Only Few Seats Left

Module 1

Introduction to Data Collection, Processing, Protection, and Transfer under EU GDPR

A. Why is data sought to be protected, and what are the different types of data? — Covers the rationale behind data protection and the classification of personal, sensitive, and special categories of data.

B. Are you a Data Controller or a Data Processor? — Explains how to identify your role in data handling and the distinct responsibilities attached to each.

C. Does the GDPR apply to you? — Covers the territorial and material scope of GDPR, including its extraterritorial reach over non-EU entities.

D. Rights of Data Subject — Examines the rights of individuals such as access, rectification, erasure, portability, and objection under GDPR.

E. The Obligation of a Data Controller and a Processor under GDPR — Details the compliance duties of controllers and processors, including lawful basis, security measures, and accountability.

F. Data commodification — under what conditions can you buy and sell data — Explores the legal limits and conditions under which personal data can be monetised or traded.

G. Cross-Border Transfer of Data — Covers mechanisms like adequacy decisions, SCCs, and BCRs for lawfully transferring data outside the EU.

H. Data Retention and Data Graveyards — Explains retention limits, storage limitation principles, and risks of holding obsolete or unused data.

I. What are the consequences of ignoring Data Protection Responsibilities — Covers penalties, fines, enforcement actions, and reputational risks of non-compliance.

J. How to conduct Legitimate Interest Assessment (LIA) — Teaches the three-part test (purpose, necessity, balancing) to rely on legitimate interest as a lawful basis.

K. How to Conduct a Data Protection Impact Assessment — Covers when a DPIA is mandatory and the step-by-step process of assessing high-risk processing.

L. AI governance: Introduces why AI systems need governing, the common risks such as bias and opacity, the risk categories under the EU AI Act, and the four functions of the NIST AI Risk Management Framework.

Module 2

Data Processing Agreement and Related Work Under GDPR

A. How to draft a Data Processing Agreement — Covers the mandatory clauses under Article 28 and practical drafting of controller-processor contracts.

B. How to Draft Privacy Policies so that they are compliant with the GDPR — Teaches drafting transparent, complete privacy notices meeting Articles 13 and 14 requirements.

C. How to Draft a Privacy and Cookie Policy — Covers cookie consent requirements, ePrivacy rules, and drafting compliant cookie banners and policies.

D. How to Implement Privacy by Design — Explains embedding data protection principles into products, systems, and processes from the design stage.

E. How to Conduct a Transfer Impact Assessment — Covers assessing destination-country laws and supplementary measures post-Schrems II before transferring data abroad.

F. AI use policy: Covers approved and prohibited uses, rules on putting personal or confidential data into AI tools, and who approves an AI tool before adoption.

Module 3

Data Protection Practice in India

A. Indian Data Protection, DPDPA 2023 — Introduces the framework, key definitions, and obligations of Data Fiduciaries under the Digital Personal Data Protection Act, 2023.

B. Indian DPDPA Rules 2025 — Covers the operational details in the Rules, including consent notices, breach reporting, and Consent Manager provisions.

C. Implementation of Indian Data Protection Law — Focuses on practical compliance steps for businesses transitioning to the DPDPA regime.

Module 4

Privacy Law Compliance in the US

A. Federal data protection laws in the U.S. — Surveys sectoral federal laws such as HIPAA, GLBA, COPPA, and the FTC's role in privacy enforcement.

B. Important state data protection laws in the US — Covers key state statutes like those of Virginia, Colorado, Texas, and other comprehensive state privacy laws.

C. Data Protection Law in California — Examines the CCPA and CPRA, consumer rights, and business obligations under California's regime.

D. How to Comply with HIPAA Rules — Covers the Privacy, Security, and Breach Notification Rules applicable to protected health information.

E. How to handle DSRs in the US — Teaches processes for receiving, verifying, and responding to consumer data subject requests within statutory timelines.

F. How to prepare a gap report for US privacy laws — Covers auditing an organisation's practices against US privacy requirements and documenting compliance gaps.