Description

This course is designed for employees and other individuals who handle, access or may be exposed to personal data as part of their work and require an understanding of their responsibilities for protecting personal information and complying with the UK privacy framework. The course introduces the principles of data protection and the requirements of the Data Protection Act 2018, UK General Data Protection Regulation (UK GDPR) and relevant provisions of the Data (Use and Access) Act 2025. Learners develop an understanding of personal data, special category data, data subjects, controllers and processors, together with the activities that constitute processing and the territorial scope of UK data protection requirements. Learners explore the principles governing lawful and responsible processing and the lawful bases on which personal data may be processed, including consent, contractual necessity, legal obligations, vital interests, public interest, legitimate interests and recognised legitimate interests. The course also considers requirements for valid consent, privacy information and the collection of personal data from both data subjects and other sources. The course examines the rights available to data subjects, including rights relating to information, access, rectification, erasure, restriction, data portability, objection and automated decision-making. Learners also consider complaints concerning data protection compliance and the responsibilities of organisations when responding to individuals exercising their rights. Learners develop awareness of organisational and individual responsibilities for protecting personal data, including privacy policies, processor arrangements, recordkeeping, data minimisation, data mapping, confidentiality, integrity, availability and resilience. The course also introduces security measures such as pseudonymisation and encryption and considers the safeguards required when transferring personal data outside the UK. The course further considers Data Protection Impact Assessments (DPIAs), circumstances in which they may be required and their role in identifying and controlling risks to individuals. Learners examine personal data breaches, including organisational reporting responsibilities, notification to the Information Commissioner where required, communication with affected data subjects and the potential regulatory consequences of non-compliance. This eLearning course provides general awareness of UK privacy and data protection requirements and does not constitute legal advice.

Topics