L2-M5 / Operational decisions
AI and data protection
A lender combines account histories and social posts, then automatically rejects applicants. Work through the data, rights and decision process.
Your fictional workplace case
A faster score. A person's future.
Several data sources feed one consequential output.
Classification does not settle the data-protection questions.
What you will create
A draft: GDPR and AI Act screening record
Use the fictional case to record evidence, explain a provisional decision and identify the next owner or action. This is a learning draft for self-review, not approved documentation for a real organisation.
See what goes into your worksheet
- Processing purpose, people and data sources
- Controller/processor roles and lawful basis
- Necessity, minimisation and Article 9 conditions
- Notices, rights, transfers and security
- Article 22, DPIA and FRIA scope
- Controls, residual risk, consultation and approval
From understanding
to better judgement.
Two lessons, a workplace decision and a final check.
Establish the data protection foundations
A fictional lender considers account history and social-media data.
Lesson 1 · 10–15 min02 / LEARNAssess automated decisions and impacts
The lender proposes automatic rejection below a threshold.
Lesson 2 · 10–15 min03 / APPLYApply what you learned
GDPR and AI Act screening record
Workplace task · 8–12 min04 / CHECKCheck your understanding
Apply the ideas to 15 workplace questions.
Final check · 5–10 minSkills you will practise on the case
A method for your
next work decision.
- Screen AI processing against GDPR principles and lawful basis.
- Assess transparency, data roles and transfers.
- Recognise DPIA and automated-decision triggers.
- Coordinate privacy assessment with AI Act controls.
The case is fictional. Timing is a planning estimate; pause whenever you need. This module is a learning activity, not a verified professional certification.