Data protection and privacy
You apply GDPR principles and the KVKK example, and set up data inventory, notices, consent, breach notification and retention processes.
Level 201 · 21 lessons · 18 practice labs
Lessons
Foundations
- Privacy and security: the difference and the link: You can show with examples that keeping data secure does not mean it is processed lawfully.
- Personal, special-category, anonymous and pseudonymised data: You sort the fields in a dataset by type and identify which need extra protection.
- Roles: controller, processor, data subject: You identify who is controller and who is processor in a business relationship and divide the duties.
- The legal landscape: GDPR, Türkiye’s KVKK and others: Using the EU GDPR as the anchor, you compare examples such as Türkiye, the UK and US state laws.
- Quick task: classify the fields of a form
Principles and lawful basis
- Processing principles: purpose limitation, minimisation, accuracy: You test whether every field on a form is really needed, using the processing principles.
- Lawful bases: contract, legal obligation, legitimate interests: You choose the right lawful basis for each processing activity and write down why.
- Explicit consent: when it is needed and how to obtain it validly: You know consent must be free, informed and withdrawable, and can fix examples of invalid consent.
- Writing a privacy notice: You can write a plain-language notice telling people who processes which data, why and for how long.
- Quick task: pick lawful bases for processing activities
Putting it into practice
- Data inventory and records of processing: By interviewing departments, you record which personal data is held where, for what purpose and by whom.
- Data subject requests: access, rectification, erasure: You can answer a request to access or erase data within the deadline, after verifying the requester’s identity.
- Privacy by design and by default: You can ask the questions that build privacy in from the start when a new app or process is designed.
- Data protection impact assessment (DPIA): You can run an impact assessment covering risks and safeguards for a high-risk processing activity.
- Processor contracts and international transfers: You check data protection terms in a supplier contract and identify the safeguards needed for international transfers.
- Retention periods, deletion, destruction and anonymisation: You set a retention period for each type of data and choose a safe way to dispose of it when it expires.
- Quick task: answer an access request
Breaches and accountability
- Assessing a personal data breach: You can decide whether an incident is a personal data breach and how much risk it poses to people.
- Notifying within 72 hours: regulator and individuals: You can prepare the notice to the regulator and affected people on time and with the required details.
- Accountability and the data protection officer: You know how to keep records that prove compliance and how to position the data protection officer’s role.
- Capstone: audit an HR process for data protection compliance: You review the data, lawful bases and retention in a hiring process, find the gaps and write a correction plan.
Practice labs
- Classify fields by data type: Classify the fields of a recruitment form as personal, special-category or non-personal.
- Anonymous or pseudonymised: Decide whether six sample datasets are anonymous or pseudonymised by looking at the re-identification risk.
- Who is controller, who is processor: Identify controller and processor, with reasons, in six relationships involving payroll, cloud storage and a marketing agency.
- Name the principle that is broken: Match eight short scenarios to a breach of purpose limitation, minimisation, accuracy or storage limitation.
- Pick a lawful basis for each activity: Pick the lawful basis for ten Turnalı Perakende processing activities and justify each in one sentence.
- Make the consent wording valid: Find the defects in a consent screen with a pre-ticked box and bundled purposes and write a valid version.
- Find the missing section in the notice: Compare a privacy notice with the list of required sections and mark the missing ones.
- Write five lines of the processing record: From a description of an HR process, write five record lines with purpose, data category, recipient and retention period.
- Reconcile the notice with the record: Find seven inconsistencies between Mercanköşk Otelcilik's privacy notice and its processing record and state which document to correct.
- Work out the request deadline: For six requests with a received date, write the response deadline and whether an extension is possible.
- Answer an access request: Compile a customer's records pulled from four systems, remove third-party information and prepare the response pack.
- Erasure request versus the duty to keep: For a customer with invoice, warranty and marketing records, write what to erase and what to keep and on which basis.
- Is a DPIA needed: Mark whether a DPIA is needed for eight project summaries against the criteria.
- Find the gaps in a processor contract: Compare a cloud payroll service contract with the list of required clauses and report the six missing ones.
- Build a retention and destruction schedule: Prepare a schedule with retention period, basis and destruction method for ten data categories of Sedirli Hukuk Bürosu.
- Is this a personal data breach: Classify ten events as a confidentiality, integrity or availability breach, or state that there is no breach.
- Assess the risk of the breach: For a lost unencrypted laptop, set the risk level from the number of people affected, the data type and the likely harm.
- Write the 72-hour notification: From the timeline of a patient data breach at Lavinya Klinikleri, draft the notification to the authority and the message to the individuals.
About this course
You apply GDPR principles and the KVKK example, and set up data inventory, notices, consent, breach notification and retention processes.
What you will learn
- Foundations
- Principles and lawful basis
- Putting it into practice
- Breaches and accountability
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.