Personal Data Protection Officer - Basic Level Training Course

Fundamental Principles of Personal Data Processing

• Sources of national and international law.
• The scope of application of personal data protection laws.
• The powers granted to the data protection authority.
• Judicial protection of the right to personal data protection.
• GDPR - essential information and definitions - key issues.
• Sector-specific GDPR requirements.
• Defining personal data.
• The concept and practice of data processing.
• Legal bases for processing personal data.
• Responsibilities of the Data Controller.
• Rights of data subjects.
• Administrative fines and penalties.
• Personal Data Protection Act of 10 May 2018 - regulatory scope.
• Procedures for appointing a Data Protection Officer.
• Proceedings for violations of personal data protection laws.
• Monitoring compliance with personal data protection regulations.
• Civil, criminal, and administrative liability.
• Conditions for the admissibility of processing personal data (including ordinary and sensitive data).
• Legal requirements for entrusting personal data processing to third-party entities.
• Data Protection Impact Assessment (DPIA).
• Data protection by design and by default.
• Legal bases for transferring personal data to third countries.
• Protection of personal data within employment relationships.

Appointment of a Data Protection Officer

• Mandatory appointment requirements for a Data Protection Officer.
• Voluntary appointment of an Inspector (internal auditor).

Eligibility to Serve as a Data Protection Officer

• Qualifications required to act as an Inspector.
• Forms of employment for the Inspector.

Status and Role of the Data Protection Officer

• Direct reporting lines from the Inspector to top management.
• Arranging necessary support for the Supervisor.
• Participation of the Inspector in all matters pertaining to personal data protection.
• Prohibition on directing the Supervisor on how to execute duties.
• Avoiding conflicts of interest within the organization - duties of the Supervisor.
• Protection against dismissal and punishment for the Inspector.
• The Inspector's duty to maintain secrecy or confidentiality regarding performed tasks.

Information Security Management

• Discussion of the organization's security management system, referencing Polish standards.
• Identification of privacy risks and their legal implications.
• Principles of risk assessment and evaluating the impact of specific solutions on safety management effectiveness.
• Understanding and applying a risk-based approach - practical completion of a Risk Analysis template.
• Personal Data Lifecycle Management.

Executing the Duties of a Data Protection Officer (DPO)

• Legal basis for appointing the DPO.
• Identifying who must appoint a DPO, when, and the procedure for appointment.
• DPO status and necessary qualifications.
• DPO tasks and rules for planning their execution.
• Conducting reports on data processing compliance with personal data protection laws, covering both traditional and IT systems.
• Documenting activities carried out by the DPO.
• Preparation of inspection reports.
• Rules for supervising personal data processing documentation.
• Powers of the Office for Personal Data Protection (UODO) in relation to DPOs.

Practical Guidance on Inspections by the Office for Personal Data Protection

• Requirements imposed on auditees during inspections.
• How to prepare for an inspection.
• Case study analysis.

Practical Exercises

• Developing an exemplary Information Security Policy.
• Drafting management instructions.
• Creating a Register of Processing Activities.
• Preparing 'Small' Personal Data Protection Documentation.
• Case study participation.
• Identifying common errors in documentation preparation.

Additional Materials for Participants:

Useful Forms and Templates:

• Consent for the use and dissemination of images.
• Newsletter opt-in form.
• Consent to receive a business offer.
• Template for sending offer emails.
• Template for general correspondence emails.
• Example of a personal data protection policy.
• Template for preparing information obligations under GDPR, including instructions.
• Risk analysis template.
• Register of personal data processing activities - template.
• Register of processing activity categories - template.
• GDPR Breach Register - Template.
• GDPR Compliance Checklist Template.
• Instructions for handling breaches of personal data protection regulations.
• Data Protection Breach Report Template.
• Register of security incidents and corrective/preventive actions.
• Register of corrigenda.
• Register of restorations.
• Model corrigendum.
• Restoration pattern/template.
• Model objection form.
• Model contract excluding further processing of personal data.
• Sample consents for competitions, marketing, and publications.
• Information obligation for ferry crossings.
• Information obligation for meeting monitoring.
• Information obligation regarding recruitment.
• Information obligation for the National Revenue Administration.
• Information obligation for the LES entity.
• Public Procurement Law (UCoC) information obligation.
• Information obligation under the Labour Code.
• Tax information obligation.
• Authorization to process personal data for employees: a template with examples.
• Notification of a breach to data subjects - template.
• Personal Data Processing Agreement for the Controller - template.
• Personal Data Processing Agreement for the Processor.
• And many more resources.