GDPR for Data and Product Teams: The Principles in Practice
GDPR for Data and Product Teams is a beginner-level course of 5 lessons (about 1 h 35 min), with 15 exercises and 15 quiz questions. No prerequisites. Exercises run in the browser, with nothing to install.
- Cross-functional skills
- Beginner
- 5 lessons
- 1 h 35 min
- 15 exercises
- Exercises run in the browser
The course in brief
This course gives data and product teams, and their managers, the GDPR principles they need day to day. You learn to recognize personal data, choose a legal basis, fill in a record of processing entry and set retention periods. You know how to handle a data subject rights request, oversee a processor and respond to a data breach. The course sticks to established principles and does not replace the advice of your DPO.
What you will be able to do
- Identify personal, sensitive, pseudonymized and anonymous data
- Apply the GDPR principles and choose the legal basis for a processing activity
- Fill in a record of processing entry with justified retention periods
- Handle an access, erasure or objection request within the deadlines
- Oversee a processor and a transfer outside the Union
- Respond to a data breach following the prescribed process
Syllabus: 5 lessons
- Recognize personal data, including indirect data
- Distinguish sensitive, pseudonymized and anonymous data
- Identify a processing activity and the controller
- 02
Principles and Legal Bases
- Apply the main GDPR principles to a project
- Choose the legal basis suited to a purpose
- Design a compliant collection by design
- 03
The Record of Processing and Retention Periods
- Explain the role of the record of processing activities
- Fill in a complete record entry
- Define justified retention periods
Record of processingRetention periodsImpact assessment (DPIA)
- 04
Data Subject Rights
- Know the rights the GDPR gives to people
- Handle a rights request within the deadlines
- Design a product that makes it easy to exercise rights
- 05
Security, Processors and Breaches
- Choose security measures appropriate to the risks
- Oversee the use of a processor and transfers outside the EU
- Know how a data breach is managed
Final project
GDPR File for a New Feature
Your team is launching a referral program in a fictitious application: a user invites a friend by email, and both receive a benefit. Build the feature's GDPR file: data inventory, legal bases, record entry, rights exercise journey, processor analysis and breach procedure.
Deliverables
- An inventory of the data collected (including the referred friend's) with a justification for each
- The purposes and their legal basis
- A complete record entry with retention periods
- The description of the rights exercise journey in the application (access, erasure, objection)
- An analysis of the processors (emailing, hosting) and any transfers outside the EEA
- A short breach management procedure adapted to the feature
Assessment criteria
- Minimization and data protection by design visible in the choices
- Legal bases correctly justified, in particular for the referred friend who is not yet a user
- Complete record entry and justified periods
- Rights and breach processes consistent with the deadlines
- Accuracy: no unestablished legal claims, referral to the DPO for decisions
Frequently asked questions
Is this course only for lawyers?
No. It is aimed at data and product teams, and their managers, who design processing activities day to day. It presents the established GDPR principles with practical exercises.
Does this course replace the DPO's advice?
No. It gives you the right reflexes and the vocabulary to work with your data protection officer, who remains the contact for specific cases.
Do I need to know how to code?
No. The exercises consist of analyzing cases, filling in forms and making decisions. Technical examples are offered for those who want them.
Is pseudonymized data subject to the GDPR?
Yes. As long as re-identification remains possible, the data remains personal. Only truly anonymized data falls outside the scope of the GDPR.
This course, told for your job
Say what you want to be able to do: “GDPR for Data and Product Teams” takes its place in your path, with examples from your field. The concepts stay those of the course.