UKOMNAS PDPA study plan

Map the Personal Data Protection Act's structure: scope, key definitions (personal data, data user, data subject, processing), and the roles of the Commissioner and the Personal Data Protection Committee.

Distinguish the PDPA's obligations from sector-specific rules and from other laws that intersect with data protection, and list at least five cross-statute touchpoints.

Explain the extraterritorial and territorial reach of the Act and apply it to three hypothetical organisations, including one offshore service provider.

Build a one-page glossary of at least 25 statutory terms with citations to the relevant sections.

Enumerate the core data protection principles and match each to the statutory provision that creates it.

Classify each lawful basis for processing and state the conditions, notice requirements, and withdrawal consequences for each.

Analyse five short scenarios and select the correct lawful basis, justifying each choice against the statutory text.

Draft the minimum content of a privacy notice that satisfies the Act's notification duties.

Differentiate the data subject rights (access, rectification, erasure, restriction, objection, portability where applicable) and state the response timelines and permitted refusals for each.

Design a consent capture and records workflow that evidences consent, handles withdrawal, and covers minors and sensitive data.

Write a template data subject access request response covering verification, fee rules, format, and refusal grounds.

Identify at least four situations where consent is not the appropriate basis and explain the alternative.

Identify the triggers that mandate a DPIA and screen ten project descriptions against those triggers.

Complete a full DPIA for one realistic high-risk processing activity, including necessity, proportionality, and mitigation.

Build a risk register that scores likelihood and impact using a defined scale and links each risk to a control.

Draft a 72-hour breach response runbook covering detection, containment, assessment, notification, and post-incident review.