Course Details

CPD REFRESHER · ENGLAND AND WALES

Information Governance, Data Protection & GDPR

A practitioner refresher for people who already handle personal and confidential information at work.

TEN MODULES · 20-QUESTION KNOWLEDGE CHECK · 10–12H GUIDED LEARNING

CPD HOURS

30 hours

ACCREDITED BY

CPD Standards Office

FORMAT

Blended self-paced

SLIDES

PPT Deck

WATCH

Video Lesson

LISTEN

Audio Podcast

QUIZ

Audio Quiz

VISUAL

Infographic

Overview

Information governance is the framework of law, roles, policies and behaviours that lets an organisation hold, use, share and dispose of information lawfully, securely and usefully. Data protection is one strand; records management, information security, confidentiality, transparency and information quality are the others — and they fail together when governance is weak.

This course refreshes and updates practitioners across all of those strands in ten modules. It starts with the legal landscape and the regulator (including the DUAA 2025 changes and the move from the ICO to the Information Commission), then works through definitions and lawful bases, individual rights and the new complaints duty, records and retention, security, breaches, lawful sharing (including Caldicott, safeguarding and police requests), accountability tools, freedom of information, and finally international transfers, AI and automated decisions, PECR and how to stay current. Every module ends with an Apply and Reflect page that sends the learner back to their own organisation’s policies, records and systems.

Who this course is for

Not for complete beginners (it assumes working familiarity with personal data), people seeking a legal qualification, or anyone needing Scotland- or Northern Ireland-specific FOI or sector guidance.

IG, data protection and information rights officers — a structured update on the DUAA 2025 changes, the complaints duty, SAR clarifications, ADM regime and transfers test

Records managers and information managers — retention, disposal, messaging channels, digital continuity, and how records underpin SARs, FOI and breach response

Health and adult social care staff and managers — Caldicott Principles, duty of confidence, sharing for care and safeguarding, DSPT context, breach handling

Local authority, education, police and charity staff — FOI and EIR handling, safeguarding sharing, PECR for charities, public-task lawful bases

HR, finance and operations managers — special category data in HR, retention, security behaviours, processor contracts, incident roles

IT and security staff — how Art. 32, breach reporting, processors and DPIAs connect to technical controls and NCSC/Cyber Essentials

Senior managers, SIROs, information asset owners, trustees — what accountability evidence a board should see, the three lines of assurance, enforcement trends

Learning outcomes

By the end of the course, learners will be able to:

✓
Explain what information governance covers, name the main statutes and codes in England and Wales, and identify governance roles in your own organisation.

✓
Decide whether information is personal, special category, criminal offence, pseudonymised or anonymous, and select and document a lawful basis.

✓
Recognise a rights request however it arrives, run a subject access request end to end, and operate the new data protection complaints procedure.

✓
Describe the records lifecycle, use a retention schedule, and dispose of records securely with evidence.

✓
Apply the security principle and Article 32, recognise phishing and social engineering, and apply core technical and organisational controls.

✓
Recognise a personal data breach, contain and escalate promptly, and assess whether the regulator and individuals must be told.

✓
Apply the ICO Data Sharing Code, reconcile UK GDPR with the duty of confidence and Caldicott Principles, and share to safeguard with confidence.

✓
Maintain a record of processing activities, screen for and conduct a DPIA, and explain the DPO’s tasks and independence.

✓
Recognise a valid FOI or EIR request, apply exemptions and the public interest test, and run an internal review.

✓
Decide when an international transfer is restricted, apply the new ADM regime, and handle marketing and cookies under PECR.

Career path

Information governance / data protection officer or manager

Runs the IG programme: policies, ROPA, DPIAs, DSARs, breaches, training; progression to Head of IG, DPO for a group, or consultancy

Records manager / information manager

Owns retention schedules, systems of record, digital continuity and archives; progression to Head of Information Management

FOI / information rights officer

FOI, EIR and SAR case handling, internal reviews, publication schemes; progression to information rights lead

Information security and cyber roles

Security analyst, ISO, CISO; overlaps with IG on Art. 32, incidents and assurance

Caldicott Guardian, SIRO, information asset owner

Senior roles held alongside clinical or executive posts; progression by seniority rather than a separate career track

Compliance, audit and legal

Internal audit of IG, compliance management, paralegal or solicitor specialising in information law

Information governance is a field people enter from many directions — administration, records, IT, health and care, legal, HR — and where experience is valued because it is evidence-driven. Professional certifications named above are examples, not endorsements, and none is conferred by this course.

Course structure

1
The IG Landscape in England and Wales

2
Personal Data, the Principles and Lawful Bases

3
Individual Rights, Subject Access and Complaints

4
Records Management, Retention and Disposal

5
Information Security for Practitioners

6
Personal Data Breaches and Incident Response

7
Sharing Information Lawfully and Confidently

8
Accountability in Practice: ROPA, DPIAs, DPOs and Assurance

9
Freedom of Information and Transparency

10
Transfers, New Technology, PECR and Keeping Current

Course delivery

Each module closes with an Apply and Reflect page tied to the learner’s own organisation. A practitioner-support note precedes Module 6, plus a 20-question knowledge check with a trainer-only answer key.

Frequently asked questions

Q. Is this a qualification or a licence to practise?

No. It is a CPD refresher. It does not confer legal status, professional registration or authority, and completing it does not make you a DPO or Caldicott Guardian.

Q. Is it accredited, and how many CPD points is it worth?

Accreditation, points and any certificate wording depend on the delivering provider. Nothing in this package should be read as claiming accreditation.

Q. Which jurisdiction does it cover?

England and Wales. UK GDPR and the DPA 2018 apply UK-wide, but FOI in Scotland is under FOISA 2002, sector codes differ, and Northern Ireland has its own public authority list.

Q. Is the content current after the Data (Use and Access) Act 2025?

Written and checked in August 2026 against the DUAA commencement dates. ICO guidance was still being rewritten and the Information Commission transition was pending — re-check before each delivery.

Q. How long does it take?

Indicatively 10–12 guided learning hours across ten modules, plus time for the applied tasks and the 20-question knowledge check.

Q. Does passing the quiz prove competence?

It shows knowledge of the material at that time. Competence is demonstrated in practice and assessed by your employer or professional body.

Q. Will it tell me exactly what to do in my organisation?

No — your own policies, contracts and sector codes take precedence. Every module ends with tasks that ask you to check the content against your own arrangements.

Q. Are the statistics reliable?

Each figure names its source and year on the slide, verified in August 2026. Statistics of this kind are updated annually and must be re-verified before publishing.

INFORMATION GOVERNANCE, DATA PROTECTION & GDPR · 30 CPD HOURS · ACCREDITED BY CPD STANDARDS OFFICE · TEN MODULES

£25.00

Course Features

Lectures 13
Quizzes 2
Duration Lifetime access
Skill level All levels
Language English
Students 2
Certificate Yes
Assessments Self