Training module
Data Protection Principles
Privacy roles, obligations and controls in organisations, aligned with common national and international data protection requirements
Do you need to understand data protection concepts?
This training module provides a holistic view of privacy roles, obligations and mechanisms so you understand the landscape before diving into specifics.
Overview
What this module is about
Privacy and data protection are often approached either as detailed legal analysis or as isolated operational tasks. What is frequently missing is a clear, shared understanding of the domain as a whole: the roles organisations play, the lifecycle of personal data, the obligations that recur across laws, and the instruments used to manage them.
This module provides that overview. Participants learn how personal data is handled in organisations, how responsibilities are typically structured, what most data protection regimes expect in principle, and why mechanisms such as impact assessments, processing records, and contractual arrangements exist.
The module is intentionally non-technical and non-prescriptive. It explains what the main elements of the data protection domain are and how they relate, without teaching how to perform specific assessments, create documents, or implement controls.
Audience
Who it is for
Management system implementers and coordinators
Executives and department heads accountable for management system performance
Those responsible for processes, policies, assets, risks and controls
Auditors seeking insight into management-side practice, not audit technique
Consultants working on management system design, governance or improvement
Decision supportIs this module for you?
It is a good fit if you…
want a clear mental model of data protection as a management domain.
need to understand roles, obligations, and lifecycle concepts.
work with personal data and need context beyond legal text.
support or review privacy practices without specialist depth.
want a law-agnostic overview of common privacy concepts.
It may not be the best fit if you…
are looking for clause-by-clause analysis of specific privacy laws.
need step-by-step guidance for executing DPIAs or maintaining records.
expect prescriptive templates, procedures, or tooling.
are seeking advanced specialist or legal deep-dive training.
What to bring
None. Participants should be familiar with basic organisational contexts such as processes, roles, and information use.
Agenda
What is taught
6 parts01What privacy and data protection are really about
How to frame privacy and data protection as constraints on organisational data use, driven by identifiability, context, and impact rather than by labels or tools
02Personal data in organisations: lifecycle perspective
How to view personal data across its full lifecycle and recognise where loss of oversight and control most commonly occurs
03Organisational roles in data protection
How to distinguish decision-making and instruction-following roles and use those distinctions to drive accountability and coordination
04Common obligations across data protection regimes
How to apply recurring obligations such as transparency, purpose alignment, minimisation, retention, and accountability in a consistent, operational way
05Key instruments and mechanisms
How to understand instruments like DPIAs, processing records, and processing agreements as problem-solving mechanisms rather than compliance artefacts
06Data subject rights: intent and organisational impact
How to interpret data subject rights as constraints on processing design and operational routines that affect multiple functions
Outcomes
Learning outcomes
01
Explain what personal data is and how identifiability arises in organisational contexts
02
Recognise recurring obligations found across most data protection laws and frameworks
03
Understand why different organisational roles exist in data protection and what they imply
Describe the personal data lifecycle and recognise common points of loss of control
Understand how roles, obligations and instruments relate without performing or designing them
Explain what instruments such as DPIA, processing records and processing agreements are and why organisations use them
Materials
The content and the assessment
Written module
The full content in writing, complete in itself. Videos are recorded for parts of it as an alternative way through, and the written module always carries everything.
Exercises
Graded work on the case organisation's own registers: structured answers checked against the encoded case, written answers scored against a rubric traced to it, with a trainer holding the final word on every assessed item.
On completion
The assessed exercises must be passed before the certificate is issued.
Scheduling
No public run of Data Protection Principles is scheduled at the moment. Tell us you are interested and we will let you know when the next one opens, or discuss running it in-house.
Module facts
- Module ID
- HAM-DP-DF-01
- Discipline
- Data Protection
- Domains
- Governance · Risk
- Part of tracks
- Management System Auditor · Management System Manager
Case organisation
All modules share one company
Each module enters the company at a particular point in its history and finds it as that history has left it.
Northstar Integrated Services AG is a group headquartered in Zurich, operating in six European countries, with about 1,350 employees at the end of 2025. It provides digital operations platforms and managed operational services to regulated organisations in healthcare, the public sector and industrial services. Founded in 2008 as a field-operations firm serving business customers, it had about twenty-five employees when its first regulated customer, a hospital group, required documented decisions, named accountability and evidence on request. It moved into the platform business in 2016 and in 2024 acquired an operating business in Poland and the Czech Republic, whose legal entity continues inside the group.
Linked registers
Organisation and people, roles, risks, objectives, policies, documents and records, communications, findings, audits and reviews, interested parties, processes
Records, not summaries
The evidence sits in the registers and documents where a real organisation would keep it.
A history
The company has a timeline from 2008, so a structure can be examined before and after it changed.
More than one legal entity
A Swiss parent company and an acquired subsidiary in Poland and the Czech Republic, with customers in several jurisdictions
Why it matters
Judgement develops on material that is incomplete and partly contradictory, as it is in practice. Northstar is built that way on purpose. Because modules enter its history at different points, a governance structure can be seen while it is built, when it is outgrown and when it is rebuilt.
Delivery & dates
How this module reaches you
Delivered live online, combining conceptual framing, discussion, case work and direct interaction with the trainer. In-house and contextualised delivery is available on request.
No public run is scheduled at the moment. Most modules run on request as well as on the public calendar, so tell us the timing you need.
Want this module scheduled?
We will tell you when the next run is scheduled, or run this module in-house with your own case material.
Not sure it is the right module?
Describe your context in a short message and we will tell you honestly.