About This Course
Data protection has become one of the most pressing compliance challenges for HR functions worldwide. From the moment a job advertisement is published to the day an employee's records are archived post-departure, personal data is collected, processed, shared, and stored at every stage of the employment lifecycle. A single misstep — an unlawful retention policy, an unprotected payroll spreadsheet, or a poorly worded consent clause — can expose an organisation to significant regulatory fines, reputational damage, and loss of employee trust.
The General Data Protection Regulation (GDPR), enforced since May 2018, fundamentally changed how organisations must handle personal data. For HR teams, this means revisiting employment contracts, onboarding packs, performance management records, health data, and third-party vendor relationships through a data protection lens. Yet many HR professionals lack the specific legal literacy and practical toolkit to do so confidently and systematically.
TrainingComplex's HR Compliance with Data Protection Regulations (GDPR) Training is a rigorous, practitioner-focused programme designed to close that gap. Over five days, participants examine the full architecture of GDPR as it applies to HR — from the six lawful bases for processing and the eight data subject rights, to Records of Processing Activities (RoPA), Data Protection Impact Assessments (DPIAs), and international data transfer mechanisms. The programme draws on case studies from supervisory authority enforcement actions, giving delegates insight into exactly where HR functions go wrong and how to put things right.
Participants leave with ready-to-use compliance tools, template documents, and the confidence to serve as their organisation's first line of GDPR defence in people operations. Whether you are building a compliance framework from the ground up or stress-testing an existing one, this course delivers the depth and practicality your HR function needs.
Who Should Attend
- HR Managers and HR Business Partners responsible for employee data governance
- HR Directors and Chief People Officers overseeing compliance strategy
- Recruitment and Talent Acquisition Managers handling candidate data
- Payroll and Compensation Managers processing sensitive financial and personal records
- Learning & Development Professionals managing training records and assessments
- Employee Relations Advisors dealing with grievance, disciplinary, and health records
- Data Protection Officers working alongside HR teams
- In-house Legal Counsel supporting the HR function
- Organisational Development Consultants advising on HR process design
- Small business owners and HR generalists managing people data without a dedicated DPO
Learning Objectives
- Explain the core principles, scope, and territorial reach of the GDPR and its equivalent national data protection laws
- Identify and correctly apply the six lawful bases for processing employee personal data across the full employment lifecycle
- Map all personal data flows within HR processes and maintain an accurate Record of Processing Activities (RoPA)
- Apply the special category data rules to sensitive HR records including health, trade union membership, and biometric data
- Draft and evaluate privacy notices, consent clauses, and data processing agreements that meet GDPR standards
- Implement data minimisation, purpose limitation, and storage limitation controls within HR systems and filing practices
- Manage data subject access requests (DSARs), erasure requests, and other individual rights within the required timeframes
- Design and execute a GDPR-compliant HR data breach response plan, including supervisory authority notification procedures
- Conduct a Data Protection Impact Assessment (DPIA) for high-risk HR processing activities such as employee monitoring
- Evaluate international data transfer mechanisms including Standard Contractual Clauses (SCCs) and adequacy decisions for cross-border HR operations
- Audit existing HR policies, contracts, and vendor agreements for GDPR compliance gaps and develop a remediation roadmap
Course Modules
Module 1: Foundations of Data Protection Law and the GDPR Framework
- Evolution of data protection law from the 1995 Directive to the 2018 GDPR
- Key definitions: personal data, processing, controller, processor, and data subject
- Territorial and material scope of the GDPR and its application to non-EU employers
- The eight data protection principles and their practical meaning for HR
- Relationship between the GDPR and national implementing legislation (UK GDPR, African data protection laws)
- Role of supervisory authorities and the enforcement landscape
Module 2: The Employment Lifecycle and Personal Data Mapping
- Understanding personal data flows across recruit-to-retire HR processes
- Building and maintaining a Record of Processing Activities (RoPA) for HR
- Identifying data controllers and processors within the HR technology ecosystem
- Data mapping tools and techniques: interviews, process walkthroughs, and system audits
- Documenting purposes, legal bases, data categories, and retention periods in the RoPA
- Common HR data flows to third parties: pension providers, insurers, payroll bureaus, and background check vendors
Module 3: Lawful Bases for Processing Employee Personal Data
- Overview of the six lawful bases and how to select the correct one
- Contractual necessity: what HR processing this genuinely covers and what it does not
- Legal obligation as a lawful basis: payroll, tax, right-to-work, and health and safety records
- Legitimate interests assessments (LIA) in the employment context: conducting and documenting the balancing test
- Consent in employment relationships: why it is rarely appropriate and when it may be used
- Documenting lawful basis decisions and keeping them current as processing purposes change
Module 4: Special Category and Criminal Convictions Data in HR
- What constitutes special category data and why it receives heightened protection
- Article 9 conditions for processing special category data in employment contexts
- Health and disability data: occupational health, sick leave, reasonable adjustments, and medical reports
- Trade union membership data: legal protections and handling obligations
- Biometric and genetic data: time-and-attendance systems, access control, and pre-employment screening
- Criminal convictions data: DBS/vetting checks, spent convictions, and proportionality requirements
Module 5: Privacy Notices, Transparency, and Employee Communication
- The transparency principle and its application across the employee lifecycle
- Mandatory content of a GDPR-compliant employee privacy notice under Articles 13 and 14
- Delivering privacy information at each touchpoint: job adverts, application forms, offer letters, and onboarding
- Drafting plain-English privacy notices that employees actually understand
- Updating privacy notices when processing purposes change and communicating amendments
- Privacy notices for job applicants, contractors, and former employees
Module 6: Consent, Contracts, and Data Processing Agreements
- Valid consent under the GDPR: freely given, specific, informed, and unambiguous
- Why employer-employee power imbalance makes consent problematic in most HR contexts
- Drafting data processing clauses in employment contracts and offer letters
- Article 28 requirements for Data Processing Agreements (DPAs) with HR vendors and suppliers
- Negotiating key DPA provisions: sub-processor controls, audit rights, breach notification timelines
- Reviewing and updating existing vendor contracts for GDPR compliance
Module 7: Data Subject Rights and Managing HR Requests
- Overview of the eight individual rights under the GDPR and their HR implications
- Handling Data Subject Access Requests (DSARs): intake, verification, search, redaction, and response
- Applying exemptions to DSARs in employment contexts: confidential references, legal privilege, and management information
- Right to erasure and right to restriction: when employees can and cannot demand deletion
- Right to data portability: scope and practical application within HR systems
- Building an internal rights-request workflow with clear ownership, timelines, and escalation paths
Module 8: Data Retention, Minimisation, and Secure Disposal
- Storage limitation principle: developing a defensible HR records retention schedule
- Legal drivers for minimum retention periods: employment law, tax, pension, and litigation hold
- Data minimisation in practice: reviewing forms, system fields, and file-sharing habits
- Secure disposal of HR records: shredding, data wiping, and vendor destruction certificates
- Managing retention in cloud-based HRIS and document management systems
- Conducting periodic data purge reviews and maintaining an auditable retention log
Module 9: HR Data Breach Prevention, Detection, and Response
- Defining a personal data breach and common HR-related breach scenarios
- Building a preventive control framework: access controls, encryption, and staff awareness
- Detecting breaches early: incident reporting culture and monitoring mechanisms
- Assessing breach risk: likelihood and severity of harm to affected employees
- Article 33 and 34 obligations: supervisory authority notification and employee communication thresholds
- Conducting a post-breach review and updating controls to prevent recurrence
Module 10: DPIAs, International Transfers, and Building a Sustainable HR Compliance Programme
- When a Data Protection Impact Assessment (DPIA) is mandatory for HR processing activities
- Conducting a DPIA: scoping, risk identification, mitigation measures, and DPO consultation
- International data transfers in global HR: adequacy decisions, Standard Contractual Clauses, and Binding Corporate Rules
- Transfer Impact Assessments (TIAs) following the Schrems II ruling and their practical application
- Auditing existing HR policies, contracts, and systems against a GDPR compliance checklist
- Building a continuous compliance culture: training programmes, DPO collaboration, and governance structures
Requirements & Prerequisites
Participants should have at least one to two years of experience working in an HR, people operations, or related legal/compliance role. A basic familiarity with employment law concepts and common HR processes such as recruitment, onboarding, and performance management is assumed. No prior formal training in data protection law is required, though delegates who have attended an introductory GDPR awareness session will find the programme builds naturally on that foundation.
Training Methodology
- Lifecycle-based case study analysis — participants trace personal data through each stage of the employee journey (recruit-to-retire) and identify compliance obligations and risk points at each step
- Enforcement action reviews — structured examination of real supervisory authority decisions and fines from the ICO, CNIL, and other EU/EEA DPAs, extracting lessons applicable to HR contexts
- Document drafting workshops — small groups draft and peer-review privacy notices, consent clauses, and processor agreements using provided GDPR-compliant templates as benchmarks
- RoPA mapping exercise — hands-on completion of a Record of Processing Activities for a fictional organisation's HR function, covering lawful bases, retention periods, and third-party recipients
- DPIA simulation — teams conduct a structured Data Protection Impact Assessment for a high-risk scenario (e.g., employee location tracking or AI-assisted recruitment screening)
- Data breach response drill — role-play exercise in which participants act as the breach response team, assessing severity, notifying the supervisory authority, and communicating with affected employees under time pressure
- DSAR handling clinic — participants work through a realistic data subject access request, redacting third-party information and applying exemptions within a 30-day countdown scenario
- Reflective compliance gap audit — delegates assess their own organisation's HR policies and documentation against a structured checklist and leave with a personalised remediation action plan
Organisational Benefits
- Reduced risk of supervisory authority enforcement action, fines, and reputational damage arising from HR data breaches
- A fully documented and defensible HR data governance framework aligned with GDPR requirements
- Increased employee trust through transparent, respectful handling of their personal information
- Streamlined response to data subject access requests, reducing legal exposure and administrative burden
- Compliance-ready employment contracts, privacy notices, and onboarding documentation
- Confident HR teams capable of identifying and escalating data protection risks without external legal support for every query
- Strengthened vendor management through properly negotiated data processing agreements with HR technology suppliers
- A culture of data accountability embedded in day-to-day people operations
Where Is HR Compliance with Data Protection Regulations (GDPR) Training Offered?
This course runs in-person across: Nairobi, Addis Ababa, Kigali, Accra, Lagos, Dar es Salaam, Mombasa, Johannesburg, Kampala, Naivasha, Riyadh, Abuja, Arusha, Kisumu, Cape Town, Pretoria, Nakuru, Dubai, Zanzibar, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Nairobi, Kenya |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
KES 105,000 |
| Addis Ababa, Ethiopia |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 2,400 |
| Kigali, Rwanda |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 1,900 |
| Accra, Ghana |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,800 |
| Lagos, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,500 |
| Dar es Salaam, Tanzania |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,300 |
| Mombasa, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 120,000 |
| Johannesburg, South Africa |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,500 |
| Kampala, Uganda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Naivasha, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 115,000 |
| Riyadh, Saudi Arabia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 4,500 |
| Abuja, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,800 |
| Arusha, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,100 |
| Live Virtual |
Online |
26 Oct 2026 – 30 Oct 2026 |
KES 80,000 |
| Kisumu, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
+233 more dates — view live schedule →
Frequently Asked Questions
Do I need prior knowledge of data protection law to attend this course?
No prior formal data protection training is required. The programme begins with a solid grounding in GDPR fundamentals before progressing to HR-specific applications, making it accessible to HR professionals who are new to the regulatory framework. Delegates with some existing GDPR awareness will simply move through the foundational modules quickly and gain greater depth in the applied sessions.
Will I receive a certificate upon completing the course?
Yes. All delegates who attend the full five-day programme receive a TrainingComplex Certificate of Completion in HR Compliance with Data Protection Regulations (GDPR). The certificate confirms the topics covered and the hours of instruction, and can be used to support CPD records with relevant professional bodies such as CIPD or IAPP.
Is this course relevant if my organisation operates outside the European Union?
Absolutely. The GDPR has extraterritorial reach — it applies to any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU, regardless of where the organisation is based. The course also covers equivalent national frameworks in Africa and the Gulf, making it directly relevant to HR professionals operating across multiple jurisdictions.
What materials will participants receive?
Participants receive a comprehensive delegate workbook covering all ten modules, plus a practical toolkit that includes a RoPA template, a DPIA framework, a DSAR response workflow, an HR retention schedule template, a vendor DPA checklist, and a GDPR compliance audit grid — all ready to adapt and implement in their own organisations.
Can this course be delivered in-house for our entire HR team?
Yes. TrainingComplex offers tailored in-house delivery of this programme for organisations that want the training customised to their specific industry, HR systems, and existing policies. In-house delivery also allows the team to work through live compliance challenges using the organisation's own documentation during the workshop sessions. Please contact us directly for a bespoke proposal.
