Avon LMC

DPO Programme - Module 3 (Virtual)
2026-10-14 13:00 - 16:00 (Europe/London)
Number of capacity: 15

Summary
This module examines breach governance under Articles 32–34 UK GDPR from a defensibility and regulatory reasoning perspective.
It focuses on risk-to-rights assessment, notification thresholds, documentation architecture, and board-level oversight.
A 3-hour governance session covering:

Legal definition of personal data breach
Risk to rights and freedoms assessment model
72-hour ICO notification threshold
Article 32 proportionality
Patient notification test (Article 34)
Insider misuse and supply chain exposure
Mitigation as regulatory credit
Breach documentation architecture
Governance oversight model

Mapped to NHS DSPT Standards 1–3.
Course Content

Breach identification and classification
Risk scoring and reportability decisions
ICO notification and patient communication
Mitigation and documentation defensibility
Breach governance structure for GP practices

Expected Outcome

Conduct structured breach risk assessments
Determine ICO notification thresholds confidently
Maintain defensible breach documentation and escalation logs

DPO Programme - Module 4 (Virtual)
2026-10-21 09:30 - 12:30
Number of capacity: 15

Summary
This session integrates operational data protection mechanics into board-level assurance and strategic governance.
It focuses on Article 30 Records of Processing (ROPA), DPO obligations, documentation architecture, and compliance maturity modelling.
A 3-hour strategic governance session covering:

ROPA completeness and audit utility
Processor listing discipline
DPO independence requirements
Caldicott Guardian interface
Governance documentation hierarchy
Training assurance evidence
Compliance maturity levels (1–4)
Board reporting structure
Integrated governance dashboard model

Mapped to NHS DSPT Standards 1–3.
Course Content

Article 30 ROPA architecture and audit readiness
DPO governance and independence
Documentation and asset ownership mapping
Compliance maturity assessment
Annual assurance cycle design

Expected Outcome

Maintain an audit-ready ROPA
Demonstrate DPO structural independence
Articulate governance maturity at board level

DPO Programme - Module 5 (Virtual)
2026-10-21 14:00 - 16:30
Number of capacity: 15

Summary
This applied workshop guides delegates through the lifecycle of a Data Protection Impact Assessment (DPIA), focusing on defensible risk reasoning and mitigation discipline.
It uses a structured case study to embed the requirements of Articles 35–36 into GP governance practice.
A 2.5-hour DPIA workshop covering:

DPIA trigger test (high-risk processing)
Processing description and data flow mapping
Necessity and proportionality analysis
Risk identification and structured scoring
Mitigation design and documentation
DPO consultation recording
Residual risk acceptance
Governance sign-off model

Mapped to NHS DSPT Standards 1–3.

Course Content

Determining when a DPIA is legally required
Risk identification and structured scoring model
Designing specific mitigation strategies
Recording DPO advice and residual risk
Embedding DPIA into project lifecycle governance

Expected Outcome

Conduct a legally defensible DPIA
Apply necessity and proportionality rigorously
Integrate DPIA governance into operational decision-making
