Data Protection and Digital Compliance

Organisation over 20 weeks

Four 5-week blocks (4 weeks of classes, 1 week of assessment). The two course units are taken unchanged from the original degree: same content, same assessments.

• Blocks 1 and 2 (weeks 1 to 10): DPD 413 — Personal Data Protection
• Blocks 3 and 4 (weeks 11 to 20): CNF 531 — Digital Compliance: Data and Information Security

DPD 413 - Personal Data Protection

To provide command of the law applicable to personal data protection at national, regional and continental level, beyond the principles introduced in NUA 415 in the same semester, starting from the text in force: loi n°2008-12 du 25 janvier 2008 (Personal Data Protection Act).

Learning outcomes

• Analyse a data processing operation in the light of loi n°2008-12 and identify the parties involved, the conditions for lawfulness and the rights of data subjects.
• Explain the missions and powers of the CDP and the procedure applicable before it.
• Link national law with ECOWAS Acte additionnel A/SA.1/01/10 (Supplementary Act on Personal Data Protection) and the Malabo Convention.
• Analyse a proposed transfer of data outside the national territory and assess its legal conditions.

Content

• Basic concepts: personal data, processing, controller, processor, data subject, special categories of data; definitions established from the text of loi n°2008-12.
• Principles applicable to processing, conditions for lawfulness, rights of data subjects, prior formalities and penalties, studied from the text of the Act.
• CDP: composition, missions, powers and published decisions, studied from loi n°2008-12 and from the Commission's publications.
• Transfers of data outside the national territory and data hosting: applicable rules and sovereignty issues.
• ECOWAS Acte additionnel A/SA.1/01/10 du 16 février 2010 and the Malabo Convention (adopted on 27 June 2014, entered into force on 8 June 2023, ratified by Senegal): scope and relationship with national law.
• Announced data protection reform: no replacement law adopted at the time of writing; method for monitoring the official stages.

Assessment: Continuous assessment (40%): annotated analysis of a fictitious processing operation and of a proposed transfer. Written final examination (60%): practical case and reflective question on how the texts fit together. Same arrangements for both cohorts.

CNF 531 - Digital Compliance: Data and Information Security

To build and manage an organisation's digital compliance: personal data protection and information security, up to the legal handling of an incident.

Learning outcomes

• Design a data protection compliance programme tailored to an organisation.
• Assess the risks of a processing operation and propose proportionate measures.
• Develop an information security policy drawing on technical frameworks, without confusing them with legal obligations.
• Manage the legal handling of a security incident or a data breach.
• Recommend compliance options to senior management, prioritised according to risk.

Content

• Compliance programme: mapping of processing operations, record of processing, data protection policy, procedures for exercising rights, supervision of processors, staff awareness-raising.
• Risk assessment of a processing operation (impact assessment method) and data breach management, taught as good compliance practice; whether corresponding legal obligations exist must be checked against the text of loi n°2008-12 du 25 janvier 2008 (Personal Data Protection Act), not presumed.
• Role of data protection officer or focal point: missions, position, independence; whether any legal status exists, and its content, must be checked against loi n°2008-12 and the CDP's published practice.
• Information security: requirements of ISO/IEC 27001:2022 and controls of ISO/IEC 27002:2022, used as technical frameworks.
• Projet de loi n°25/2026 relatif à la protection des infrastructures d'information critiques et à la sécurité numérique (Bill on the Protection of Critical Information Infrastructure and Digital Security), adopted by the Assemblée nationale (National Assembly), promulgation not verified: reading and monitoring; Stratégie nationale de cybersécurité (National Cybersecurity Strategy) (SNC2022), whose time horizon has been reached.
• Legal handling of an incident: classification, any notification obligations, relations with CERT-SN and the authorities, communication, preservation of evidence; simulated crisis exercise.

Assessment: Project (60%): diagnosis and prioritised compliance programme, presented as a memo to senior management. Practical simulation (40%): legal handling of a simulated incident, assessed against a rubric. Same arrangements for both cohorts.

Career opportunities

Data protection focal point, digital compliance officer.

At your own pace: the self-paced pathway

In a class, this certificate takes 20 weeks, on the cohort's dates. On the self-paced pathway, you start whenever you like, online, and progress at your own pace. The price is the same.

Admission

Bachelor's degree in law or a related field, or experience in compliance or information systems assessed on application; a non-credit-bearing legal refresher course is recommended for non-lawyers. Admission based on application; detailed requirements set by the school.

The credits you earn are recognised without further assessment if you later join the programme they come from, Professional Master's degree in Digital Law, within a period set by the certificate regulations.