Effective GDPR for HR and People Teams

The course focuses on enabling HR professionals to

• handle personal data safely and effectively.
• do so with confidence and resilience to challenge
• develop effective GDPR compliant systems for their team, organisation and with third parties but without major operational disruption or additional cost

With a focus on practical, applicable skills and giving you the confidence to manage personal data effectively, while achieving your business needs, this course goes beyond simply knowing what the GDPR requires.

That’s why a significant part of the course focuses on action planning, and throughout the learning there are quizzes, case studies and Q&A sessions where people are encouraged to test what they are being taught against their own experience and systems. Unlike any other provider we also offer six-month’s post course support, completely free, to help ensure your new skills are successfully applied in the real world.

Module 1: Managing Personal Information Across the Employment Lifecycle

HR teams handle personal information throughout recruitment, employment and after a person leaves the organisation. This module examines how the data protection principles apply at each stage and how to identify, document and review the lawful basis for common HR processing activities.

It will also explain the additional requirements that apply when HR teams process special category or criminal offence data.

By the end of this module, you will be able to:

• map how applicant, worker and former-worker information is collected, used, shared, retained and deleted;
• identify and document appropriate lawful bases and, where necessary, additional conditions for processing;
• provide applicants and workers with clear and accurate privacy information;
• apply the principles of purpose limitation, data minimisation, accuracy, storage limitation and security to HR records;
• identify appropriate retention periods for different categories of HR information; and
• record HR processing activities and demonstrate how key decisions have been made.

Module 2: Handling Sensitive and Difficult HR Situations

Disciplinary proceedings, grievances, occupational health referrals, sickness absence, safeguarding concerns, whistleblowing and workplace investigations can involve sensitive, disputed or confidential information.

This module explores how to collect, use, record and disclose personal information appropriately when the organisation must balance operational needs, confidentiality, fairness and individual rights. It will also consider employee monitoring and other higher-risk processing activities.

By the end of this module, you will be able to:

• determine what information is genuinely necessary for an HR process or investigation;
• identify when special category or criminal offence data is involved and apply the appropriate safeguards;
• limit access and disclosure to people with a legitimate need to know;
• distinguish between information that should remain confidential and information that may need to be disclosed;
• recognise when a data protection impact assessment may be required;
• design proportionate approaches to workplace monitoring; and
• record and justify decisions if the organisation’s handling of information is challenged.

Module 3: Respecting Workers’ Rights and Managing New Technology

Applicants, current workers and former workers have rights over their personal information. These rights can become especially important during grievances, disciplinary proceedings, workplace disputes and termination of employment.

This module examines how HR teams should recognise and respond to rights requests. It will also consider the data protection implications of using AI, profiling and automated decision-making in recruitment, performance management and other employment processes.

By the end of this module, you will be able to:

• recognise and respond appropriately to different types of data protection rights request;
• coordinate proportionate searches and responses to subject access requests within the applicable timescales;
• assess difficult issues involving third-party information, confidentiality, legal advice and management records;
• respond appropriately to requests for rectification, erasure, restriction or objection;
• recognise the risks associated with AI-assisted and automated employment decisions;
• identify when meaningful human review and other safeguards are required; and
• handle complaints about the collection, use, sharing or accuracy of HR information.

Module 4: Applying the Learning and Planning Improvements

The final module brings the course together through realistic HR scenarios and practical decision-making exercises. Participants will apply what they have learned to situations involving recruitment, employee relations, information sharing, rights requests and the use of HR technology.

Participants will then complete a structured action-planning exercise to identify and prioritise improvements within their own organisation.

By the end of this module, you will be able to:

• apply data protection principles to realistic HR scenarios;
• identify weaknesses in an employee information lifecycle;
• distinguish urgent risks from longer-term improvement opportunities;
• determine which policies, notices, records, contracts and procedures should be reviewed; and
• produce a prioritised action plan for improving the management of people-related personal information.

As a final exercise, each participant will review an employee information lifecycle, identify at least three improvements and record the practical steps needed to implement them.

Michael is an experienced data protection officer and information governance professional. He is our lead consultant for these areas and has supported organisations up to and including Board level ensure and assure GDPR compliance. Most recently he has helped the Department of Health transition personal data processing to a new data platform, been the Information Governance and Assurance Lead for HS2, and acted as Data Protection Officer for organisations such as London Luton Airport and Homerton Hospital.

His GDPR work in the public, private and charity sectors make him the ideal lead for this course.

LPCH

London-Luton-Airport

Homerton_University_Hospital_NHS_Foundation_Trust_logo

Tunbridge-wells-council

When booking with us you can have a full refund, change your course date or venue, or nominate a substitute attendee up to 24 hours before your course.

Simply click “add to basket” on your preferred choice and you will move automatically to the next step in the process, where you can add more attendees if you wish. Once complete, confirmation of your place and joining instructions will follow automatically.

All prices are inclusive of VAT

Interested in In-House Training?

For larger groups it can be more cost effective and logistically easier to have us come to you. In house training can take place where you want and when you want – and by focussing on your organisation the learning can be more targeted too. Click the button below to find out if in-house training might work for you.