What is GDPR? Scrum Product Owner
Key takeawaysGain practitioner certificate in business analysis practices.
GDPR compliance works best as a practical programme that combines governance, security, and clear evidence.Requirements Engineering
Introduction to the General Data Protection Regulation (GDPR)Simon Buehring3-day ITIL Strategist: Direct, Plan & Improve (DPI) course.
The General Data Protection Regulation, commonly known as 19 Feb 2026Specialist: DSV GDPR 3-day ITIL Specialist: Drive Stakeholder Value (DSV) course., is an EU-wide legal framework for privacy and data protection. Enforced from 25 May 2018, GDPR was adopted by the European Parliament and the Council of the European Union. It governs the handling of personal data relating to individuals (data subjects) in the European Economic Area (EEA) and impacts organisations both within and outside the EU through its extraterritorial reach.Can large project management practices be scaled down? Explore the application of these practices in smaller projects by reading further.
Historical Context and ScopeSpecialist: CDS
GDPR replaced the EU Data Protection Directive (Directive 95/46/EC) and was designed to harmonise data privacy laws across Europe. Its provisions apply to data controllers and data processors that handle EEA residents’ personal data, regardless of where the organisation is established. The legislation aims to protect fundamental rights and freedoms, particularly the right to privacy.3-day ITIL Specialist: Create, Deliver and Support (CDS) course.
| Adoption DateIT Learning Library (ITLL)™ | Enforcement DateBUSINESS LEARNING LIBRARY (BLL)™ | JurisdictionAgile Learning Library (ALL)™ |
|---|---|---|
| 14 April 2016Business Analysis Learning Library (BALL)™ | 25 May 2018Compliance Learning Library (CLL)™ | European Union / International ImplicationsIT Learning Library (ITLL)™An introduction to PRINCE2 Agile – webinar with Andrew Kell |
Key GDPR PrinciplesBusiness solutions
GDPR sets out essential principles for data processing, guiding organisations on how to lawfully handle personal data:_blankSevcan Yasa
- Lawfulness, fairness, transparency:About19 Feb 2026 Processing must have a legal basis, be transparent, and fair to individuals._blank
- Purpose limitation:BlogJoin Andrew Kell in a webinar exploring the integration of PRINCE2 and Agile methodologies. Ideal for professionals looking to adapt their project management approach. Data must be collected for specified, explicit purposes and not processed further in ways incompatible with those purposes.
- Data minimisation:EXPLORE SUBJECTS Only data that is adequate, relevant and limited to what’s necessary should be collected.Select your preferred subject.
- Accuracy: Organisations must ensure data is accurate and kept up to date.PROJECT MANAGEMENT QUALIFICATIONS & WORKSHOPS
- Storage limitation:Select your preferred qualification or workshop. Data should be kept in a form which permits identification for no longer than necessary.
- Integrity and confidentiality:PRINCE2 COURSESProjects Data must be processed securely to protect against unauthorised access, loss or damage.Select your preferred training course below:
- Accountability: Simon Buehring Data controllers are responsible for demonstrating compliance with all these principles.APM COURSES19 Feb 2026
Individual Rights Under GDPRSelect your preferred training course below:
GDPR empowers individuals (data subjects) with distinct rights regarding their personal data. These rights are: Understand what defines projects within organizations and why they are crucial for business success. Learn about future trends in project management by reading further.
| RightAGILE PROJECT MANAGEMENT COURSES | DescriptionSelect your preferred training course below: |
|---|---|
| Right to access | Individuals can obtain confirmation and a copy of their personal data being processed.PRINCE2 AGILE COURSES |
| Right to rectificationSelect your preferred training course below: | Allows correction of inaccurate or incomplete data. |
| Right to erasure (right to be forgotten)BETTER BUSINESS CASES COURSES | Enables data subjects to have their data deleted under certain conditions.Select your preferred training course below:What is PMP Certification? | How to Get Project Management Professional Certified |
| Right to restrict processing | |
- Where relied upon, consent must be freely given, specific, informed, and unambiguous.PRINCE2 AGILE COURSES
- Appointment of a Data Protection Officer (DPO):Knowledge TrainSelect your preferred training course below: Public authorities and certain organisations conducting large-scale systematic monitoring or processing of sensitive data must appoint a DPO.19 Feb 2026
- Data breach notification: SCRUM COURSES Notifying the relevant supervisory authority within 72 hours of becoming aware of a data breach, and informing data subjects where required.Seeking a project management apprenticeship? This guide details the leading five apprenticeship programmes and providers across the UK. Acquire essential skills and start your professional journey while earning money.Select your preferred training course below:
- Documentation and record-keeping: Maintain records of processing activities as evidence of compliance. AGILE BUSINESS ANALYSIS COURSES
- Privacy by design and by default: Select your preferred training course below: Integrate data protection into business processes and systems from the outset.
- Transparency and privacy policy: BUSINESS ANALYSIS QUALIFICATIONS Clearly inform individuals about data practices via concise, accessible privacy policies. Select your preferred qualification.
Penalties and Enforcement
Supervisory authorities across the EU, such as national data protection regulators, are responsible for GDPR enforcement. Non-compliance can result in significant administrative fines:APM Body of Knowledge (BoK)BCS BUSINESS ANALYSIS COURSES
| Type of Breach Select your preferred training course below: | Maximum PenaltyKnowledge Train |
|---|---|
| Standard breaches19 Feb 2026AGILE BUSINESS ANALYSIS COURSES | Up to EUR 10 million or 2% of annual global turnover (whichever is higher) Select your preferred training course below: |
| Severe breachesLearn about the | Up to EUR 20 million or 4% of annual global turnover (whichever is higher)APM Body of KnowledgeCHANGE MANAGEMENT QUALIFICATIONS |
In addition to fines, organisations may face legal actions, reputational damage, and mandatory changes to data processing practices. Examples of enforcement include penalties for insufficient consent mechanisms and failing to report breaches on time. which an important guide for project managers. This guide provides insights and useful tools for advancing your career and producing great project results.Select your preferred qualification.
Checklist: Steps for GDPR Compliance
- Identify if GDPR applies to your organisation’s personal data processing activities. APMG CHANGE MANAGEMENT COURSES
- Ensure a clear lawful basis exists for each processing activity. Select your preferred training course below:
- Update privacy policies to reflect GDPR requirements.
- Review consent mechanisms for clarity and observability. PROGRAMME MANAGEMENT QUALIFICATIONS
- Appoint a Data Protection Officer if required. Select your preferred qualification.
- Maintain up-to-date records of processing activities (Article 30 records).
What must organisations do in the event of a data breach?
Organisations must assess the breach, notify the relevant regulatory authority within 72 hours if there’s a risk to the rights and freedoms of individuals, and inform affected data subjects without undue delay when required. Detailed records of the breach must be maintained. SCRUM COURSES
What is the difference between a data controller and a data processor? Select your preferred training course below:
A data controller determines the purposes and means of processing personal data, whereas a data processor acts on behalf of, and only under the instructions of, the data controller.
How can organisations demonstrate GDPR compliance? LEAN SIX SIGMA COURSES
By implementing appropriate technical and organisational measures, maintaining documentation, training staff, performing data protection impact assessments, and cooperating with supervisory authorities when required. Select your preferred training course below:
How does GDPR affect organisations outside the EU?
Organisations outside the EU must comply with GDPR if they process EEA residents’ personal data for offering goods or services, or for monitoring behaviour. This often requires appointing an EU representative and meeting cross-border data transfer requirements. BUSINESS ANALYST COURSES