GDPR and ISO/IEC 27701 (PIMS) Audit (Internal Auditor level) Course

GDPR and ISO/IEC 27701 (PIMS) Audit (Internal Auditor level) Course

810,00 € iva esclusa

Description

The GDPR and ISO/IEC 27701 (PIMS) Audit course (Internal Auditor level) trains internal auditors of the privacy management system, combining GDPR compliance with ISO/IEC 27701, the privacy extension of ISO/IEC 27001.

Taught by Dott.ssa Valentina Grazia Sapuppo, the course is delivered live, online or in person, and covers audit planning, conduct and reporting as well as the verification of key compliance requirements, with exercises and practical cases.

16
Hours
8
Modules
2
Lessons
Live
Synchronous
Course information
Instructor
Dott.ssa Valentina Grazia Sapuppo
Level
Internal Auditor
Training area
Audit
Delivery
Synchronous, online or in person
Schedule
Shared upon enrolment
Participants
Classes of 5 to 14 participants
Who it is for
  • Internal auditors
  • DPOs and privacy managers
  • Management system and information security managers
  • Consultants
Objectives and expected outcomes

The course trains internal auditors to carry out GDPR audits using ISO/IEC 27701, the privacy extension of ISO/IEC 27001.

By the end of the course, participants will:

  • understand the structure of a PIMS under ISO/IEC 27701 and its relationship with ISO/IEC 27001 and the GDPR;
  • apply the audit principles and techniques of ISO 19011;
  • plan an audit, defining objectives, criteria, scope and programme;
  • conduct the audit, gathering and evaluating evidence on key compliance requirements;
  • record findings and nonconformities, follow up on corrective actions and write the audit report.

Main topics

ā—PIMS and ISO/IEC 27701 ā—Requirements for controllers and processors
ā—Mapping to the GDPR ā—ISO 19011 audit techniques
ā—Audit planning and conduct ā—Verification of key requirements
ā—Nonconformities and corrective actions ā—Audit report

Course programme

01 The privacy information management system: from ISO/IEC 27001 to ISO/IEC 27701 (PIMS) as an extension; relationship with the GDPR
02 Audit principles and techniques according to ISO 19011
03 ISO/IEC 27701 requirements for controllers and processors (additional controls and mapping to the GDPR)
04 Audit planning: objectives, criteria, scope and programme
05 Conducting the audit: interviews, document review, gathering and evaluating evidence on compliance
06 Auditing key requirements: records, privacy notices and consent, DPIA, data breaches, data subject rights, Art. 28
07 Findings and nonconformities, corrective actions and follow-up; the audit report
08 Exercises and practical GDPR/27701 audit cases; overview of ISO/IEC 17021-1 accreditation against ISO/IEC 27701 (ACCREDIA Technical Circular DC 39/2024)

The programme is complemented by audit exercises and practical cases and by a final learning assessment.

Prerequisites

Knowledge of the GDPR (PRIV-FND course) and basic knowledge of management systems. Audit experience is helpful. No preparatory courses or specific digital skills are required.

Methodology and materials

Exercises
Exercises and practical cases of GDPR and ISO/IEC 27701 audits.
Audit kit
Ready-to-use checklist, audit plan, report and nonconformity template.
Downloadable materials
Slides and summary cards, case studies.
Assessment
Final learning assessment.

Certificate of attendance

A certificate of attendance is issued at the end of the course.