# Data protection training: what should staff learn?

A useful course helps people handle real situations and shows where they still need help.

The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026.

Part of the guide [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md).

**The short answer.** Data protection training should teach staff how to handle information in their own work. It should cover requests, sharing, security, breaches and records. Check understanding, keep a record and refresh the training at suitable intervals ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

## Is GDPR training a legal requirement?

UK GDPR requires suitable security measures for the risk, including how an organisation works. Article 32 also requires steps to ensure people with access follow the controller’s instructions, unless law requires otherwise ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

Where there is a data protection officer, or DPO, their monitoring role includes staff awareness and training. This appears in Article 39. It does not mean every lesson must be delivered by that person ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/39), checked 9 October 2026).

The ICO sets out practical training expectations in its toolkit. It expects training that reflects staff needs, plus checks that people complete and understand it. The toolkit is marked as under review following the Data (Use and Access) Act ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

## What should staff learn for their role?

Start with the information people handle and the choices they make. The ICO expects coverage of requests, sharing, security, breaches and records. Specialist roles need further training beyond the common basics ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

The table is an example plan to adapt. Use fictional or anonymised details in practice exercises. The ICO recommends anonymised breach examples, especially when training is tailored to a business area ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/) and [ICO, Training](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/), checked 9 October 2026).

**Example practice tasks for different roles**

| Role | Practice situation | What the exercise should check |
| --- | --- | --- |
| Customer service | Someone asks for the information held about them. | Can the staff member recognise the request and find the right internal contact? |
| Finance or administration | A file containing personal information goes to the wrong recipient. | Can they recognise a possible breach and report it through the agreed route? |
| HR | A colleague asks for access to an employee record. | Can they find the sharing rules and check what they are instructed to do? |
| Breach decision maker | A reported incident may affect people. | Can they apply the organisation’s response process using their specialist training? |

Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 9 October 2026); ICO, Training and awareness, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026); ICO, Training, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/ (checked 9 October 2026)

## When should induction and refresher training happen?

The ICO expects induction before staff access personal information and within one month of their start date. This is the regulator’s training expectation, rather than a general statutory one month course deadline ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32) and [ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

For refreshers, the ICO says to use appropriate intervals. It does not set a universal annual rule in this toolkit. Review the programme so it stays current, and use staff feedback to improve it ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

**Build training into the work**

1. Start: Complete induction before access to personal information.
2. Practise: Use situations from the person’s role.
3. Check: Assess understanding and listen to feedback.
4. Refresh: Keep the material current and repeat at appropriate intervals.

An example cycle based on the ICO’s expectations. Set intervals that suit the work and its risks.

Source: ICO, Training and awareness, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026)

**The ICO’s own wording on induction and refresher training.**

![ICO training guidance: induction before access to personal information, then refreshers at appropriate intervals.](https://theassurancedesk.com/images/editorial/ico-training-expectations.png)

The first line expects induction before staff access personal information and within one month of starting. The next line expects refresher training at appropriate intervals. These are the ICO toolkit’s expectations. The toolkit is under review following the Data (Use and Access) Act.

Text from the ICO, reproduced under the Open Government Licence. Captured 9 October 2026.
Licence: https://ico.org.uk/global/copyright-and-re-use-of-materials/
Source: ICO, Training and awareness, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026); ICO, Copyright and re-use of materials, https://ico.org.uk/global/copyright-and-re-use-of-materials/ (checked 9 October 2026)

## How do you check that the training worked?

Ask people to work through a situation, rather than only confirming they watched the course. The ICO recommends an assessment at the end and a way for staff to give feedback ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

For example, ask where they would report a misdirected email and what information they would give the person handling it. Keep the reporting route easy to find. The ICO also recommends a culture where staff can report near misses ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/) and [ICO, Training](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/), checked 9 October 2026).

> "Conduct an assessment at the end of the training to test staff understanding and make sure that it is effective"
> ICO, Staff training guidance
> ICO, Training and awareness, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026)

## What training records should you keep?

Keep the materials and details of who received them. Monitor completion and follow up with anyone who has not finished. A simple record can show what happened and what needs attention ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

This is an illustrative record, not a required form. The useful point is to connect the lesson, the learner’s understanding and any next action ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

**Example training record to adapt**

| Record field | Illustrative entry |
| --- | --- |
| Role and learner | New starter in customer service. |
| Material and completion date | Induction version used, with the actual completion date. |
| Understanding checked | Recognised a request for personal information and found the reporting route. |
| Support still needed | Practise secure sharing with the team manager. |
| Next review | The planned refresher date and the person responsible for following up. |

Source: ICO, Training and awareness, https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026)

## Is there a free ICO training resource?

Yes. Data Protection Essentials is a free ICO training and self assessment programme. It is designed for organisations with fewer than 250 employees, no DPO and no high risk data processing. Check all those conditions before choosing it ([ICO, Data Protection Essentials](https://ico.org.uk/for-organisations/advice-for-small-organisations/training-and-resources/data-protection-essentials), checked 9 October 2026).

The programme has annual renewal for its training and self assessment certificates. That is a programme rule, not a universal training deadline for every UK organisation. The ICO says the programme is not an accredited certification scheme ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/) and [ICO, Data Protection Essentials](https://ico.org.uk/for-organisations/advice-for-small-organisations/training-and-resources/data-protection-essentials), checked 9 October 2026).

When choosing any training, compare its content with the work people actually do. Check how it tests understanding and how you will keep completion records. Specialist roles may need additional help ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

## What to do

1. List the training needs of each role ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).
2. Put induction before access to personal information ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).
3. Use practical exercises and check understanding ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/) and [ICO, Training](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/), checked 9 October 2026).
4. Keep materials and completion records, then follow up on gaps ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).
5. Make guidance and the internal contact easy to find ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

## Common questions

### Must everyone repeat the same course every year?

The ICO toolkit expects refreshers at appropriate intervals and training suited to staff needs. It does not prescribe the same annual course for every organisation ([ICO, Training and awareness](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/), checked 9 October 2026).

### Does an ICO Essentials certificate mean accredited certification?

No. The ICO explicitly says Data Protection Essentials is not an accredited certification scheme ([ICO, Data Protection Essentials](https://ico.org.uk/for-organisations/advice-for-small-organisations/training-and-resources/data-protection-essentials), checked 9 October 2026).

### Can we use examples from our own incidents?

The ICO recommends anonymised breach examples to make training relevant. Keep the exercise useful without exposing someone’s information ([ICO, Training](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/), checked 9 October 2026).

## Where next

- [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md)
- [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md)
- [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md)

## Sources

- ICO, Training and awareness: https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/ (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/39 (checked 9 October 2026)
- ICO, Training: https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/personal-data-breach-management/training/ (checked 9 October 2026)
- ICO, Copyright and re-use of materials: https://ico.org.uk/global/copyright-and-re-use-of-materials/ (checked 9 October 2026)
- ICO, Data Protection Essentials: https://ico.org.uk/for-organisations/advice-for-small-organisations/training-and-resources/data-protection-essentials (checked 9 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.