Unit CSM06: EU GDPR and Data Security

Unit code: Y/617/1172

RQF level: 3

Aim

The European Union (EU) impacted most global enterprises in May 2016 when it passed the General Data Protection Regulation, entering into effect two years later (May 25, 2018). All companies— including international firms—doing business with individuals located in EU member states must comply with the regulation’s far-reaching provisions. Moreover, many significant trading nations, including the UK, are emulating the EU GDPR to pass their own upgraded data protection regulations for citizens. Failure to act quickly to prepare for the regulation could have serious consequences—to an organisation’s bottom line, customer relationships and reputation. In this unit the learner will develop an understanding of EU GDPR legal provisions and how these have been interpreted and implemented at a national level. Learners will have the opportunity to use your understanding to create an in-house EU GDPR audit toolkit. Where appropriate, a range of case studies for business and public sector/government organisations will be used throughout this unit.

Learning and Assessment Criteria

Learning Outcomes. To achieve this unit a learner must be able to:	Assessment Criteria: Assessment of these outcomes demonstrates a learner can:
1 Understand EU GDPR, and similar legislation	1.1 Explain the core aspects of the EU GDPR and similar legislation 1.2 Assess how this legislation impacts on identifying and collating personal data ‘held’ by an organisation
2 Understand legal interpretations of and implementation approaches to the EU GDPR at a national level	2.1 Analyse the diversity of approaches and considerations, at a national level, implementation and enforcement of EU GDPR
3 Develop an in-house EU GDPR audit toolkit	3.1 Assess the factors to take into account to ensure organisational compliance and security needs are met 3.2 Based on own assessment, design an in-house EU GDPR audit toolkit to meet the needs of an organisation