GDPR Fundamentals Training
A one-day fundamentals course for Malaysian teams working with European customers, group companies or service providers. The session starts by checking when the GDPR applies: EU establishment, offering goods or services to people in the EU, or monitoring their behaviour there. Handling data about an EU citizen or having a European customer does not, by itself, settle whether every GDPR obligation applies to a Malaysian business.
Who should attend: HR, marketing, customer service, IT, procurement, compliance and privacy staff who handle personal data. No legal training or prior GDPR knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Scope, Personal Data and Roles
Apply simple scenarios to GDPR territorial scope. Identify personal data, special category data, controllers and processors. Distinguish direct GDPR applicability from contractual duties when supplying services to an EU controller.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Principles and Lawful Bases
Introduce the seven data protection principles and six Article 6 lawful bases. Explain why consent is not always the correct basis, when additional Article 9 conditions matter, and how a privacy notice supports transparency.
11:30 AM to 12:30 PM
Individual Rights in Everyday Work
Recognise requests for access, rectification, erasure, restriction, portability and objection. Introduce the usual one-month response period, identity checks and escalation, and explain that rights have conditions and exceptions.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Security, Accountability and Breach Response
Connect data minimisation, retention, access controls and privacy by design to daily work. Introduce processing records, DPIA and DPO triggers. Assess breach escalation: controllers notify the supervisory authority within 72 hours of awareness unless the breach is unlikely to risk individuals' rights and freedoms; processors notify the controller without undue delay. High-risk breaches may also require communication to affected individuals.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Processors, International Transfers and the PDPA
Recognise processor contract requirements and restricted transfers outside the EEA. Introduce adequacy decisions and safeguards such as Standard Contractual Clauses, with assessment and supplementary measures where required. Explain why GDPR and Malaysia's PDPA require separate applicability checks even when controls overlap.
4:00 PM to 5:00 PM
Practical Exercise: A Customer Data Journey
Map collection, cloud storage, marketing use and deletion for a fictional Malaysian business. Identify roles, a plausible lawful basis, a rights request, a breach escalation and a transfer question. Draft a short action list and complete a knowledge check.
Key Outcomes
- Recognise when GDPR may apply to a Malaysian organisation
- Distinguish controllers, processors and key personal data categories
- Explain the principles and lawful bases without defaulting to consent
- Recognise rights requests and escalate breaches promptly
- Identify processor, transfer and PDPA coordination questions for follow-up
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to Malaysian organisations with EU establishments, relevant goods or services offered to people in the EU, behavioural monitoring there, or contractual processor obligations. Applicability needs an activity-specific check.
Practical Takeaways
A personal data mapping worksheet and a rights-request and breach escalation checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
This is introductory awareness training. The Certificate of Completion is not GDPR certification, a DPO qualification or proof that an organisation complies with the GDPR. Organisation-specific legal and implementation questions require further assessment.
Frequently Asked Questions
Related Fundamentals Training
Data Privacy & Secure Information Handling Cloud Privacy Protection (ISO/IEC 27018) Fundamentals Privacy Information Management (ISO/IEC 27701) Fundamentals Personal Data Protection (Malaysia PDPA) Fundamentals View all fundamentals programmes
Reference material: European Commission: application of the GDPR. EUR-Lex: GDPR official text.