The GDPR overturns and eclipses virtually all current data protection and privacy legislation in Europe – and by inference worldwide – and exemplifies further the increasing trend of the need for enterprises to self-report breaches to a regulatory authority and also underscores governmental trends to utilise regulation as a surrogate for taxation.

The big change is that control over private data is now vested in the individual de facto as well as de jure. Others’ processing, unlawful by default, is feasible only if they can prove in advance that their intended processing is lawful.

This course accepts that neither lawyers nor IT/business are solely capable of delivering compliance, and thus a multidisciplinary approach is required. It teaches the GDPR against its cultural US and European roots, and relates data processing to the enacted laws in Europe and many other jurisdictions down to province/State level. It presents a meta-architecture for both retrospective and prospective discovery of the effects of legislation and tort on current or planned IT systems.

At the core is a methodology to create Enterprise Privacy Architecture, leading to automated Privacy Impact Assessments, financial quantification of multijurisdictional compliance risk, and local compliance implementation. Some aspects of culture and business ethics are necessarily covered: these are necessary to understand the boundaries between legal systems and the implications for the overlap of legal jurisdictions and regulatory scope. This is backed up by “war stories” of the emerging international habit of jailing executives for contempt or criminal offences in relation to their IT processes and conflicts.