Personal data from collection to deletion: notices, vendors, retention and impact assessments
Follow personal data through its life at work: know what you hold, collect only what you need and tell people why at the time, recognize when a supplier is a processor that needs a proper contract, spot projects that may need a data protection impact assessment (DPIA), keep data no longer than your retention schedule says, dispose of it so it can't be read, and plan for incidents. Uses the US FTC's five principles (take stock, scale down, lock it, pitch it, plan ahead) and UK ICO guidance as examples; your privacy team and local law govern.
- Level
- Intermediate
- Length
- About 45 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 3 Oct 2026
Skills you'll practise
- Apply the FTC's five principles to everyday handling of personal information
- Design a form or process that collects only the data it needs, with privacy information at the point of collection
- Distinguish a controller from a processor and list what a processor contract must cover
- Recognize indicators that a project may need a DPIA and raise it early with the privacy team
- Apply a retention schedule, and dispose of paper and devices so data can't be read or reconstructed
- Explain why an incident plan names a coordinator and who may need to be notified
Course outline
- 1.Personal data from collection to deletionVideo · 3 min
- 2.Before you collect: take stock, scale down, tell peopleLesson · 15 min
- 3.Suppliers and new projects: processors, contracts and DPIAsLesson · 15 min
- 4.Keeping and getting rid of it, and planning aheadLesson · 15 min
- 5.Personal data from collection to deletion: notices, vendors, retention and impact assessments: knowledge checkKnowledge check · 17 questions
- 6.The open-day booking formScenario
- 7.Final exam9 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- FTC (US): Protecting Personal Information: A Guide for Business (take stock, scale down, lock it, pitch it, plan ahead)
- ICO (UK): Right to be informed
- ICO (UK): What are 'controllers' and 'processors'?
- ICO (UK): What needs to be included in the contract? (controller-processor contracts, Article 28)
- ICO (UK): When do we need to do a DPIA?
- ICO (UK): Principle (e): Storage limitation
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.