Online GDPR Course

Module 1 – UK GDPR & Data Protection

This module introduces GDPR, its importance in protecting personal information, and organisations’ and employees’ responsibilities.

The UK GDPR and Data Protection Act 2018 govern personal data collection, use, storage, sharing and protection. They help prevent misuse, unauthorised access, identity theft and financial fraud, giving individuals greater control over their information.

The Information Commissioner's Office (ICO) enforces UK data protection law. Non-compliance may lead to investigations, financial penalties and reputational damage.

Two key roles are:

• Data Controllers decide why and how personal data is processed, ensuring lawful, fair and secure handling.
• Data Processors handle personal data for controllers, following their instructions and maintaining appropriate security.

Employees must keep information confidential, use it only for authorised purposes, store records securely and promptly report suspected breaches.

The module distinguishes personal data, such as names, addresses and contact details, from special category data, such as health information, religious beliefs and racial or ethnic origin, requiring additional protection.

Properly anonymised data cannot reasonably identify an individual and falls outside UK GDPR. Pseudonymous data can identify someone using additional information and remains legally protected.

Module 1 emphasises lawful, secure and responsible data handling, everyone’s role in protecting personal information, and maintaining trust.

Module 2 – UK GDPR & Data Protection

This module covers the seven data protection principles, lawful bases for processing personal information, individual UK GDPR rights and handling Subject Access Requests (SARs).

The seven principles require lawful, fair and transparent processing, specified purposes, necessary data only, accurate records, limited retention, protection against unauthorised access and demonstrable compliance.

The seven lawful bases are consent, contractual necessity, legal obligations, vital interests, public tasks, legitimate interests and recognised legitimate interests. Organisations must identify an appropriate basis before processing; consent is not always required.

UK GDPR gives individuals eight core rights: information, access, correction, erasure, restricted processing, data transfer, objection to certain uses and safeguards for automated decision-making.

SARs let individuals obtain copies of their personal information and understand its use. Requests can be verbal or written, with no specific wording required.

Organisations must generally respond within one month, with extensions in certain circumstances. SARs are normally free, and disclosure requires appropriate identity and authorisation checks.

Employees must recognise, record and promptly forward potential SARs to the appropriate person, maintain confidentiality and help locate information when authorised.

Module 2 emphasises following data protection principles, respecting individual rights and handling information requests appropriately to maintain transparency, accountability and UK GDPR compliance.

Module 3 – UK GDPR & Data Protection

This final module covers data protection complaints, information security, personal data breaches and employees' workplace data protection responsibilities.

Individuals can raise concerns about organisations' handling of their personal data. Organisations must maintain appropriate complaints procedures, acknowledge complaints within 30 days, investigate and communicate outcomes without undue delay.

The module stresses securing personal information through strong passwords, multi-factor authentication, secure emails, phishing awareness, protected paper records and safe remote working.

A personal data breach is an accidental or unlawful loss, destruction, alteration, disclosure or unauthorised access. Examples include misdirected confidential emails, lost devices containing personal information, and unauthorised access to records.

Employees must recognise and immediately report suspected breaches, take authorised containment steps, preserve evidence and cooperate with investigations.

Under UK GDPR, organisations must report certain personal data breaches to the Information Commissioner's Office (ICO) within 72 hours, where feasible, if likely to risk individuals' rights and freedoms. Serious breaches may also require notifying affected individuals.

Workplace responsibilities include accessing personal information only when necessary, sharing only with authorised recipients, following retention and disposal procedures, and embedding data protection in new systems and working practices.

GDPR non-compliance can lead to regulatory investigations, financial penalties, legal action and reputational damage. Employees may face disciplinary action for not following organisational procedures.

Module 3 emphasises everyone's responsibility to protect personal information. Secure working, risk awareness and prompt incident reporting help prevent breaches, protect privacy and ensure organisational UK GDPR compliance.