A2 Estudio Legal
EN ▼
🇪🇸 Español 🇬🇧 English
Privacy Training for Product

GDPR for Product Managers: Practical Workshop

Intensive training designed for product teams. Learn to integrate privacy by design into your roadmap, manage consent, assess impact, and make product decisions that comply with GDPR — without slowing innovation.

Request workshop →

Why Product Managers Need GDPR Training

Every product decision has privacy implications: what data to collect, how to store it, who to share it with, how long to retain it. Product managers who understand GDPR design better products, avoid costly redesigns, and turn privacy into a competitive advantage. Our workshop transforms compliance from an obstacle into a product tool.

  • Product-first approach — Not a legal course, it's training for product decisions
  • Practical privacy by design — Frameworks applicable to your roadmap
  • Real product cases — Privacy decisions in SaaS, apps, and platforms
  • Applicable tools — DPIA templates, decision matrices, checklists
  • 1-day format — Minimal sprint disruption
  • Post-workshop follow-up — Review of a real case from your product

What the GDPR Workshop for Product Managers Covers

The programme is designed for product managers, product owners, and digital product leaders. We cover product decisions that impact data protection, with practical frameworks and exercises based on real products:

  • Privacy by design — How to integrate privacy from discovery through to launch
  • Legal bases and consent — When you need consent and when you don't, and how to design it
  • Data minimisation — Collecting only what's needed without compromising product metrics
  • International transfers — Implications of using providers outside the EEA
  • User rights — Designing access, rectification, portability, and deletion flows
  • Incident management — What to do when something goes wrong with personal data

Each module includes product decision exercises based on real scenarios.

Workshop Agenda: GDPR for Product Managers

Morning (9:00 - 13:30)

9:00 - 10:30 | GDPR Essentials for Product

  • GDPR principles as design principles
  • Personal data: what counts and what doesn’t
  • Legal bases: when you need consent
  • Exercise: Evaluate legal bases for existing features

10:45 - 12:15 | Privacy by Design in the Roadmap

  • Privacy framework for each product phase
  • Integrating privacy into user stories
  • From feature to data processing: mapping the flow
  • Exercise: Redesign a feature applying privacy by design

12:30 - 13:30 | Consent and Privacy UX

  • Designing effective consent flows
  • Cookie banners that comply and convert
  • Dark patterns: what to avoid and why
  • Exercise: Design a privacy-first onboarding flow

Afternoon (15:00 - 18:00)

15:00 - 16:00 | DPIAs for Product Managers

  • When an impact assessment is mandatory
  • Agile DPIA: simplified format for product teams
  • How to integrate the DPIA into the discovery process
  • Exercise: Conduct a DPIA on a proposed feature

16:15 - 17:00 | International Data and Providers

  • Implications of choosing AWS, Google Cloud, or Azure
  • Transfers outside the EEA: SCCs, adequacy, exceptions
  • Provider evaluation from a privacy perspective
  • Exercise: Evaluate a cloud provider for a new feature

17:00 - 18:00 | Integrating Workshop + Q&A

  • Design a complete feature end-to-end
  • Presentation and feedback
  • Next steps and resources

Complementary Services

Featured Services

Module 1: GDPR Essentials for Product

Key GDPR principles translated into product decisions. Personal data, legal bases, processing legitimacy, and proportionality applied to feature design.

→

Module 2: Privacy by Design in the Roadmap

Practical framework for integrating privacy at every stage of the product cycle: discovery, definition, development, launch, and iteration.

→

Module 3: Consent and Privacy UX

Designing consent flows that comply with GDPR without destroying conversion. Cookie banners, opt-in/opt-out, and privacy-respecting user experiences.

→

Module 4: DPIAs for Product Managers

When an impact assessment is mandatory, how to conduct one in an agile way, and how to integrate it into the discovery process without slowing the team.

→

Module 5: International Data and Providers

Implications of choosing cloud providers outside the EEA, international transfers, and how to evaluate providers from a privacy perspective.

→

Module 6: Product Practical Workshop

Integrating exercise: design a complete product feature applying all workshop principles, from user story to launch.

→

Frequently Asked Questions

Who is this workshop designed for?

For product managers, product owners, UX designers, and product leaders in tech companies. No prior legal knowledge required. It is adapted to profiles who make product decisions and need to understand how GDPR affects those decisions.

How is this different from a generic GDPR course?

Our workshop doesn't teach GDPR as regulation — it translates it into product decisions. Instead of explaining regulatory articles, we work with user stories, roadmaps, and product flows. Every legal concept is presented as a design decision.

Can it be customised to my company's sector?

Yes. Before the workshop we hold a session with the Head of Product to understand your product, market, and specific privacy challenges. Exercises and cases are adapted to your context: B2B SaaS, B2C apps, marketplaces, data platforms, etc.

How long does the workshop last?

The standard format is 1 full day (8 hours). We also offer half-day formats (4 hours) focused on specific modules — for example, privacy by design and DPIAs only, for teams with existing basic knowledge.

Does it include practical tools?

Yes. Each attendee receives: DPIA template adapted for product managers, privacy by design checklist by product phase, legal basis decision matrix, consent flow design guide, and privacy documentation templates for PRDs.

What is the workshop price?

The in-company workshop for up to 15 people starts at €3,000. Includes sector customisation, complete materials, and a follow-up session where we review a real case from your product.

Does it also cover the AI Act?

We can include a complementary module on AI Act implications for product decisions: when an AI feature requires risk assessment, transparency obligations, and how to document AI features in the product. This additional module extends the workshop by half a day.

Is it applicable to teams working with health or financial data?

Yes. For regulated sectors (healthtech, fintech, edtech), we adapt content to cover additional sectoral regulations that supplement GDPR: health data under Article 9, PSD2 requirements for fintech, or child protection in edtech.

Do you offer continuing education?

Yes. After the workshop, we include a follow-up session at 4 weeks where we review a real case from your product. We also offer quarterly regulatory update programmes for product teams.

Can you deliver it in Spanish?

Yes. We deliver workshops in both English and Spanish. For international teams, we adapt language and jurisdictional examples according to the group's composition.

Contact

If you want to talk about intellectual property protection, AI and data regulation, startup formation or international expansion, write us a few lines and schedule a conversation with the team.

A2 Estudio Legal
María de Molina, 41
28006 Madrid · Spain

Tel: +34 913 451 406
Email: info@a2estudiolegal.com

Tell us briefly about your project, development stage and target countries. We will respond with the next steps to start working together.

Let's talk →
Contact us→