This course is available in the Classroom and via Teams

Data Security

Course Overview:

Data protection law requires that personal information must be processed in a manner that ensures appropriate security. When it comes to regulatory enforcement, a failure to comply with this obligation is one of the most frequent infringements identified by the Data Protection Commission resulting in fines and sanctions for organisations. It is not always obvious what measures should be taken by organisations to comply with this obligation and to avoid regulatory sanction.

This session looks at the practical steps that organisations need to take to keep personal data safe, to ensure compliance with their obligations, and to meet regulator expectations.  It concentrates on how to avoid breaches from a legal and practical point of view, as well as considering the implications of any breach that might occur.

Key aspects of this session include:

• analysis of the legal requirements for keeping personal data secure
• a review of recent Data Protection Commission decisions setting out its recommendations for GDPR compliance
• key physical, technical and organisational measures that every organisation should consider
• the requirement for documentation and how to comply with it
• an introduction to the requirements of ‘data protection by design’, and ‘data protection by default’
• the data security implications of using 3rd parties to process personal information, such as external contractors and outsourced service providers, including cloud service providers
• informing individuals and notifying the Commissioner about data security breaches - what is required and how to go about it
• the powers of the Data Protection Commissioner and other legal and commercial consequences of data security breaches

Attendance on this course can be used as credit towards gaining the Practitioner Certificate in Data Protection.