CPD Data Protection Policy

Policy scope

This document applies to adult educators undertaking Dr Layla Institute for Educational Excellence professional development independently or through a school or employer.

Initial delivery is through self-paced online CPD e-modules and, where offered, live online sessions. Face-to-face activities may be introduced only after the applicable permissions, licences, venue safeguards and any necessary accreditation or course-delivery approvals have been confirmed. No course is described as CPD-accredited unless formal approval has been granted for that course and delivery format.

Status and scope

This operational policy should be read alongside the website Privacy Notice and checked against the eventual company jurisdiction, actual WordPress/LMS/payment tools, hosting, cross-border transfers and relevant privacy laws before adoption.

Personal data

Dr Layla Institute for Educational Excellence may need learner names, contact details, school affiliations, purchase records, course enrolment, learning progress, assessment responses, certificates and support correspondence. Only necessary information should be collected.

Purposes and lawful basis

Personal information is used to provide contracted training, administer payments, maintain learning and certification records, respond to requests, improve services and meet legal obligations. The applicable lawful bases must be confirmed and explained in the public Privacy Notice.

School-sponsored learning

Before sharing attendance, progress or results with a purchasing school, Dr Layla Institute for Educational Excellence must clearly explain the reporting arrangement and establish the appropriate lawful basis and contractual responsibilities.

Security and suppliers

Restrict access by role, use strong authentication, maintain appropriate backups and update software. Confirm written agreements and appropriate safeguards with hosting, LMS, email and payment providers.

Retention and rights

Define retention periods for enrolment, payments, assessment, certificates and complaints. Provide an accessible contact route for requests to access, correct or delete personal data where applicable.

Cross-border and incidents

Assess international transfers and the relevant UK/UAE/other-country obligations once the operating entity and service providers are known. Record and assess suspected personal-data incidents promptly.