CompliQuest

Course Overview

The IT department plays a central role in implementing technical and organizational measures for GDPR compliance, as it manages systems, access, infrastructure, and security settings. While often behind the scenes, IT lays the foundation for data protection. If this fails, compliance efforts elsewhere fall apart.

This module focuses on real-world examples and shows what good and poor technical management looks like under GDPR. Participants will learn how everyday technical decisions impact data protection and compliance. The course covers areas such as access control, secure data deletion, remote work policies, encryption, and cloud settings. The importance of regular system updates is emphasized, along with practical topics such as configuring cookie banners and managing cookies in a compliant manner.

The module also explains best practices for data storage, limiting access, separating test and production environments, and ensuring secure home office setups using VPNs, official devices, and preventing local storage of sensitive data. It includes guidance on maintaining activity logs, auditing external service providers, and preparing for potential security incidents.

The goal is to equip IT teams with practical solutions to fulfil their GDPR responsibilities effectively while preserving user trust.

Who is this course for?
This course is ideal for all employees who are members of the following departments within an organization:

1. System and network administrators – due to their daily management of access, infrastructure, and security settings.
2. IT and security teams – in the context of encryption, threat detection, and technical measures for personal data protection. 
3. DevOps and engineering teams – who develop or maintain applications that process personal data.
4. DPOs and legal advisors – who work with IT to define technical and organisational measures in line with the GDPR.
5. Customer support and access management – due to their handling of user data and activity logging.
6. External IT service providers and partners – if they have access to the organization’s information systems and data
7. All IT team members – since the GDPR requires collective and an understanding of everyone’s role in data protection

Modules

• GDPR in the IT Department– Participants will learn how to manage access control, securely delete data, handle remote work, encryption, and cloud settings, and understand why system updates are essential. The module also covers activity logging, third-party audits, and incident preparedness. The focus is on clear, practical understanding of IT’s responsibility, both technical and compliance-related.