To get a PDF, choose "Save as PDF" as the printer.

1. Module 1. What data protection law covers

   Every business holds personal data: staff records, customer bookings, CCTV, emails and payment details. Data protection law sets out how that data must be handled.

   What you will learn

   • Explain what personal data and special category data are.
   • Name the main data protection laws in the UK and the regulator.
   • Describe the seven principles.

   Key points

   • Personal data is any information about an identifiable living person.
   • Health data, including allergies, is special category data and needs extra care.
   • Follow the seven principles and have a lawful basis for every use.
   • The Information Commissioner's Office (ICO) enforces the law and can issue large fines.

   Based on: UK General Data Protection Regulation (UK GDPR); Data Protection Act 2018; Privacy and Electronic Communications Regulations 2003 (PECR); Information Commissioner's Office guidance.

2. Module 2. People's rights and everyday good practice

   People have rights over their data, and most data protection problems come from small everyday habits. This module covers both.

   What you will learn

   • Recognise the main data protection rights.
   • Handle a request for personal data correctly.
   • Follow good practice with paper, screens, email, phones and CCTV.

   Key points

   • People can ask for a copy of their data, corrections, deletion and an end to marketing.
   • Pass any request to your manager straight away. Most must be answered within one month.
   • Lock screens, shred paper, use strong passwords and check email recipients.
   • Use BCC for group emails and respect marketing choices.

   Based on: UK General Data Protection Regulation (UK GDPR); Data Protection Act 2018; Privacy and Electronic Communications Regulations 2003 (PECR); Information Commissioner's Office guidance.

3. Module 3. Data breaches and what to do

   A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, shared or accessed without permission. Fast reporting limits the harm.

   What you will learn

   • Recognise a personal data breach.
   • Report a breach immediately inside the business.
   • Explain when the business must report to the Information Commissioner's Office (ICO).

   Key points

   • A breach is any loss, sharing or access to personal data without permission.
   • Report breaches immediately inside the business. Never hide them.
   • The business must report risky breaches to the Information Commissioner's Office (ICO) within 72 hours.
   • Watch for phishing, and report suspicious messages.

   Based on: UK General Data Protection Regulation (UK GDPR); Data Protection Act 2018; Privacy and Electronic Communications Regulations 2003 (PECR); Information Commissioner's Office guidance.

HygieneReady certificates confirm completion of training. They are not a regulated qualification. Definitions of the key terms are in the glossary.