Privacy in Practice: GDPR, US State Laws and the Privacy Program
Signature Course No. 421 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's Privacy in Practice: GDPR, US State Laws and the Privacy Program course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Privacy law is not a poster in a break room. It is a set of enforceable duties — to have a lawful reason before you process, to say what you do before you do it, to answer the person who asks, to assess before you build, to report on a clock when things go wrong — and an organization either runs a program that meets those duties deliberately or discovers them one complaint, one request, and one incident at a time. This course teaches the law as a working system and the program as the machine that serves it, on one running company: Aldermoss Living, a fictional mid-size retailer of home goods selling online across the European Union and the United States.
It starts with roles. Every duty in the European regime is addressed to a role, and the roles are decided by facts, not by labels, contracts, or job titles. From there: the seven principles as working tests, a lawful basis chosen in advance and documented, transparency that tells people before processing starts, and a rights desk that runs to its clock — each duty ending in a record that proves it was met on purpose.
It works in two movements. First, Module 1 — The European Regime and the Duties It Creates — work through Concepts 1–9, finishing with The Launch File; then, Module 2 — The United States Patchwork and the Running Program — work through Concepts 10–18, finishing with The Expansion File.
Both capstones produce real artifacts — a program file for a European launch: roles, bases, records, assessments, and a breach-ready desk; and a program file for a United States expansion plus a transfer: applicability, rights and opt-out operations, vendor terms, and the mechanism that carries the data. Both are program work, not legal advice: each produces a defensible draft position for qualified review, and each says so on its face.
The honesty standard is part of the course. This course is information about privacy law and program practice, not legal advice. It teaches the regimes at structure level — the durable architecture of duties, roles, and clocks — because privacy law churns: legislatures amend thresholds, regulators publish new guidance, and transfer mechanisms are litigated and replaced. Every point where you must verify the current position against the current source before you act is flagged, and the judgment the course teaches at full strength is the judgment those amendments land on.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
Privacy in Practice: GDPR, US State Laws and the Privacy Program is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with roles. Name one processing activity in your organization and say who decided it should exist, what data it uses, and how long the data lives; name one vendor your organization calls a processor and say whether it ever uses your customers' data for any purpose of its own; and say where your organization has people, offices, or deliberate selling activity in Europe — the facts, not the intentions, that place its processing inside the European regime. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Launch File for Module 1 and The Expansion File for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Role before rule, every duty ends in a record, and clocks are part of the law. Almost every privacy error begins as a role error, so each concept starts from the same question — in what role, over what processing, does this duty arise? A basis is a documented choice, an assessment a written decision, a request a logged case, a breach a timed file: the program is the set of records that let you prove, months later and to a skeptical reader, that the duty was met on purpose. And a right answered late, a breach reported late, an assessment finished after launch is a duty missed, not a duty met slowly.
Module 1 works the European regime end to end. Roles and scope; the principles; lawful bases; transparency; rights operations; records; impact assessments; breach duties on the seventy-two-hour clock; and the privacy lead function — when a designated officer is required, what independence means, and how the function governs when no single officer is mandated.
Module 2 crosses the Atlantic and then goes operational. The United States state-law architecture and its rights and opt-outs; vendor and processor management; cross-border transfers; retention and design controls; heightened duties for sensitive and children's data; security as a legal duty; regulator relations; and finally the program itself as a running system with metrics, reporting, and repair.
And it holds its boundary throughout. Every-employee privacy basics are taught in their own neighboring course, No. 94, and data-estate governance in No. 317. This course owns privacy law and the privacy program: what the law requires, in what role, on what clock — and the program an organization builds to meet those requirements on purpose rather than by accident.
What you will learn
- Assign controller, processor, and joint-controller roles and state the duties each role carries
- Apply the processing principles and choose and document a lawful basis that survives challenge
- Run transparency duties and data-subject rights operations to their clocks and standards
- Build and keep the accountability record: processing records, impact assessments, and program evidence
- Meet breach notification duties on the European clock and judge risk to people, not just to the firm
- Operate under the United States state comprehensive laws: applicability, rights, opt-outs, and assessments
- Govern processors and vendors, and move personal data across borders on a lawful mechanism
- Run the privacy program as a system: heightened duties, security, regulators, metrics, and repair
Everything in the course
- All 18 concepts of Privacy in Practice: GDPR, US State Laws and the Privacy Program, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Launch File and The Expansion File
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the people the duties land on
Privacy program owners and data protection officers — who carry the duties personally in the organization's chart and need the full regime in one working frame; and operations, product, and marketing leads whose launches, campaigns, and vendor choices create the processing the program must govern.
Legal, compliance, and risk staff — who advise the business on privacy and need the operational half of the subject: how a duty becomes a queue, a clock, and a record.
Owners and executives of growing companies — whose firm has crossed a threshold — a first European customer, a first state law that applies, a first enterprise buyer's security-and-privacy review — and who must build the program now rather than explain its absence later. This course assumes you already understand, at the level No. 94 teaches, what personal data is and why careless handling harms people. It assumes no law degree and no prior privacy role.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Roles First
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
Privacy in Practice: GDPR, US State Laws and the Privacy Program is Signature Course No. 421. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.