GDPR in depth
You study the articles of GDPR, European Data Protection Board guidance and landmark decisions, and apply hard topics such as the legitimate interest test, transfer impact assessments and joint controllership through case studies.
Level 301 · 17 lessons · 15 practice labs
Lessons
Structure and scope
- GDPR's structure: articles and recitals
- Territorial scope and representatives
- Key definitions and edge cases
- Quick task: scope decisions for six companies
Lawful basis in depth
- The legitimate interest balancing test
- Conditions for special-category data
- Children's data
- Profiling and automated decisions
- Quick task: write a legitimate interest assessment
Roles and transfers
- Joint controllership
- Processor contracts (Article 28)
- International transfers: adequacy, SCCs, BCRs
- Transfer impact assessments
- Quick task: a data transfer map
Enforcement
- The one-stop-shop and cooperation
- Landmark decisions and fines
- Capstone: a GDPR assessment of an ad-tech company
Practice labs
- Find the article and the recital: For eight questions, find the relevant GDPR article and the recital that explains it in the text provided.
- Scope decisions for six companies: For six companies, write whether GDPR applies and whether a representative is needed from their establishment and target market.
- Edge cases of the definitions: Assess eight edge cases such as dynamic addresses, pseudonymised research data and records of the deceased against the definition of personal data.
- Pick the condition for special-category data: Pick the fitting condition for processing special-category data for eight activities.
- Write a legitimate interest assessment: Write the purpose, necessity and balancing tests for a shop's customer scoring for fraud prevention.
- Challenge a weak balancing test: Find the flaws in a legitimate interest assessment written for location-based marketing and justify the correct outcome.
- Apply the age threshold for children's data: For six country and age scenarios, decide whether parental authorisation is needed using the given threshold table.
- Automated decision or not: Assess whether eight decision processes are solely automated and whether they produce legal or similarly significant effects.
- Design safeguards for credit scoring: Write the information, human intervention and contest safeguards for Yelkovan Bankası's automated credit decision.
- Decide the role: joint or separate: In six collaboration scenarios, decide whether the parties are joint controllers, separate controllers or processor.
- Check an Article 28 contract: Check a processor contract for the instructions, confidentiality, security, sub-processor, assistance, return and audit clauses.
- Write a joint controller arrangement: Write the allocation of duties between an event organiser and a ticketing platform and the essence to be made available to individuals.
- Choose the transfer tool: For eight transfer scenarios, choose adequacy, standard contractual clauses, binding corporate rules or a derogation.
- Draw up a data transfer map: From a software company's supplier list, produce a map with data category, destination country, transfer tool and sub-processors.
- Write a transfer impact assessment: Write a document assessing destination law, access risk and supplementary measures for a transfer to a support provider.
About this course
You study the articles of GDPR, European Data Protection Board guidance and landmark decisions, and apply hard topics such as the legitimate interest test, transfer impact assessments and joint controllership through case studies.
What you will learn
- Structure and scope
- Lawful basis in depth
- Roles and transfers
- Enforcement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.