GDPR Compliance

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

1. 1

   What GDPR is, and who it applies to

   GDPR is an EU law that protects the personal data of people in the EU. It follows those people, so a company outside Europe with EU customers can be covered.

2. 2

   Know what personal data you hold, and your role

   GDPR follows personal data. Know what counts as personal data, whether you are a controller or a processor for it, and where it goes.

3. 3

   Your reason to use data, and people's rights

   GDPR has two halves. You need a valid reason, called a lawful basis, before you use personal data, and people have rights over the data you hold, including the right to have it deleted.

4. 4

   Turn GDPR into everyday work

   Being accountable under GDPR takes more than a privacy policy on your website. It is a short list of jobs: map your data, build privacy in, assess risky work, sign contracts with your vendors and tell people clearly.

5. 5

   When personal data leaks: the 72-hour rule

   When a breach of personal data puts people at risk, you tell the regulator without undue delay, and where feasible within 72 hours of becoming aware. You also keep a record that shows what you did.

6. 6

   Keep GDPR working over time

   GDPR is an ongoing program, not a launch project. You keep the data map, lawful bases, rights handling, DPIAs, transfers and training up to date, and data leaving the EU needs a valid transfer route.

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

• You answer 6 short questions, one for each module, in your own words (at least 40 words each).
• An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
• To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

1. Module 1, What GDPR Actually Is: A correct model: an EU law with global reach, enforced by DPAs — not a certificate.
2. Module 2, Personal Data, Roles & Scope: A clear view of your personal data and whether you're a controller or processor.
3. Module 3, Lawful Basis & Data-Subject Rights: A lawful basis for each processing activity and a process to honor rights requests.
4. Module 4, Your Core Obligations: A RoPA, privacy-by-design defaults, and DPIAs/DPAs/DPO where required.
5. Module 5, Breach Notification & Accountability: A breach plan built to the ~72-hour expectation, with the evidence to prove compliance.
6. Module 6, Staying Compliant: A continuous GDPR program covering rights, transfers, and ongoing accountability.

What you walk away with