DATA PROTECTION & COMPLIANCE (NDPR and the GDPR)

Introduction

Data Protection & Compliance (NDPR/GDPR) refers to the legal frameworks for protecting individuals’ personal data. The General Data Protection Regulation (GDPR) is the European Union’s comprehensive data privacy law, while the Nigeria Data Protection Regulation (NDPR), recently updated to the Nigerian Data Protection Act (NDPA), is Nigeria’s similar legislation. Both regulations aim to protect personal data, define data protection roles, require data subject rights like the right to erasure, and mandate accountability for organizations that process this data. 

A Data Protection & Compliance (NDPR/GDPR) course covers fundamental data privacy concepts, legal and regulatory frameworks like GDPR and NDPR, ethical considerations, risk assessment, and security measures. Key topics include data subject rights, roles of controllers and processors, data handling best practices, and procedures for data breaches and impact assessments. 

Course Contents

A comprehensive course on Data Protection & Compliance, focusing on the NDPR (Nigeria Data Protection Regulation/Act) and the GDPR (General Data Protection Regulation), typically covers the following modules and topics: 

Module One: Introduction to Data Protection and Privacy 

• Understanding the Importance of Data Privacy: Significance of privacy in the digital age and historical evolution of concerns.
• Key Concepts and Terminology: Definitions of personal data, sensitive personal data, data subject, data controller, data processor, processing, and consent.
• Overview of Legal Frameworks: Exploration of major data protection laws, including the GDPR/UK GDPR and the NDPR/NDPA, their objectives, scope, and extraterritorial

Module Two: Core Data Protection Principles

• Lawfulness, Fairness, and Transparency: Ensuring data is processed legally, ethically, and with clear information provided to data subjects.
• Purpose Limitation, Data Minimization, and Accuracy: Principles for collecting data only for specified purposes, collecting only necessary data, and keeping it accurate and up-to-date.
• Storage Limitation and Security: Storing data only as long as necessary and implementing appropriate security measures (Confidentiality, Integrity, Availability).
• Accountability: The requirement for organizations to demonstrate compliance with the principles. 

Module Three: Legal Basis for Data Processing

• Lawful Bases: Understanding and applying the conditions for processing personal data (e.g., consent, contract performance, legal obligation, vital interests, public task, legitimate interests).

• Specific Rules for Sensitive Data: Additional safeguards required for “special categories” of personal data.
• Obtaining Valid Consent: Requirements for consent to be freely given, specific, informed, and unambiguous (opt-in vs. opt-out mechanisms). 

Module Four: Rights of the Data Subject

Procedures for handling and responding to individuals’ rights requests:

• Right to be informed (via clear privacy policies).
• Right of access to personal data (DSARs – Data Subject Access Requests).
• Right to rectification (correction) and erasure (deletion/right to be forgotten).
• Right to restrict processing and object to processing.

• Right to data portability.
• Rights related to automated decision-making and profiling. 

Module Five: Compliance and Governance

• Roles and Responsibilities: The functions of the Data Protection Officer (DPO), Data Controllers, Data Processors, and Data Protection Compliance Organizations (DPCOs) in Nigeria.
• Documentation and Records: Maintaining records of processing activities (RoPAs).
• Privacy by Design and Default: Embedding privacy principles into new projects, systems, and processes.
• Data Protection Impact Assessments (DPIAs/PIAs): Conducting assessments for high-risk processing activities.

• Developing and Implementing Policies: Creating effective data handling, security, and breach notification policies. 

Module Six: Data Security and Breach Management

• Technical and Organizational Measures: Implementing security measures like encryption, access controls, and authentication protocols.
• Risk Assessment and Management: Identifying privacy risks and developing mitigation strategies.
• Data Breach Response and Notification: Comprehensive understanding of incident response protocols, legal and ethical considerations, and mandatory notification to authorities (e.g., NDPC/ICO) and affected parties (within 72 hours where applicable). 

Module Seven: International Data Transfers

• Mechanisms for Transfer: Rules and conditions for transferring data to foreign countries or international organizations (adequacy decisions, Standard Contractual Clauses, explicit consent, etc.).
• Regional and International Variations: A comparative analysis of NDPR, GDPR, and potentially other laws like CCPA. 

Module Eight: Emerging Technologies and Auditing

• Privacy in New Technologies: Impact of AI, IoT, biometrics, and Cloud technologies on data privacy.
• Monitoring and Continual Improvement: Auditing compliance programs and ensuring ongoing adherence to regulations.
• Enforcement and Penalties: Understanding the consequences for non-compliance, including fines and legal liabilities. 

Duration: Three (3) days            Fee: N300,000