GDPR data protection training: duty, content, frequency
Short answer
The GDPR has no single article titled training duty, but it requires appropriate technical and organisational measures (Articles 24 and 32) and that staff process data only on instructions (Article 32(4)). The data protection officer's tasks expressly include awareness-raising and training of staff (Article 39(1)(b)). Documented data protection training is therefore the usual way to meet the accountability duty under Article 5(2).
Key points
- Legal bases: Articles 5(2), 24, 32(4) and 39(1)(b) GDPR.
- Anyone with access to personal data needs to know the rules and instructions.
- No statutory cycle; common practice is training on joining plus regular refreshers.
- Align content with the job: HR, sales, IT and management need different things.
- Documentation proves the measure to supervisory authorities.
Where the training duty comes from
Anyone looking for an article called "training duty" in the GDPR will not find one. The duty results from several provisions together. Article 24 requires the controller to implement appropriate technical and organisational measures to ensure and be able to demonstrate that processing complies with the regulation. Article 32(4) requires controllers and processors to take steps so that any person acting under their authority with access to personal data processes it only on instructions. People who must follow instructions have to know them.
Training is mentioned expressly among the tasks of the data protection officer: under Article 39(1)(b) the DPO monitors compliance, including the awareness-raising and training of staff involved in processing operations. That does not make the DPO everyone's teacher, but it does make the DPO the function that checks whether training happens.
Above all sits the accountability principle in Article 5(2): the controller must be able to demonstrate compliance with the principles. Documented training is one of the few pieces of evidence showing that organisational measures are actually lived.
What content belongs in it
Good data protection training does not explain the whole regulation but what matters day to day. It starts with key terms and principles and moves quickly to concrete situations: to whom may I send a customer list? What do I do if I sent an email to the wrong recipient? Which data may go into an AI tool?
- Key terms: personal data, special categories (Article 9), processing, controller, processor.
- The principles of Article 5: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
- An overview of the legal bases under Article 6, with examples from your own organisation.
- Data subject rights (Articles 15–22) and how requests are passed on internally.
- Data breaches: recognise and report immediately — the controller generally has 72 hours to notify the supervisory authority under Article 33.
- Working securely: passwords, phishing, mobile devices, printouts, working away from the office.
- Internal rules: policies, approved tools, contacts.
Target groups and depth
Not everyone needs the same. Basic training for everyone with data access is complemented by deeper modules for high-risk areas. That reflects the GDPR's risk-based approach: someone working with health data, applications or large customer databases needs more than someone who occasionally scans a business card.
| Area | Deeper content |
|---|---|
| HR | Employee data, recruitment, health data, deletion periods |
| Sales and marketing | Consent, objection to direct marketing, handling prospect data |
| IT and development | Data protection by design (Article 25), logs, access rights, processors |
| Managers | Responsibility, data breaches, impact assessments (Article 35), handling complaints |
How often to train
The GDPR sets no cycle. Because Article 32(1) refers to the state of the art and to risk, and measures are to be tested and evaluated regularly (Article 32(1)(d)), a one-off session on hiring is hard to justify for long. A widespread pattern is basic training on joining and a refresher every one to two years, plus event-driven sessions after data breaches, new systems or changed processes.
Short, recurring units often work better than one long mandatory session. Five minutes on phishing ahead of a known attack wave sticks better than an annual slide deck. What matters is that every unit appears in the records.
Documentation and evidence
Evidence consists of the training concept with target groups, the content in its current version, and per person the date, course and result of a knowledge check. If a supervisory authority asks after a data breach whether the person involved was trained, the answer should be one click away.
Training data are personal data too. They may only be used for the defined purpose — proving training — and not simply for performance appraisal. Deletion periods belong in the record of processing activities under Article 30.
This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.
Step by step
Assess needs
With the data protection officer, determine which areas work with which data and where the risk lies.
Plan core and deeper modules
A core module for everyone with data access and deeper modules for high-risk areas.
Deliver and check
Assign the training, close with a short knowledge check and record results.
Refresh
Schedule regular refreshers and event-driven units after incidents or changes.
Terms
- Accountability
- The controller must be able to demonstrate compliance with the principles in Article 5(1) GDPR (Article 5(2)).
- Technical and organisational measures
- Safeguards for personal data, from encryption to training and instructions (Articles 24 and 32 GDPR).
- Personal data breach
- A breach of security under Article 4(12) GDPR, generally to be notified to the supervisory authority within 72 hours (Article 33).
Frequently asked questions
Is data protection training required by law?
Not as a separate article, but it follows from Articles 24 and 32(4) GDPR and, under Article 39(1)(b), is part of what the data protection officer monitors. Without training the accountability duty under Article 5(2) is hard to meet.
Who needs training?
Everyone with access to personal data — in most companies almost all staff, including temporary staff and apprentices. High-risk areas need additional depth.
How often must data protection training be repeated?
The GDPR sets no fixed cycle. Common practice is training on joining, a refresher every one to two years and event-driven sessions after incidents or changes.
Is online training enough?
Yes, if it conveys the necessary content, checks learning and documents participation. A contact person, such as the data protection officer, should be available for questions.
What does a breach cost?
Missing training has no fine of its own. Breaches of the obligations in Articles 25 to 39 can, however, be fined under Article 83(4) up to EUR 10 million or 2 percent of worldwide annual turnover, and in a data breach it matters whether appropriate measures were in place.
How it works in Universe
Related articles
- Data protection for learning platforms: DPA and transfersWhat to check with learning platforms: roles, processing agreements under Article 28 GDPR, third-country transfers, learning data and proctoring.
- Mandatory training at work: overview and organisationWhich mandatory training companies must provide, where the obligations come from, and how to organise assignment, refreshers and records properly.
- Evidencing AI literacy: documentation that holds upHow organisations show they meet Article 4 of the AI Act: the parts of good documentation, forms of evidence, retention and the most common mistakes.
- Training records for audits: what auditors want to seeWhich training records auditors, authorities and customers expect, which standards and laws require them and how to organise records that withstand an audit.