UK GDPR Workshop - A Practical Guide to the Basics for Business

Introduction

The GDPR has been in force since May 2018 but there remains a considerable amount of confusion as to its precise requirements. This confusion has been exacerbated further by the new Data (Use and Access) Act 2025 (DUAA), which makes a series of amendments to the UK GDPR and other related legislation.

Thoroughly updated in the light of the DUAA, this face-to-face seminar is aimed at those who have little or no previous experience of data protection and provides a succinct overview of the basic concepts that are relevant in any workplace. Delegates will be encouraged to apply their knowledge through a series of exercises with an emphasis on finding practical, risk-focused solutions to common problems.

What You Will Learn

This course will cover the following:

• Applicable rules
  • What are the differences between the UK GDPR and the EU GDPR and which applies?
• Key terminology
  • What do the key terms of the UK GDPR and the DPA 2018 mean?
  • ‘Personal Data’ v ‘Special Categories’
  • ‘Controller’ v ‘Processor’
• Principles
  • What are the principles and what do they mean practically for firms and for employees?
  • What is meant by ‘accountability’?
  • Is consent required to process personal data?
• Data Subjects’ Rights
  • What are the key rights that data subjects have?
  • What needs to be done when a request is received from a data subject?
• Security
  • What are the key areas of risk in respect of security breaches?
  • What needs to be done if there is a security breach?
• Direct marketing
  • UK GDPR and the Privacy and Electronic Communications Regulations 2003 - how do they interact in practice?
  • How is ‘marketing’ defined?
  • What lawful bases can be relied upon? Consent v legitimate interests
  • Opt-out v opt-in - which approach should be used?
• Enforcement regime
  • What enforcement options are available to the ICO?
  • In what circumstances will the ICO issue a civil monetary penalty?
  • What are the factors considered by the ICO in determining the amount?
  • What mitigating steps can be taken to reduce the likelihood of a civil monetary penalty?