Course Outline:

Module 1: Introduction to Data Privacy in Hospitality

• Why data privacy matters: reputational, financial, and legal risks

• Common types of guest data collected at every touchpoint

• Key terminology: PII, Processing, Consent, Data Controller vs. Processor

• Case Study: Analysis of a real-world hospitality data breach and its impact.

Module 2: Overview of Key Regulations: GDPR & CCPA

• Territorial and material scope of the GDPR

• Key rights of data subjects: Access, Rectification, Erasure (Right to be Forgotten), Portability

• Key principles of the CCPA and who it applies to

• Quiz: Testing understanding of core regulatory concepts.

Module 3: Lawful Basis for Processing & Consent Management

• The six lawful bases for processing data and which applies to hotel operations

• When and how to obtain valid, unambiguous consent

• Managing marketing preferences and opt-outs

• Workshop: Drafting a compliant consent request for a hotel newsletter.

Module 4: Practical Data Security Day-to-Day

• Secure data handling: paper records, screens, emails, and verbal communication

• Payment Card Industry Data Security Standard (PCI DSS) basics

• Best practices for passwords, system access, and mobile devices

• Role-Play: Handling a guest's request to see their data file.

Module 5: Incident Response and Building a Privacy Culture

• How to identify and report a suspected data privacy incident

• The role of the Data Protection Officer (DPO)

• Creating a culture of security: ongoing training and vigilance

• Final Exam: A scenario-based test on identifying and responding to data privacy situations.