After the course you can put the GDPR into practice in your organisation: you write privacy policies, establish who is controller or processor, carry out a data protection impact assessment and know which steps a data breach requires and by when. You also keep records of processing and build privacy by design into your processes. The course is aimed at data protection officers and compliance, legal and security staff who are taking on responsibility beyond the basics and want to prepare for the professional-level EXIN exam.
What you’ll take away.
- Develop privacy policies and embed them in existing management systems
- Distinguish the roles of controller, processor and data protection officer
- Plan, carry out and document a data protection impact assessment
- Assess and report personal data breaches and organise the response
- Anchor records of processing and privacy by design across the data lifecycle
Your training in detail
- Who is it for?
- Data protection officers and coordinators, compliance, legal and security staff, auditors and HR managers who run data protection in their organisation day to day.
- Prerequisites
- EXIN recommends passing EXIN Privacy & Data Protection Foundation first. You should be confident with the basic concepts of the GDPR.
- Format & planning
- Standard length: 3 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Privacy policies: content, responsibilities and fit with existing management systems
Organising data protection: records of processing, privacy by design and the data lifecycle
Roles and contracts: controllers, processors, joint controllership and the position of the DPO
Data protection impact assessment: when it is required and how to carry it out step by step
Personal data breaches: assessment, notification deadlines, informing data subjects and incident response
Exam preparation and working through the practical assignments
For a fictional HR software product you produce a data protection impact assessment and then work through a data breach: you assess the risk, decide whether to notify and draft the message to the supervisory authority.
Exams, licences & credentials
The course prepares you for the EXIN Privacy & Data Protection Professional exam. The exam and its fee are included only if the offer confirms this. For the certificate EXIN requires, besides a passed exam, accredited training with successfully completed practical assignments; check in advance whether the offer meets this requirement. EXIN issues the certificate. This is not an official EXIN course unless the offer states otherwise.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
What is the EXIN exam like?
According to EXIN it has 40 multiple-choice questions in two hours, and you need 65 per cent to pass. Current details are in EXIN's preparation guide.
Do I need the Foundation certificate?
EXIN recommends the Foundation exam as a first step but does not require it. If you already know the GDPR basics well, you can start directly.
Does the course replace legal advice?
No. It teaches how to apply the GDPR in processes but does not replace a legal review of individual cases.
Does EXIN Privacy & Data Protection Professional: putting the GDPR into practice include a certificate?
The course prepares you for the EXIN Privacy & Data Protection Professional exam. The exam and its fee are included only if the offer confirms this. For the certificate EXIN requires, besides a passed exam, accredited training with successfully completed practical assignments; check in advance whether the offer meets this requirement. EXIN issues the certificate. This is not an official EXIN course unless the offer states otherwise.