This module establishes the GDPR foundation for AI training data work. Learners examine the six lawful bases under Article 6 and the additional protection layer for special category data under Article 9, then practice applying a structured decision tree to assign the correct lawful basis to individual data elements in a Record of Processing Activities.

This module moves from element-by-element classification to operational completeness. Learners apply retention rules and DPO sign-off triggers to AI training data documentation, then populate a full RoPA, including retention periods, DPO routing, and the documentation that survives an audit cycle.

This module builds the analytical skill of reading a DPIA the way a regulator reads one—finding what isn't there. Learners study Article 35 triggers and the structural anatomy of a defensible DPIA, then practice gap-detection methodology against a sample DPIA for a healthcare patient triage AI chatbot to identify missing mitigations and complete the mitigation plan.

This module moves from finding gaps to making the de-identification decision that closes one. Learners study the mechanisms and trade-offs of pseudonymization and differential privacy, examine re-identification risk thresholds, and use a comparison matrix to evaluate both techniques against the healthcare chatbot's training data, producing a recommendation a product owner can act on.