Data protection by design requires organisations to take steps to ensure that personal data processing activities are designed to comply with data protection law and protect the rights of data subjects. Data protection by default requires that the default position for any data processing activity should be to carry out the minimum amount of processing.
Organisations need to apply these requirements throughout the lifecycle of any processing activity. This means that they need to set up processes to assess data protection issues during the initial design and development of any new system, project or other activity involving personal data. They will then need regularly to review design features to ensure ongoing compliance.
This course is designed for organisations to gain an understanding of the legal requirements for data protection by design and by default under the UK GDPR (as amended by the Data (Use and Access) Act 2025), and how to apply these requirements in practice. Using practical examples, the course includes:
- essential requirements for data protection by design and by default
- responsibilities for compliance
- practical application of the rules to comply with the data protection principles
- practical application of the rules to protect the rights of data subjects
- how to manage data protection by design and by default within project initiation procedures and using data mapping
- how to assess risk
- use of data protection impact assessments in the context of design and default
It is recommended that delegates attending this session have a basic knowledge of current data protection legal requirements. Delegates with no existing knowledge may find it helpful to attend Data Protection Essential Knowledge Level 1 before undertaking this training course.
“Very impressed with this course, which was easy to understand but went into enough technical detail.”