Course Features

Pre-course reading

3.5 hour online sessions

40+ hours self-study

Live, interactive Instructor-led training

Unlimited 1-2-1 coaching

Exam preparation

90-minute online BCS exam

Course Overview

First launched in 1999, the BCS (formerly ISEB) Practitioner Certificate in Data Protection is the leading independent professional workplace qualification for individuals with privacy or data protection responsibilities. Over the years, the BCS has continued to evolve the practitioner certificate to keep pace with the advances in UK and EU legislation. In doing so, the BCS Practitioner Certificate has become one of the most trusted data protection training programmes in the UK and is frequently listed by employers as a required qualification.

The BCS DP practitioner certificate requires participants to develop a deep understanding of both UK and EU data protection laws and how to apply them in the workplace. Rather than focus on the strict interpretation of the law, this BCS-accredited data protection course places privacy in the context of human rights and promotes good practice within organisations.

The practitioner certificate examines all 10 chapters, 99 articles and 173 recitals of the UK General Data Protection Regulation (GDPR) (specifically those that remain relevant after being transposed into UK Law). It focuses on the complex interactions between the GDPR and the Data Protection Act 2018, including its derogations and exemptions, as well as the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations).

The BCS Practitioner Certificate in Data Protection recognises the ability of award holders to fulfil the mandatory role of a Data Protection Officer (DPO) or to lead UK GDPR compliance within their organisation, department or group.

This BCS-accredited GDPR training course follows the latest BCS Syllabus (v9.9) from June 2026, which takes into account the legislative changes following the end of the transition period on 31 December 2020, when the UK formally ceased to be a member of the EU, and everything up to the 42 amendments introduced by the Data (Use and Access) Act 2025 (DUA Act). It also examines the concepts of artificial intelligence (AI) and the overlap with information access laws.

The course is delivered online, although on-site in-company options are available. Delegates can gain a recognised practitioner-level workplace qualification by attending ten consecutive 3.5-hour live online sessions across two weeks. Participants will also receive a separate 1-day online revision course to help prepare for the BCS exam.

Course Costs

Attend the BCS Practitioner Certificate in Data Protection for:

£2,349.00 + VAT

10% discount for subscribing to our PrivacyNewsfeed & Training Announcement Newsletters
15% additional online saving for multiple bookings on public schedule courses
In-company options available for teams of 6 or more

BCS training package includes:

10 x 3.5-hour live online sessions across 2 weeks, or
5 days for a traditional classroom setting
Entrance to the 90-minute, multiple-choice online BCS Examination
1-2-1 coaching and support
1st year BCS Associate membership

Course materials:

Detailed eBook course manual (see here for eBook features & print options)
Includes free lifetime updates, which means it will never go out of date
Copy of the General Data Protection Regulation & Data Protection Act 2018
Full course PowerPoint presentation
Exercises & revision materials
Sample exam questions

Book Now

Intended Audience

The BCS Practitioner Certificate in Data Protection is suitable for those individuals with the following roles or responsibilities:

Data Protection Officers (DPO)
Chief Privacy Officer (CPO)
Data protection practitioners
Information governance managers
Governance, Risk and Compliance (GRC) professionals
Information security, IT security and IT professionals
Privacy engineering
Solicitors advising on information law
AI governance
Project management

Learning Outcomes

By obtaining the Practitioner Certificate in Personal Data Protection, individuals will:

Hold a recognised practitioner-level qualification in GDPR
Gain an in-depth understanding of the UK's post-Brexit data protection legislative framework (UK GDPR, DPA18 & PECR)
Learn about the obligations placed on controllers, joint controllers and processors
Understand the need for effective record keeping
Be able to apply the rights available to data subjects
Develop a Privacy by Design approach when implementing new processing systems
Understand the rules surrounding international data transfers under UK & EU GDPR
Possess the ability to perform the tasks a Data Protection Officer
Prepare an organisation to achieve and maintain compliance with the UK GDPR
Be confident to implement relevant data protection skills development initiatives

Course Itinerary

The BCS Certificate in Data Protection is a GDPR training course conducted over 10 consecutive morning sessions (or 5 full days when delivered in-company).

The following schedule is intended as a guide:

Module 1	Introductions, Learning outcomes
	BCS Exam details & techniques
	Data protection, privacy and its history in the UK • Article 2 Material scope of UK and EU GDPR • Article 3 Territorial scope and jurisdiction of UK and EU GDPR • Awareness of EU Main Establishment, one-stop-shop mechanism (OSS) • Article 27 UK and EU requirements for Representation
	Principles of Data Protection and Applicable Terminology • Article 4 Definitions of UK and EU GDPR • Article 5 Principles of UK and EU GDPR
Module 2	Principles of Data Protection and Applicable Terminology (continued)
Module 2	Lawfulness of Processing Personal Data • Article 6 Lawful Basis of Processing • • Article 9 Processing special categories of personal data • Additional safeguards: UK GDPR Article 9 and DPA18 Schedule 1
Module 3	Lawfulness of Processing Personal Data (continued) • Article 9 Processing special categories of personal data (continued) • The Rules for processing criminal offence data
Module 3	Accountability Principle • Article 5(2) Accountability and Article 24 Responsibility of the controller (accountability obligations) • Article 35 Data Protection Impact Assessments (DPIA) • Article 30 Records of Processing Activity (ROPA) • Articles 13 and 14 Interplay with Privacy Notices
Module 4	Accountability Principle (continued) • Article 25 Data Protection by Design and Default • Article 32 Security of personal data • Article 37-39 The position, tasks and role of the Data Protection Officer
Module 4	Obligations of Controller, Joint Controllers and Processors • Article 24 Responsibilities of the Controller • Article 28 Responsibilities of the Processor • Cloud Service Providers (CSPs)
Module 5	Obligations of Controllers, Joint Controllers and Processors (continued) • Article 26 Joint Controllers • Article 28(3) Data processing agreements
	International Data Transfers under EU and UK GDPR • Article 44 General principles for transfers • Article 45 UK Adequacy Regulations and EU Adequacy Decisions • Article 46 Appropriate safeguards: - UK International Data Transfer Agreement (IDTA) - EU Standard Contractual Clauses (SCCs) • Article 47 Binding corporate rules • Article 49 Derogations for specific situations
	Data Subjects Rights • Article 12 Transparency and Modalities • Articles 13 and 14 Information to be provided to a data subject • Article 15 Right of Access • Section 184 Prohibition against enforced subject access requests • Section 185 Void contractual terms relating to health records
Module 6	Data Subjects Rights (continued) • Article 16 Right of rectification • Article 17 Right to erasure • Article 18 Right of restriction • Article 19 Notification obligations • Article 20 Data portability • Article 21 Right to object • Article 22 Automated decision making and profiling Restrictions that may affect Data Subject Rights (as per Article 23 Restrictions and DPA18, Schedules 2 and 3) • Access rights of FOI and EIR • Impact of AI on data rights
Module 6	The Role of the Supervisory Authority (EU) • The role and importance of supervisory authorities • Article 57 Tasks of the Independent Supervisory Authorities • Article 68-73 European Data Protection Board (EDPB)
Module 7	The Information Commissioner’s Office (ICO) • The role of the ICO • Investigative and corrective powers of the ICO as the UK regulator • ICO guidance and codes of practice • Promoting public awareness • Promotion of Privacy Seals, certification schemes and commonly used standards • Advice and reporting to Parliament • Data Protection Fees and Exceptions
Module 7	Breaches, Enforcement and Liabilities and Role of the Tribunal • Articles 33 & 34 Obligations to report personal data breaches to ICO and data subjects • Data Protection Complaints • Sanctions that can be imposed due to breaches or complaints • Reprimands • Notices and Administrative fines • Liabilities of controllers and processors
Module 8	Breaches, Enforcement and Liabilities and Role of the Tribunal (continued) • Criminal liabilities – Offences • Offences under the Computer Misuse Act 1990 • The role of the Tribunal
	Processing of personal data in relation to children • Article 8 Consent in relation to Information Society Service • Children’s right to erasure • Age Appropriate Design Code (Children's Code)
	Specific provisions relevant to public authorities • Meaning of Public Authority/Body • Article 6(1)(e) Public Task lawful basis of processing considerations • DPA18 Section 7(2) interplay for public authorities with Article 6(1)(f) • Relevant exemptions from Schedules 2 & 3
Module 9	Application of data protection legislation in key areas of industry • Overview of ICO Codes of Practice: - Employment Code - Surveillance Cameras and Personal Information Code - How the use of cookies and digital technologies is governed by data protection law (and PECR) - Data Sharing Code AI and the processing of personal data • What is meant by AI • AI Risks and Benefits • The Data Protection Principles and AI • DPIAs and AI
Module 9	Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) • Link to GDPR consent definition • Types of electronic marketing and obligations
Module 10	Questions & Answers
Module 10	Individual 1-2-1 tutorials

Side-by-side GDPR comparison + DUA Act markup

As the UK diverges from EU data protection standards toward a more pro-growth, risk-based framework through changes introduced by the DUA Act, practitioners will increasingly need to understand the differences between the two GDPR jurisdictions.

Our in-house-developed BCS course materials include detailed side-by-side comparisons of the EU and UK versions of the GDPR, as well as additional markup of the DUA Act.

BCS DP Practitioner Syllabus

Practitioner Certificate in Personal Data Protection (PC-DP)
Extracted from syllabus version 9.9
June 2026

Download the new syllabus (PDF)

This professional certification is not regulated by the following United Kingdom Regulators - Ofqual, Qualification in Wales, CCEA or SQA.

Exam Preparation Day

Exam preparation days are optional and run every bi-monthly. To attend, coordinate and select a revelent date with our office.

The topics covered in this session include:

Part 1. Online discussion and presentation

Exam technique
Timing
Completing the exam paperwork
How to read and answer BCS exam questions properly
Exercises
Group discussion, 3 example questions

Part 2. Mock exam

45-minute mock exam (50% of the exam paper)

Part 3. Discussion, Q&A, review of the mock exam

Group discussion, mock exam answers

Following the examination prep day, the instructor will evaluate each student’s mock paper and provide individual feedback. This will include direct comments on the answers and offer guidance for further study areas.

BCS DP Practitioner Examination

Duration and Format of the BCS Examination

The BCS Practitioner Certificate in Data Protection exam format is a 90-minute multiple-choice examination. The exam is a closed book, i.e. no materials can be taken into the examination room.

Format of the Examination

Type	40 Multiple Choice questions
Duration	90 minutes
Supervised	Yes
Open Book	No (no materials can be taken into the examination room)
Pass Mark	26/40 (65%)
Delivery	Digital or paper-based

Additional time for candidates requiring Reasonable Adjustments

Adjustments and/or additional time can be requested in line with the BCS reasonable adjustments policy for candidates with a disability or other special considerations, including English as a second language.