a) Purpose 

b) Instruments giving an impetus to create Data Protection Laws 

c) Timeline of Data Protection Laws 

d) Data Protection Directive vs General Data Protection Regulation

e) Related Legislation & Instruments 

f) Brexit 

a) Overview  

b) European Parliament (“EP”)

c) European Council 

d) Council of the European Union 

e) European Commission 

f) Court of Justice of the European Union  

a) Overview 

b) Council of Europe Convention (Convention 108)

c) Data Protection Directive 

d) General Data Protection Regulation 

e) Law Enforcement Data Protection Directive 

f) Privacy and Electronic Communications Directive 

g) EU Directive on Electronic Commerce

h) Directive on Security of Network and Information Systems 

i) Data Retention Directive 

a) Personal Data

b) Sensitive personal data 

c) Processing 

d) Controller 

e) Processor 

f) Data Subject 

Summary of Guidelines 07:2020 on the concepts of controller and processor in the GDPR

a) Territorial Scope 

b) Material scope 

Summary of Guidelines 3:2018 on the territorial scope of the GDPR - Art. 3

a) Introduction 

b) Lawfulness, fairness and transparency

c) Purpose limitation 

d) Data minimisation 

e) Accuracy 

f) Storage limitation 

g) Integrity and confidentiality 

7.1. Lawful Processing Criteria

a) Introduction 

b) Consent

c) Contractual necessity 

d) Legal obligation 

e) Vital interests 

f) Public interests 

g) Legitimate interests 

7.2. Lawful Processing Criteria - Special Categories of Personal Data 

a) Introduction 

b) Explicit consent 

c) Legal obligations under employment/social protection law 

d) Vital interests 

e) Legitimate activity of a not-for-profit body  

f) Publicly available 

g) Legal claim

h) Substantial public interest 

i) Medical purpose 

j) Public health 

k) Public interest, scientific or historical research purposes, or statistical purposes

a) Introduction

b) Article 13  

c) Article 14  

d) When additional information must be provided 

e) When and how

f) Fair processing notices  

g) Exemptions 

a) Introduction

b) Right of access  (Art. 15) 

c) Right to rectification (Art. 16) 

d) Right to erasure (Art. 17) 

e) Right to restriction of processing (Art. 18) 

f) Notification obligation regarding rectification or erasure of personal data or restriction of processing (Art. 19)

g) Right to data portability (Art. 20) 

h) Right to object (Art. 21) 

i) Right to not be subject to automated decision-making (Art. 22) 

Summaries of

• Guidelines 52019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR 
• Guidelines 10:2020 on restrictions under Article 23 GDPR

a) Introduction

b) Appropriate technical and organisational measures

c) Breach Notification 

d) Vendor Management

e) Data Sharing

a) Introduction

b) Responsibility of controllers

c) Article 25 - Data protection by design and by default 

d) Record keeping and co-operation with regulators 

e) Data protection impact assessment 

f) Data protection officer 

g) Auditing of privacy programs

a) Introduction 

b) What is a transfer? 

c) Adequacy Decisions 

d) Adequate Safeguards 

e) Derogations 

f) Transfers to the US 

g) Transfer Impact Assessments

Summaries of 

• Guidelines 05:2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
• Guidelines 04:2021 on codes of conduct as tools for transfers
• Guidelines 02:2018 on derogations of Article 49 under Regulation 2016:679
• Recommendations 01:2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

a) Introduction 

b) Self-regulation 

c) Data subject rights 

d) Regulator supervision

e) International cooperation 

a) Introduction 

b) Process and procedures 

c) Fines 

d) Data Subject Compensation 

e) Class Actions

a) Introduction 

b) Legal basis for processing of employee data 

c) Storage of personnel records 

d) Workplace monitoring and data loss prevention 

e) EU Works councils 

f) Whistleblowing systems 

g) ‘Bring your own device’ (BYOD) programs

a) Introduction 

b) Regulation of surveillance  

c) Communications surveillance 

d) Video surveillance 

e) Biometric data/facial recognition  

f) Location data  

Summary of Guidelines 3:2019 on processing of personal data through video devices

a) Introduction 

b) Regulation of direct marketing 

c) Specific types of marketing +

Summary of Guidelines 8:2020 on the targeting of social media use

a) Introduction 

b) Cloud computing 

c) Cookies

d) Search engines

e) Social networking services (SNS)

f) Artificial Intelligence