DAY 1 — SEE THE RISK

Opening — The Data Moment

• Digital responsibility; personal data as a business, operational, privacy and trust asset; analytics, AI, profiling and automated decisions.

Module 1 — From Personal Data to Organisational Responsibility

• PDPA framework, scope, personal data, controller, processor, 2024 amendments, controller registration, DPO awareness and the wider privacy, cybersecurity, data sharing, online safety and AI governance ecosystem.

Module 2 — Privacy & Seven Principles Test

• Seven Principles, purpose, notice, choice, disclosure, security, retention, data integrity, access, necessity and proportionality.
• Practical Privacy Notice and Seven Principles Test.

Module 3 — Accountability Test

• Accountability beyond policies; management ownership, DPO, governance, records, contracts, processors, vendors and evidence.

Vendor Problem

• Third party processing, contracts, access, disclosure, security, sub processors and cloud dependency.
• Practical Vendor Risk Check.

Module 4 — Lifecycle Test

• Collection, use, disclosure, storage, transfer, retention and disposal; minimisation, purpose limitation, access and correction, third parties, cloud and cross border transfer.
• From reuse to training, profiling, inference and decision making.
• Practical Follow the Data exercise.

Module 5 — Privacy Risk Test

• Privacy risk, affected individuals, harm, likelihood and severity, high risk, technology, profiling, residual risk and DPIA.
• Practical HR Facial Recognition DPIA.

Should We Proceed?

• Applying principles, accountability, lifecycle and DPIA: Proceed / Modify / Escalate / Reassess.
• Day 1 takeaway: SEE THE DATA. RECOGNISE THE RISK.

DAY 2 — MANAGE THE RISK

Privacy Blind Spot

• Excessive collection, unclear purpose, weak access, indefinite retention, vendor dependency, poor Privacy by Design, uncontrolled reuse and AI/profiling.
• Practical Spot the Blind Spot.

Module 6 — Protection Test

• Privacy by Design and by Default, minimisation, access, privacy settings, retention, security, transparency and accountability.
• Practical Marketing Loyalty App case: Keep / Remove / Restrict / Protect / Explain.

Design It Better

• Practical application of Privacy by Design and by Default. Building privacy protection into processes, systems and services from the outset.

Module 7 — Breach Test

• Data breach assessment, escalation, evidence, notification, affected individuals, processors, containment and remediation.
• Practical Breach Decision.

When Data Goes Wrong

• Incident response governance, regulatory response, business impact, communications and evidence.
• Case Lens using selected Malaysian data incidents.

Module 8 — Digital Future Test

• Automated decision making and profiling, AI and personal data, generative AI, training data, accuracy, transparency, human involvement, challenge, AI governance and agentic AI.
• Practical case: The AI Agent Has Access.

When System Decides

• Profiling, significant decisions, human oversight, transparency, explanation, accuracy, challenge, accountability and meaningful human involvement.
• Practical Decision Test.

Module 9 — Governance & Evidence Test

• Leadership, DPO, registration, privacy notices, vendors, complaints, sector codes, monitoring, regulatory engagement, enforcement and evidence.
• From policy to proof. Practical Governance Stress Test.

Module 10 — Improvement Test

• Risk based improvement, prioritisation, owner, evidence, monitoring and corrective action.
• Practical exercise: One weakness → One risk → One control → One owner → One evidence → One action.

Privacy Moment

• Assess → Protect → Respond → Evidence → Monitor → Improve.
• Day 2 takeaway: ASSESS THE RISK. PROTECT THE DATA. IMPROVE WHAT MATTERS.