Become a certified legal engineer.

Build and maintain records of processing activities for controllers and processors. The course covers the minimum content, how to scope a processing activity, integration with system inventories and processor registers, and how the record actually operates as a governance tool — not just as an audit artefact.

When a DPIA is mandatory, how to assess necessity and proportionality, which mitigations reduce residual risk, and when prior consultation with the supervisory authority is required (Article 36). Built on the EDPB criteria and national lists of processing operations that require a DPIA.

From detection to documentation: how a breach is detected, assessed for risk, notified to the supervisory authority within 72 hours, and — where the risk to individuals is high — communicated to the data subjects. Covers the internal breach protocol, the controller-processor interface, and the templates that make the process runnable under pressure.

Classification of AI systems by risk, with a focus on high-risk systems under Annex III. The course covers provider obligations (quality management, technical documentation, conformity assessment, CE marking, registration) and deployer obligations (instructions for use, human oversight, logging, fundamental rights impact assessment where required), and the interface with the GDPR.