GDPR in practice: managers and project owners
Complete plan
Five modules for managers and project owners: the record of processing, retention periods, the legal basis and informing people, the three GDPR gates of a new project, and when a DPIA is needed. What a CNIL control checks on paper, and your part: tell the DPO at the right time.
- 9 min
- 5 modules
- 15-question check
- English · Français
- Attestation
You will be able to
- Explain what a processing activity is and what the record is for
- Know that each processing has a retention period set in advance
- Know that a processing rests on one of six legal bases, chosen before collecting
- Involve the DPO at the start of a project that uses personal data
- Know what a DPIA is and that it is done before the processing
Programme
5 modules · 9 min-
The record of processing 2 min
- Explain what a processing activity is and what the record is for
- Read one line of the record: purpose, data, recipients, transfers, retention, security
- Know when to tell the DPO: new tool, new form, new supplier, end of a use
-
Data has a use-by date 2 min
- Know that each processing has a retention period set in advance
- Tell the active base, the intermediate archive and deletion or anonymisation apart
- Know where periods come from (the law, the CNIL, the company's justified choice) and write them in the record
-
Why, and did we tell them? 2 min
- Know that a processing rests on one of six legal bases, chosen before collecting
- Know when consent is the right basis and when it isn't, especially between employer and employee
- Know what the information to people must contain, and give it at the moment of collection
-
New project: three GDPR gates 2 min
- Involve the DPO at the start of a project that uses personal data
- Check a supplier: processor contract, hosting, access and transfers outside the European Union
- Check before go-live: record, information, retention, people's requests, need for a DPIA
-
The DPIA: when? 2 min
- Know what a DPIA is and that it is done before the processing
- Apply the two-criteria rule among the nine, and know the CNIL's list
- Know who carries it out (the company, with the DPO's advice) and what to do about a remaining high risk
-
Knowledge check
15 questions, pass mark 80 %. Explanations after each answer; you can try again.
-
Attestation
One per person, with the date, the score and the frameworks covered — anyone can check it online with its code.
Version 1 · updated October 5, 2026