Course : AI and the GDPR: Protecting Personal Data in the Age of AI SystemsFrom Impact Assessment to AI Act Compliance: Key Considerations for Addressing AI Challenges
Practical course - 3d
- 21h00 - Ref. AAO
|
Download in PDF format
Share this course by email
 | Analyze the interactions between the requirements of the GDPR and those of the AI Act in the context of an artificial intelligence project |
| Assess the risks associated with the processing of personal data by AI systems and conduct an appropriate data protection impact assessment (DPIA) |
| Identify the legal frameworks and compliance measures applicable to training data, validation data, and results generated by AI systems |
| Implement mechanisms for managing the rights of data subjects in the context of automated or AI-assisted decision-making |
| Draft and negotiate key contractual provisions related to the use, development, or acquisition of AI solutions |
Intended audience
DPOs and outsourced DPOs, compliance officers, legal counsel, CISOs, GDPR consultants, data governance managers, AI project managers, innovation managers, internal auditors, risk managers, and anyone involved in ensuring compliance with artificial intelligence projects.
Prerequisites
General knowledge of the GDPR and the fundamental principles of personal data protection.
Practical details
Interactive presentations illustrated with real-world examples and case studies. Case studies serving as a common thread, covering various applications of AI (generative AI, recruitment, scoring, customer relations). Individual exercises, pair work, collaborative workshops, and role-playing exercises.
Course schedule
1 Understanding the European Regulatory Framework for AI
- Identify the fundamental principles of the GDPR that apply to artificial intelligence systems
- Explain the objectives, structure, and implementation timeline of the European AI Act
- Distinguish the roles and responsibilities of the various stakeholders: supplier, deployer, importer, distributor, and professional user
- Mapping the respective obligations under the GDPR and the AI Act by use case
- Classify AI systems according to the risk levels defined by the AI Act
Hands-on work
Group case study on various uses of AI (recruiting, HR chatbot, customer scoring, generative AI).
2 Managing Data and Ensuring Legal Compliance in AI Projects
- Identify the categories of data used throughout the lifecycle of an AI system
- Determine the appropriate legal frameworks for training, testing, validation, and operational data
- Verify compliance with the principles of data minimization, purpose limitation, and data retention
- Verify the quality, source, and traceability of the data used to train the models
- Implement a document management system that complies with regulatory requirements
Hands-on work
Case Study of a Company Using a Generative AI Model.
3 Conducting an AIPD for an Artificial Intelligence System
- Identify processing operations that require a data protection impact assessment (DPIA)
- Assess the specific risks associated with AI systems: bias, discrimination, lack of explainability, and model drift
- Apply a data protection methodology tailored to projects that incorporate AI
- Define technical, organizational, and legal measures to reduce risks
- Document the results of the analysis and prepare the supporting documentation required by the regulatory authorities
Hands-on work
Group workshop with a common theme. Participants conduct a simplified AIPD on an AI-assisted recruitment system. Presentation of results and cross-group review.
4 Ensuring individuals' rights and transparency in automated processing
- Identify the disclosure requirements applicable to AI systems
- Explain the requirements related to automated individual decision-making under the GDPR
- Implementing the rights of access, rectification, objection, and erasure in an AI-driven environment
- Organize the processing of requests for explanations of automated decisions
- Develop internal procedures for handling complaints and requests from data subjects
Hands-on work
Role-playing in groups of three. One participant plays the role of a data subject, another plays the role of the DPO, and the third plays the role of a business manager. Using realistic scenarios, participants handle a request to object, a request for an explanation of an automated decision, or a request for access. Group debriefing on the responses provided and key regulatory considerations.
5 Establish a contractual framework for AI solutions and carry out the duties of the outsourced DPO
- Identify the key contractual provisions in contracts related to AI systems
- Analyze the respective responsibilities of suppliers, subcontractors, and customers
- Draft provisions regarding data protection, security, and model governance
- Evaluate the contractual guarantees offered by generative AI vendors and cloud providers
- Implement a continuous compliance process as part of an outsourced DPO engagement
Hands-on work
Critical analysis of excerpts from contracts, terms of service, and data processing agreements provided by AI solution providers.
6 Implementing a Sustainable AI Compliance Strategy
- Developing a Compliance Roadmap That Incorporates the GDPR and the AI Act
- Define performance and risk monitoring metrics related to AI
- Organize the processes for monitoring, auditing, and continuous improvement
- Raise awareness among stakeholders about compliance and ethical issues related to AI
- Prepare the steps to be taken in the event of an audit or incident involving an AI system
Hands-on work
Individual case study. Each participant develops a compliance action plan for a fictional AI project. Presentation of the action plans and feedback from the instructor.
PARTICIPANTS
DPOs and outsourced DPOs, compliance officers, legal counsel, CISOs, GDPR consultants, data governance managers, AI project managers, innovation managers, internal auditors, risk managers, and anyone involved in ensuring compliance with artificial intelligence projects.
PREREQUISITES
General knowledge of the GDPR and the fundamental principles of personal data protection.
TRAINER QUALIFICATIONS
The experts leading the training are specialists in the covered subjects. They have been approved by our instructional teams for both their professional knowledge and their teaching ability, for each course they teach. They have at least five to ten years of experience in their field and hold (or have held) decision-making positions in companies.
ASSESSMENT TERMS
The trainer evaluates each participant’s academic progress throughout the training using multiple choice, scenarios, hands-on work and more.
Participants also complete a placement test before and after the course to measure the skills they’ve developed.
TERMS AND DEADLINES
Registration must be completed 24 hours before the start of the training.
ACCESSIBILITY FOR PEOPLE WITH DISABILITIES
Do you need special accessibility accommodations? Contact Mrs. Fosse, Disability Manager, at psh-accueil@orsys.fr to review your request and its feasibility.
DPOs and outsourced DPOs, compliance officers, legal counsel, CISOs, GDPR consultants, data governance managers, AI project managers, innovation managers, internal auditors, risk managers, and anyone involved in ensuring compliance with artificial intelligence projects.
PREREQUISITES
General knowledge of the GDPR and the fundamental principles of personal data protection.
TRAINER QUALIFICATIONS
The experts leading the training are specialists in the covered subjects. They have been approved by our instructional teams for both their professional knowledge and their teaching ability, for each course they teach. They have at least five to ten years of experience in their field and hold (or have held) decision-making positions in companies.
ASSESSMENT TERMS
The trainer evaluates each participant’s academic progress throughout the training using multiple choice, scenarios, hands-on work and more.
Participants also complete a placement test before and after the course to measure the skills they’ve developed.
TEACHING AIDS AND TECHNICAL RESOURCES
• The main teaching aids and instructional methods used in the training are audiovisual aids, documentation and course material, hands-on application exercises and corrected exercises for practical training courses, case studies and coverage of real cases for training seminars.
• At the end of each course or seminar, ORSYS provides participants with a course evaluation questionnaire that is analysed by our instructional teams.
• A check-in sheet for each half-day of attendance is provided at the end of the training, along with a course completion certificate if the trainee attended the entire session.
• The main teaching aids and instructional methods used in the training are audiovisual aids, documentation and course material, hands-on application exercises and corrected exercises for practical training courses, case studies and coverage of real cases for training seminars.
• At the end of each course or seminar, ORSYS provides participants with a course evaluation questionnaire that is analysed by our instructional teams.
• A check-in sheet for each half-day of attendance is provided at the end of the training, along with a course completion certificate if the trainee attended the entire session.
TERMS AND DEADLINES
Registration must be completed 24 hours before the start of the training.
ACCESSIBILITY FOR PEOPLE WITH DISABILITIES
Do you need special accessibility accommodations? Contact Mrs. Fosse, Disability Manager, at psh-accueil@orsys.fr to review your request and its feasibility.
This programme is an original creation, developed by the teaching teams at ORSYS Formation. Any reproduction, representation, adaptation or use, in whole or in part, without the prior written authorisation of ORSYS, is strictly prohibited. ORSYS reserves the right to take any action necessary to protect its intellectual property rights.
Dates and locations
Dernières places
Date garantie en présentiel ou à distance
Session garantie
This programme is an original creation, developed by the teaching teams at ORSYS Formation. Any reproduction, representation, adaptation or use, in whole or in part, without the prior written authorisation of ORSYS, is strictly prohibited. ORSYS reserves the right to take any action necessary to protect its intellectual property rights.