Become a certified legal engineer.

Produce a consent record that is standardised, machine-readable, and interoperable. You learn the duty that creates it — GDPR Art. 7(1), which requires the controller to be able to demonstrate consent — the four sections every record carries, the eight mandatory processing fields, and why events are appended and never overwritten. You finish able to read any 27560 record end to end.

Give the individual their own copy of the consent. Under §9.2 the receipt reuses the record's fields at the same requirement levels — it is not a lesser summary. You learn what the header carries, why the GDPR names no explicit duty to issue a receipt, and why Art. 15 and Art. 20 are the nearest hooks.

The notice is what makes consent informed. ISO/IEC 29184 §5 sets when it must reach the individual (§5.2), the sixteen content elements it must convey (§5.3), and the controls that let consent be withdrawn or renewed (§5.4–5.5). You learn to read a notice against the clause that governs it, and to spot a provision failure before a regulator does.

The organisation-wide document — what most people still call the privacy policy. You apply the same standard at scale: provision judged per collection route, content judged per section and per processing activity, and the Art. 13 / Art. 14 split on where the data came from. Including the discipline of recording "does not apply", with a justification, control by control.

The policy does not fail because of the law. It fails because of layout, length, and sequencing — and that is a design outcome, which means it can be redesigned. You learn real progressive disclosure, the move from document to dashboard where the reader can act as well as read, symmetry that survives an audit, and comprehension you can evidence under GDPR Art. 25(1).

No new theory. One client brief, four processing activities, three builds: the consent notice and its UI, then the record and receipt, then the privacy notice and the dashboard over it. You assemble the §5.1 audit file as you go, and you defend it. The credential is attested by oral examination on your portfolio — not by a score.

Build and maintain records of processing activities for controllers and processors. The course covers the minimum content, how to scope a processing activity, integration with system inventories and processor registers, and how the record actually operates as a governance tool — not just as an audit artefact.

When a DPIA is mandatory, how to assess necessity and proportionality, which mitigations reduce residual risk, and when prior consultation with the supervisory authority is required (Article 36). Built on the EDPB criteria and national lists of processing operations that require a DPIA.

From detection to documentation: how a breach is detected, assessed for risk, notified to the supervisory authority within 72 hours, and — where the risk to individuals is high — communicated to the data subjects. Covers the internal breach protocol, the controller-processor interface, and the templates that make the process runnable under pressure.

Classification of AI systems by risk, with a focus on high-risk systems under Annex III. The course covers provider obligations (quality management, technical documentation, conformity assessment, CE marking, registration) and deployer obligations (instructions for use, human oversight, logging, fundamental rights impact assessment where required), and the interface with the GDPR.