GDPR Training for Employees: What UK Staff Need to Know

GDPR training for employees teaches staff how to handle personal data safely in their own job: what counts as personal data, how to keep it secure, how to spot a subject access request or a data breach, and who to tell. UK GDPR does not name training as a duty, but the Information Commission (still known as the ICO) expects every member of staff to be trained before they access personal data and within a month of starting, with refresher training ideally every year and never more than two years apart.

This guide covers what the training should include, which roles need more than the basics, how often to run it, the records to keep and what the Data (Use and Access) Act 2025 changed for frontline staff.

Is GDPR training a legal requirement in the UK?

There is no line in UK GDPR that says “train all staff”. The law does require you to keep personal data secure and to be able to show that you comply (Article 5). Article 32 also requires you to take steps so that anyone working under your authority only uses personal data on your instructions, and where you have a data protection officer, Article 39 makes “awareness-raising and training of staff” part of their job.

The ICO’s accountability framework on training and awareness links missing or out-of-date training to possible breaches of those articles. In practice, it is very hard to show you protect personal data if your staff have never been told how.

The ICO does take action on this. In August 2026 it issued the Metropolitan Police with a reprimand and an enforcement notice after two disclosures. In one, an officer emailed 18 people linked to a sensitive investigation with every address in the “To” field. The ICO found the officer had not completed data protection training for over four years, nor had their line manager for almost four, and it ordered the force to improve training completion, monitoring and governance.

For the other training UK employers must provide, see our guide to mandatory training for employees in the UK.

What the ICO’s breach data says about staff mistakes

The ICO publishes data on the personal data breaches reported to it. In 2025 it recorded 13,462 reports. The most common single type was data emailed to the wrong recipient, at around 2,500 reports, nearly one in five. Unauthorised access and phishing each accounted for about 1,500 to 1,600, and failure to redact for about 900.

Many of these start with an ordinary task: a rushed email, an autocompleted address, a link clicked without checking, a document sent without removing someone else’s details. Training built on examples from people’s real work is how you change those habits.

What should GDPR training for employees include?

The ICO says the seven data protection principles should form the basis of training, along with key terms such as personal data, data subject, personal data breach and information rights. Beyond that, staff need practical rules for their own work. Use this outline as a starting point.

Topic	What staff should be able to do
Personal data	Recognise personal data in their own work, including the more sensitive types such as health information, ethnicity, religion or sexual orientation.
The seven principles	Explain in plain words what lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability mean for their job.
Everyday security	Check recipients before sending, use BCC or a secure method for group emails, lock screens, keep paper secure and use only approved systems.
Phishing and suspicious requests	Spot phishing and check unusual requests for personal data before acting on them.
Subject access requests	Recognise a request for someone’s own information, even when it is made verbally or on social media, and pass it straight to the right person.
Other rights and complaints	Recognise requests to correct, delete or stop using data, and complaints about how data is used, and know where to send them.
Personal data breaches	Report a suspected breach internally at once, because the organisation may have to tell the regulator within 72 hours of becoming aware of it.
Sharing data	Check that a colleague or another organisation needs the information, and share only what they need.
Keeping and deleting data	Follow your retention schedule and delete or archive data properly.
AI tools	Keep personal data out of AI tools your organisation has not approved.
Your policies and contacts	Know where your data protection policies are and who your data protection lead or DPO is.

The ICO also expects an assessment at the end of the training to test understanding, ideally with a minimum pass mark.

Subject access requests deserve particular care. The ICO’s subject access guidance says a request can be made verbally or in writing, including on social media, and does not need any particular wording or to go to a specific contact. You normally have one month to respond, so a request that sits in a receptionist’s notebook for a fortnight has already used half of it.

If your staff use AI assistants, the training should match your rules for them. Our guide to an AI policy for employees covers what to put in those rules.

Who needs more than the basics?

Everyone needs the core training, but the ICO’s small business training checklist makes the point that depth should match the role. Its example is the person who cleans your premises: they are unlikely to need every aspect of data protection, but they do need to spot personal data that is not stored securely and know who to tell.

Roles that usually need more:

• Managers and HR: recruitment, sickness and health records, disciplinary files, references and staff monitoring.
• Customer-facing staff: identity checks, what can be said to a third party, and requests or complaints that arrive by phone, email or chat.
• Marketing: consent and the rules on email and text marketing.
• People who handle requests and records: searching for information, redacting other people’s details and applying retention rules.
• IT and security: access controls, logging and responding to a breach.
• Senior leaders: accountability, risk and signing off the training programme, which the ICO expects senior management to do.

The ICO also expects specialist roles, such as a DPO or a subject access team, to get additional training beyond the basic level. Our free training needs analysis template helps you record which roles need what.

How often should staff do GDPR training?

• Induction: before a new starter accesses any personal data, and within one month of their start date. The ICO says this applies to all staff regardless of how long they will be with you, their contractual status or grade, so temporary staff and contractors are included.
• Refresher: at regular intervals. The ICO’s checklist says ideally once a year, and no more than two years apart.
• Extra training when it is needed: if someone scores low on the assessment, train them again straight away rather than waiting for the next refresher. Update the training when the law, your systems or someone’s role changes, and after an incident.

What GDPR training records should you keep?

When the ICO, an auditor or a client asks about training, they will want evidence for named people. The accountability framework expects you to:

• keep copies of the training material and details of who received it
• record assessment results and anyone who needed extra support
• monitor completion at every level of the organisation and follow up with people who have not finished
• remind staff and managers about upcoming refresher training
• review the training regularly so it stays accurate.

One option the ICO lists is removing access to personal information from staff who do not complete refresher training within a set time. That only works if you know, at any moment, who is overdue.

What changed with the Data (Use and Access) Act 2025?

The Act amends UK GDPR, the Data Protection Act 2018 and the electronic marketing rules rather than replacing them, and the ICO confirmed in June 2026 that all of its data protection changes are now in force. Most of the changes give organisations more flexibility. Two matter for frontline staff:

• Subject access requests: the law now makes clear you only have to make reasonable and proportionate searches. Staff who search for information need to know what that means in your organisation.
• Complaints: you must give people a way to complain about how you use their personal data, acknowledge a complaint within 30 days and respond without undue delay. Anyone who might receive a complaint needs to recognise it and know where it goes.

Other changes, such as recognised legitimate interests, cookies and automated decision-making, belong in specialist training. The ICO says training should be updated as soon as possible when the law changes, so a course written in 2018 is due for review.

Online GDPR training: ready-made or built around your policies?

A ready-made online course is the quickest way to cover the principles and key terms for everyone, but it cannot explain your systems, your breach reporting route or your subject access process. Most organisations get the best result from both: a ready-made course for the basics, and a short module on how things work in your organisation, which is also the part you update when a policy or the law changes.

How Capytech helps

The Capytech course library has around 9,000 ready-made courses, including data protection awareness titles, and runs on any LMS.

For training built around your own rules, we turn your data protection policy, breach procedure and subject access process into a short interactive custom e-learning module with a knowledge check and pass mark. With FastTrack, modules are built from your own documents in days, and updates are turned round in 48 hours, so the training keeps up when the law or your policy changes.

The Capytech LMS keeps the records the ICO expects. Its compliance matrix maps each job role to the training it needs and shows who is valid, due or overdue. Certificates carry renewal dates, the course reopens when a certificate expires, and managers see who needs chasing.

Frequently asked questions