles 12–22, the standard one-month response deadline, the possible two-month extension for complex requests, and lawful grounds for refusal.
• Classify at least three real-world scenarios as controller, joint controller or processor relationships, justifying the classifications using accountability and contract criteria.
• Draft a 150–200-word privacy notice for a given processing activity, stating the controller’s identity, purposes, lawful basis, retention period, data subject rights and international transfer safeguards.
• Analyse an organisational data map to identify personal data, special-category data, children’s data and cross-border transfers; determine whether a DPIA is required under Article 35 and document at least three risk mitigations.
• Evaluate an organisation’s GDPR compliance using a structured checklist covering records of processing activities, processor contracts, consent records and breach response; justify risk-based remediation priorities and calculate maximum administrative fines using the 2%/€10 million and 4%/€20 million thresholds under Article 83.
• Design a 90-day GDPR implementation plan for a mid-sized organisation covering governance roles, key policies, records of processing activities, processor due diligence, legitimate interests assessments, consent management, data subject request workflows, breach notification procedures, training and audit metrics.
• Predict at least two data protection developments over the next two to three years, such as international transfer frameworks, AI governance or ePrivacy rules, and summarise their implications for organisational compliance programmes.

Frequently asked questions