Personal Data Protection Officer - Basic Level Training Course

Fundamental principles of personal data processing

• Key sources of national and international law.
• The applicability range of personal data protection laws.
• The authority and powers of the data protection regulator.
• Judicial mechanisms for safeguarding personal data rights.
• GDPR – core information and key definitions – selected topics.
• Sector-specific aspects of the GDPR.
• Definition and nature of personal data.
• The process of personal data handling.
• Legal foundations for processing personal data.
• Responsibilities of the Data Controller (Administrator).
• Rights afforded to data subjects.
• Administrative penalties and fines.
• The Personal Data Protection Act of May 10, 2018 – regulatory scope.
• The process of appointing a Data Protection Officer.
• Procedures for violations of personal data protection laws.
• Monitoring adherence to personal data protection regulations.
• Civil, criminal, and administrative liability.
• Criteria for lawful processing of personal data (general and sensitive categories).
• Legal requirements for entrusting personal data processing to third-party entities.
• Data Protection Impact Assessments.
• Concepts of data protection by design and by default.
• Legal grounds for transferring personal data to third countries.
• Personal data protection within employment relationships.

Appointment of the Data Protection Officer

• Mandatory requirements for appointing a Data Protection Officer.
• Optional appointment of an Inspector.

Eligibility for the Data Protection Officer role

• Qualifications required to serve as an Inspector.
• Employment structure and forms for the Inspector.

Role and Status of the Data Protection Officer

• Direct reporting lines from the Inspector to top management.
• Organizing support mechanisms for the Supervisor.
• The Inspector’s involvement in all matters concerning personal data protection.
• Prohibitions regarding instructing the Supervisor on how to perform duties.
• Managing conflicts of interest within the organization – specific tasks of the Supervisor.
• Protections against dismissal and disciplinary action for the Inspector.
• The Inspector’s obligation to maintain secrecy and confidentiality regarding performed tasks.

Information Security Management

• Analyzing the organizational security management system based on Polish standards among others.
• Identifying privacy risks and understanding their legal consequences.
• Principles of risk assessment and evaluating the impact of specific solutions on safety management effectiveness.
• Applying a risk-based approach – practical completion of a Risk Analysis template.
• Managing the Personal Data Lifecycle.

Executing the duties of the Data Protection Officer (DPO)

• Legal basis for the DPO’s appointment.
• Entities required to appoint a DPO, timing, and appointment procedures.
• DPO status and necessary qualifications.
• DPO responsibilities and guidelines for planning their execution.
• Conducting compliance reports on data processing in both traditional and IT systems.
• Documentation of activities performed by the DPO.
• Drafting inspection reports.
• Guidelines for overseeing personal data processing documentation.
• The scope of the UODO’s powers in relation to DPOs.

Practical insights into Office for Personal Data Protection inspections

• Expectations and requirements of the Office for those undergoing audit.
• Strategies for preparing for an inspection.
• Analysis of a specific case study.

Practical exercises

• Drafting a sample Information Security Policy.
• Creating management instructions.
• Developing a Register of Processing Activities.
• Preparing essential Personal Data Protection documentation.
• Case study analysis.
• Common pitfalls in documentation preparation.

Supplementary materials for participants:

Useful forms and templates:

• Consent for the use and distribution of images.
• Event newsletter registration.
• Consent to receive commercial offers.
• Guidelines for sending offer emails.
• Guidelines for sending general communications.
• Sample personal data protection policy.
• Template for fulfilling information obligations under GDPR, including instructions.
• Risk analysis template.
• Register of personal data processing activities – template.
• Register of categories of processing activities – template.
• GDPR Breach Register – Template.
• GDPR Compliance Checklist Template.
• Procedures for handling breaches of personal data protection regulations.
• Data Protection Breach Report Template.
• Register of security incidents and corrective/preventive actions.
• Register of amendments (corrigenda).
• Register of restorations.
• Model corrigendum.
• Restoration pattern.
• Model objection.
• Model contract excluding further processing of personal data.
• Sample consents for competitions, marketing, and publications.
• Information obligations related to ferry crossings.
• Information obligations regarding meeting monitoring.
• Information obligations in recruitment.
• Information obligations to the National Revenue Administration.
• Information obligations of the LES.
• Information obligations under Public Procurement Law (UCoC).
• Information obligations: Labour Code.
• Tax-related information obligations.
• Employee authorization to process personal data: template with example.
• Notification of a breach to data subjects – template.
• Personal Data Processing Agreement for the Controller – template.
• Personal Data Processing Agreement for the Processor.
• And many more.