BCS Practitioner Certificate in Data Protection Practice Exam

The BCS Practitioner Certificate in Data Protection from the British Computer Society (BCS) is an advanced level certification on data protection laws and practices, specific to the General Data Protection Regulation (GDPR). This certification covers the usage of data protection principles in real-world scenarios, for effective management and mitigation of  data protection risks within their organizations. It is apt for professionals working in data protection, compliance, governance, and risk management.
Why is BCS Practitioner Certificate in Data Protection important?

• Enhances in-depth understanding of data protection legislation and best practices.
• Prepares professionals for practical application of data protection principles.
• Supports career advancement in data protection, compliance, and governance roles.
• Helps organizations ensure compliance with GDPR and other data protection laws.
• Provides skills necessary to assess and manage data protection risks effectively.

Who should take the BCS Practitioner Certificate in Data Protection Exam?

• Data Protection Officers
• Compliance Managers
• Risk Managers
• IT Security Professionals
• Data Privacy Consultants
• Information Governance Officers
• Legal Advisors in data protection
• Business Analysts specializing in compliance
• Project Managers in data-driven environments
• HR Professionals handling personal data

Skills Evaluated

Candidates taking the certification exam on the BCS Practitioner Certificate in Data Protection is evaluated for the following skills:

• Application of GDPR and data protection principles in practice.
• Data subject rights and organizational responsibilities.
• Conduct data protection impact assessments (DPIAs).
• Identifying and mitigating data protection risks.
• Data processing activities and legal bases for processing.

BCS Practitioner Certificate in Data Protection Certification Course Outline
The BCS Practitioner Certificate in Data Protection Certification covers the following topics -

Module 1. CONTEXT OF DATA PROTECTION LEGISLATION. (7.5%)

• Explaining the concepts of data protection and privacy.

• Describing the history of data protection in the UK.

• Describing the territorial scope and jurisdiction of GDPR.

• When a representative of the controller is needed.

Module 2. PRINCIPLES OF DATA PROTECTION AND APPLICABLE TERMINOLOGY. (5%)

• Define the following key items of terminology.

• Show how the UK GDPR principles regulate the processing of personal data.

Module 3. LAWFUL BASES FOR PROCESSING PERSONAL DATA. (5%)

• Illustrating the lawful bases to process personal data listed under (Article 6) of the UK GDPR

• Explaining the conditions permitted for processing special category data listed under Article 9 of UK GDPR.

• Describing the rules for processing criminal offence data.

Module 4. ACCOUNTABILITY PRINCIPLE. (15%)

• Identifying the accountability and data governance obligation (Article 5 (2) Article 24).

• Describing the purpose of a Data Protection Impact Assessment (DPIA) and when risks arising from one may need prior consultation with the supervisory authority/ICO (Article 36).

• Demonstrating the process of conducting a DPIA (Article 35).

• Explaining what a record of processing activity (RoPA) is, the information it should contain and why this is important (Article 30).

• Outlining the interplay with privacy notices (Article 13 & 14).

• Demonstrating how to adopt a ‘data protection by design and by default’ approach (Article 25).

• Identifying suitable information security measures (Article 32).

• Explaining the designation, position and tasks of the Data Protection Officer (DPO) (Article 37 to 39).

• Explaining the scope of the DPO role in monitoring compliance and managing risks through a Privacy Management programme (Article 39 1.b).

Module 5. OBLIGATIONS OF CONTROLLERS, JOINT CONTROLLERS AND DATA PROCESSORS. (10%)

• Explain controller and processor obligations (Article 24 & 28).

• Describe the concept of joint controllers (Article 26).

• Describing the act of processing under the authority of a controller or processor (Article 29).

• Explaining what a Data Processing Agreement is and when it would be necessary in a controller-processor arrangement.

Module 6. INTERNATIONAL DATA TRANSFERS UNDER EU AND UK GDPR. (2.5%)

• Recognise the general principles for transferring personal data to third countries from both the UK and the EU and illustrate what issues might arise

Module 7. DATA SUBJECT RIGHTS. (5%)

• Demonstrating a detailed knowledge of the key rights which are granted to every individual (as per the Articles 12 to 17 and 21 to 22).

• Express awareness of the rights in addition to the above.

• Describe the restrictions and exemptions that may affect data subject rights.

• Explain the fundamental rights of information requests.

Module 8. THE ROLE OF INDEPENDENT SUPERVISORY AUTHORITIES (ISAS) AND THE ICO. (7.5%)

• Explaining the role and importance of supervisory authorities.

• Explaining the role of the Information Commissioner’s Office (ICO).

Module 9. BREACHES, ENFORCEMENT AND LIABILITY (12.5%)

• Explain what constitutes a personal data breach and the information required for reporting.

• Explain when the obligations arise to report breaches of personal data (as per the Articles 33 and 34 UK GDPR).

• Explain how a data protection complaint should be handled (as per the Article 57 (1)(f)).

• Describing the sanctions which could be imposed due to a personal data breach or data protection complaint.

• Describing the liabilities.

• Identifying the role of tribunal and judicial courts.

Module 10. PROCESSING OF PERSONAL DATA IN RELATION TO CHILDREN. (2.5%)

• Explaining how data protection legislation applies to children.

Module 11. SPECIFIC PROVISIONS IN DATA PROTECTION LEGISLATION OF PARTICULAR RELEVANCE TO PUBLIC AUTHORITIES. (7.5%)

• Defining the meanings of public authority and public body and how it relates to both Data Protection Act 2018 and the UK GDPR (Section 7 of Data Protection Act 2018).

• Explaining the provisions relating to Data Protection Officers (DPOs) for public authorities.

• Explaining awareness of the existence of the exemptions which are applicable for health, social work and education (As per the Schedule 3, DPA 18).

Module 12. PRIVACY AND ELECTRONIC COMMUNICATIONS (EC DIRECTIVE) REGULATIONS (PECR) 2003 AND SUBSEQUENT AMENDMENTS TO 2021. (5%)

• Explaining the relationship between PECR and the GDPR, including PECR’s.

Module 13. APPLICATION OF DATA PROTECTION LEGISLATION IN KEY AREAS OF INDUSTRY. (10%)

• Recognising the data protection implications of the Employment Practices Code.

• Describing how the usage of video surveillance and CCTV (Data Protection Code of Practice for surveillance cameras and personal information) are being governed under the data protection law.

• Identifying how the use of cookies and digital technologies is governed by data protection law.

• Explaining how data sharing practices are being governed under the data protection law (ICO Data Sharing Code of Practice).

Module 14. AI AND THE PROCESSING OF PERSONAL DATA. (5%)

• Analyse the benefits versus the risks of AI for individuals and organisations.

• Analyse the impact of AI on the principles and concepts of data protection.

• Explain the process of completing a Data Protection Impact Assessment (DPIA) where AI is used.