EDITORIAL REVIEW · PROTOTYPE
From the presentation
to the experience
Source: SEEDTAG Data Protection Awareness Training, October 2026. A custom interactive adaptation, not an Articulate project or SCORM package.
Source coverage
| Source slides | Topic | Adaptation |
|---|---|---|
| 1–3 | Course introduction | Overview and course purpose. No fines used as the main motivational device. |
| 5–6 | Global context and personal data | Chapters 1 and 7. Flip cards plus five classification examples. |
| 7–9 | Roles, principles and legal bases | Chapters 2 and 3. Build an export; explore roles and six bases; decide how to route a contract. |
| 10 | Rights requests | Chapter 6. Inbox scenario with different consequences for each choice. |
| 11–12 | Local differences and transfers | Chapter 7. Practical escalation rules; country-specific lists are not converted into automatic legal advice. |
| 13 | Breaches | Chapter 6. Sequence exercise. Clarifies the distinction between immediate employee reporting and authority notification when required. |
| 14 | Compliance toolkit | Chapter 7. Expandable overview of RoPA, DPIA, LIA, TIA, contracts and policies. |
| 16–19 | AdTech flows, signals and roles | Chapter 4 and role scenario. Selectable bid-request fields and consent decision. |
| 21–23 | CTV, AI, minors and daily rules | Chapter 5. Six decisions with immediate explanations. |
| 25–27 | Ten-question assessment | Chapter 8. Retains all ten topic areas; refines ambiguous wording and gives feedback after submission. |
| 28 | Support contacts | Overview and chapter 7. Uses Privacy Office and DPO contacts from the closing slide. |
| 4, 15, 20, 24 | Section divider slides | Replaced by chapter navigation rather than separate learning screens. |
Editorial points for the content owner
- 72 hours: authority notification is conditional on the breach risk assessment. Employees must report suspicions immediately. The question and explanation now distinguish these obligations.
- Consent risk: the slide’s “NO RISK” label for a framework signal plus contract is not used. Those elements do not establish zero risk or prove that all processing is compliant.
- Contacts: slide 10 lists legal@seedtag.com; the closing slide lists the Privacy Office at gdpr@seedtag.com. The course uses the closing slide’s Privacy Office address and seedtagdpo@ecija.com. Confirm the intended routing before launch.
- Countries: the detailed national-law, digital-age and adequacy lists need a current review by the privacy team. The course teaches when to escalate; it does not present the full lists as a current decision matrix.
- Anonymous data: practice examples explicitly state whether identifiability has been removed. An aggregate or a hashed value is not automatically anonymous.
- Role: default role descriptions are attributed to the supplied Seedtag training. The course does not assign a role to a live transaction.
- Internal resources: no Compliance Drive URL or Security contact address was provided, so the course does not invent links.
Learning and tracking
Practice is ungraded and provides immediate feedback. Completing the seven learning chapters and passing the ten-question check (8/10) completes the course. Navigation remains open for review. Answers can be changed before submitting the final test. Attempt history and the personal action are stored on the current browser only.
The prototype does not provide employee identity, central reporting, assignment deadlines, SCORM/xAPI, or formal certification. These are integration tasks for the final LMS.
Primary references checked
EDPB · Data breaches
EDPB · Anonymisation and pseudonymisation