Although the UK has now left the European Union, employees must comply still comply with UK data protection laws.
Now, the UK's main data protection law is still known as the GDPR.
GDPR Hero covers a broad range of topics to ensure your staff are clear on how to handle and protect data within your organisation.
In this premium e-learning course, we first conduct a brief overview of the UK GDPR to settle into the topic. Then we challenge learners on their knowledge of the UK GDPR through quickfire questions. Finally, a feedback page details the topics each learner needs to work through in order to complete the course.
This course covers the following key areas:
- Exercise: Key definitions
- Exercise: Data processing
- Exercise: Lawful basis
- Exercise: Rights
- Exercise: Compliance measures
- Exercise: Breaches
- Multi-choice questions to assess existing knowledge
- Dashboard view of training needs in 10 key topics
- What are the key principles
- Can we process personal information for another purpose?
- How can we meet the data minimisation principle?
- Does this meet the accuracy principle?
- Does this violate the storage limitation principle?
- How can we be more proactive when it comes to security?
- Best practice and the six principles of data processing
- What are Individual Rights?
- How should we meet the right to be informed?
- What is the right of access?
- Do we need to fulfil this request?
- When requests are refused or the time is extended
- What other rights do individuals have under the GDPR?
- Is the right to rectification justified?
- When does the right of erasure apply?
- Does the right of erasure apply in this case?
- When does the right to restrict processing apply?
- What other rights do individuals have under the GDPR?
- What rights do you have to stop marketing?
- Can we make solely automated decisions with a legal or significant impact on individuals?
- What is the right to data portability?
- Best practice and individual rights
- What is the lawful basis?
- Why is lawful basis important?
- The six lawful bases
- Relying on consent
- When might we rely on contract?
- You decide: What lawful basis applies in this case?
- Can the company share our personal data?
- Can we rely on contract for this purpose?
- Other obligations in respect of lawful basis
- When is legitimate interests appropriate?
- When we use consent as the lawful basis
- Can we switch the basis from consent to legitimate interests?
- The link between lawful basis and individual rights
- Best practice on the lawful basis for processing personal data
- What is a legitimate interest?
- When might individual interests override Company interests?
- When the interests of the Company and individuals collide
- The Legitimate Interests Assessment (LIA)
- Sophie's story: The purpose test
- Sophie's story: The necessity test
- Sophie's story: The balancing test
- Meeting the GDPR principles
- Individual rights when relying on legitimate interests
- Documenting and reviewing your LIA
- Best practice for using legitimate interests
- What is consent?
- Do we always need consent?
- Is consent the gold standard?
- When do we need consent?
- What constitutes valid consent?
- Can we automatically enrol website visitors?
- Consent can't be bundled with another action
- Consent by default?
- Does consent always require an opt-in box?
- How should we obtain consent?
- How long does the consent last?
- Right to withdraw consent
- Best practice in obtaining consent
- What is special category data?
- Is it special category data?
- Collecting special category data
- Conditions for processing special category data
- What separate condition would apply in this case?
- Conditions for processing special category data
- What is the condition for substantial public interest?
- Safeguarding special category data
- How should we protect special category data?
- What more can we do to protect special category data?
- Best practice and special category data
- The impact of data breaches
- Do we always need to report breaches?
- Informing individuals
- Recognising data breaches
- Informing relevant people
- What information is required for a breach notification to the ICO?
- What if we don't have all the information yet?
- Assessing the impact on individuals affected by a data breach
- Do the affected individuals need to be informed?
- Data breaches and third parties
- Accountability
- Documentation
- Best practice and personal data breaches
- What are restricted transfers?
- Checklist for restricted transfers
- Is it a restricted transfer?
- Adeel's bookings
- What's the difference between transfer and transit?
- How can you make a restricted transfer in accordance with the GDPR?
- Is there an "adequacy decision"?
- Can PNR data be shared outside the UK?
- Are there appropriate safeguards?
- What appropriate safeguards are in place?
- What are the main exceptions?
- Do you know what exception applies here?
- Best practice and international transfers
- What does accountability mean in data protection?
- How do we demonstrate accountability?
- Good Governance Measures 1-3
- Who needs a DPO?
- Good Governance Measures 4-5
- When do we need to conduct a DPIA?
- How can we mitigate risks?
- Good Governance Measures 6-8
- Checklist
- Best practice in accountability and governance
- When do you need a DPIA?
- Benefits of conducting a DPIA
- How to conduct a DPIA
- Exercise: When is a DPIA required?
- Scenario: CCTV data
- The risk of CCTV
- The legal basis for CCTV
- The necessary criteria for CCTV
- CCTV in the workplace
- The impact of CCTV on privacy
- Best practice for DPIAs
Approximately 90-minutes long e-learning course followed by a 10-question assessment.
Suitable for DPOs, senior managers, and frontline staff that regularly deal with personal data. Previous knowledge of data protection legislation required.
SHARD-compliant, responsive display on all devices, accessibility on screen readers, visual design controlled via a client style sheet.
All Windows, Mac OSX, iOS, Android (Flash-free for mobile compatibility). AICC and SCORM 1.2-compliant, suitable for both hosted and deployed SCORM or AICC.
Fully customisable on Skillcast Portal CMS.
Pre-translated versions not available, but all text content can be exported for translation into all languages.
Based on UK legislation, but suitable for global audiences upon the removal of UK-specific references and translation as necessary.
Our compliance training courses are available across Skillcast plans. Our plans cover businesses with small to large teams and offer a mix of tailored and off-the-shelf courses.
We have three plans available; simply choose the one that meets your needs below.
Skillcast CoreCompliance provides your own portal pre-loaded with the key compliance courses needed in your sector. It's the most comprehensive and cost-effective compliance training solution on the market for teams of up to 50 staff.
Prices start from £349 for 12 months.
Skillcast Standard is a flexible plan for building your digital compliance portal. You start with our award-winning Learning Management System and select one or more course libraries to train your staff.
Later, you can add the Policy Hub for policy attestations, DSE self-assessment, Gifts and Hospitality register, and other features to streamline staff compliance.
Skillcast Premium combines our innovative technology tools and features into one simple solution. The premium plan is designed for companies that want a fully featured, branded and managed portal to transform their staff compliance.
It enables you to create comprehensive user journeys to deliver learning and policies, obtain declarations and submissions, and consolidate data to achieve your compliance outcomes.
In the United Kingdom, the Senior Managers and Certification Regime (SMCR) is designed to foster accountability among senior managers at financial services companies while elevating ethical and professional standards across the entire workforce.
The SMCR replaced the Approved Persons Regime (APR), which was previously applicable to key individuals in regulated entities. In the realm of insurance companies, this regime effectively superseded the Senior Insurance Managers Regime (SIMR), marking a significant shift in how financial services firms manage and hold their senior personnel accountable.
There are three key parts to the SMCR: Senior Managers Regime, Certified Persons Regime and Conduct Rules.
1. Statement of Responsibilities - Set out the areas for which each Senior Manager is personally accountable
2. Responsibilities Map - This knits together the Statement of Responsibilities
3. Pre-approval for all Senior Managers - obtain this from the regulators before they carry out their roles
4. Duty of Responsibility - Ensure that Senior Managers understand their responsibilities and take reasonable steps to prevent regulatory breaches in their areas of responsibility
5. Identify all Certified Persons - These are all material risk takers
6. Fit and Proper Assessment - Of all Certified Persons, then re-assess on an annual basis
7. Training - Of all those who are subject to the Conduct Rules
SMCR rollout waves
The SMCR has been rolled out in three waves:
Wave 1: Banks, building societies, credit unions and large investment firms in March 2016 (updated July 2018)
Wave 2: Extended to insurance firms (those regulated by the FCA and PRA) in December 2018
Wave 3: The remaining financial services firms (otherwise known as 'solo-regulated firms' since they are regulated only by the FCA, not the FCA and PRA) came under the scope of this regime in December 2019.
SMCR categories
The third wave encompasses a wide variety of firms. To ensure that regulation is appropriate to their sizes and activities, the FCA has categorised them into three distinct groups:
Core: Firms that have to comply with the baseline requirements for solo-regulated firms
Limited scope: Firms that already had exemptions under the Approved Persons Regime, and are exempt from some requirements and require fewer senior management functions
Enhanced: Firms that have extra requirements - these are large, complex firms with potential impact on consumers or markets which warrant more attention from the FCA
Senior Managers have a statutory duty of responsibility "to take reasonable steps to prevent regulatory breaches in the areas of the firm for which they are responsible". The FCA can take action against a Senior Manager (SM) where it can show that:
The burden of proof for all these elements lies on the FCA. The SM does not need to show that they took reasonable steps - rather, it is for the FCA to prove that they did not. The defence against such action is if the senior manager can show that they took "the steps that are reasonable for a person in that position to take to prevent a regulatory breach from occurring".
The FCA must approve all senior managers, which assess whether they are fit and proper to perform the given function or responsibility.
Three key factors determine whether you are Fit and Proper:
When assessing a person's financial soundness, the FCA typically does not require a statement of the individual's assets or liabilities. Having limited financial means does not, by itself, impact the suitability of a person to perform a Senior Management Function (SMF).
When appointing a Senior Manager or Certified Person, firms must obtain regulatory references from all of their past employers from the past six years. This requirement also applies to the appointment of Non-Executive Directors (NEDs) who are not Senior Managers.
To meet this requirement, firms must keep records of disciplinary actions and fit and proper assessments for the past six years and avoid any agreements that would conflict with their disclosure obligations.
This training aid is just one of 100+ free compliance training resources, including assessments, best practice guides, checklists, desk aids, eBooks, games, handouts, posters, training presentations and even e-learning modules!
You can keep up to date with SMCR best practices, industry insights and key trends across regulatory compliance, digital learning, EdTech, and RegTech news, by subscribing to our FCA Compliance Bulletin.
Our SMCR Compliance roadmap will help you navigate the compliance landscape supported by a comprehensive library of SMCR Courses and a fully integrated SMCR 360 Compliance Toolkit to streamline, unify and automate your processes.
Finally, SkillcastConnect provides a unique opportunity to network with other compliance professionals in a vendor-free environment, as well as exclusive benefits, including access to our free online learning portal.