GDPR training for employees: what UK law requires

GDPR training helps staff handle personal data appropriately in their actual role. Start with induction, add specialist instruction where needed, and refresh it when risks, procedures or understanding change. An online course can support this programme, but a dated certificate alone does not show that an organisation complies with data protection law.

The consequences of getting it wrong are real: fines of up to £17.5 million, regulatory investigations, and reputational damage that can take years to repair. The consequences of getting it right are simpler. You protect your customers, your colleagues, and your business.

This guide explains how to plan staff awareness alongside your own procedures. Compare the published outline of our Data Protection and UK GDPR course with the knowledge your team needs. The ICO’s training and awareness guidance is the primary reference; it currently carries a review notice following the Data (Use and Access) Act 2025.

Is GDPR training a legal requirement?

No line of UK law orders you to buy a GDPR course. The UK GDPR and the Data Protection Act 2018 do require you to demonstrate compliance, and the ICO treats staff training as part of that accountability duty. If a breach happens and you cannot show your staff were trained, that counts against you.

Article 32 concerns appropriate technical and organisational security measures. Article 39 includes monitoring awareness and training among a data protection officer’s tasks where one is appointed. For the wider responsibilities, use the ICO’s current guide to accountability and governance.

What counts as appropriate training scales with the data you hold. A care provider handling health records is processing special category data under Article 9, so the ICO expects tighter controls and better prepared staff than a business holding only names and email addresses.

How often should GDPR training be done?

There is no single annual certificate-renewal rule for every employee. Plan induction and appropriate refreshers around the role and risk. A changed booking system, a new responsibility or an incident may require instruction before the next scheduled refresher.

A refresher does not have to repeat the induction course word for word. Keep records of what was covered and check understanding with a question or scenario relevant to the person’s work. Record any further instruction needed. Attendance and a course certificate are useful records, but neither alone establishes that someone can follow the organisation’s procedures.

A practical training checklist for hospitality teams

Use these examples to plan your own instruction alongside a general awareness course. They are prompts for your team, not a universal legal checklist.

Role or task	Example to work through	The local procedure to identify
Reception and reservations	A guest asks what information you hold about them	Where to pass the request and how to record its receipt
Kitchen and service staff	A booking includes a named guest’s allergy information	Who needs access and how the information is shared for service
Supervisors and payroll	A rota file includes sickness information	The authorised storage location and access permissions
Marketing	Someone asks to stop receiving promotions	How the request reaches the person managing the mailing list
Anyone using email	A customer attachment goes to the wrong recipient	Who receives an immediate internal incident report

For each team, name the person who handles questions and suspected incidents. Check that temporary staff and new starters can find that route as well as permanent employees.

The legal framework: UK GDPR and the Data Protection Act 2018

When the UK left the European Union, the EU’s General Data Protection Regulation was incorporated into domestic law as the UK GDPR. It works alongside the Data Protection Act 2018 (DPA 2018) to form the UK’s data protection framework.

Together, these laws govern how organisations collect, store, use, share, and dispose of personal data. They apply to every organisation that processes personal data, regardless of size, sector, or whether the data is held digitally or on paper.

The Information Commissioner’s Office (ICO) is the UK’s independent supervisory authority for data protection. The ICO has the power to investigate complaints, conduct audits, issue enforcement notices, and impose fines of up to £17.5 million or 4% of annual global turnover (whichever is greater) for the most serious infringements.

What counts as personal data?

Personal data is any information that can identify a living individual, either on its own or when combined with other information. Names, email addresses, and phone numbers are the obvious examples, but it also covers IP addresses and online identifiers, employee records (payroll data, performance reviews, sickness absence records), customer records (booking details, order history, dietary requirements), CCTV footage where individuals can be identified, and special category data such as health information, ethnic origin, religious beliefs, trade union membership, and biometric data.

Many employees do not realise that the information they handle daily qualifies as personal data under the law. This is exactly why training matters.

The seven principles of UK GDPR

The UK GDPR is built around seven principles that govern all data processing activities. Every employee who handles personal data should understand these.

1. Lawfulness, fairness, and transparency

Personal data must be processed lawfully, fairly, and in a transparent manner. This means having a valid legal basis for processing (such as consent, contractual necessity, or legitimate interests) and being upfront with individuals about how their data will be used.

2. Purpose limitation

Data must be collected for specified, explicit, and legitimate purposes and not processed further in a way that is incompatible with those purposes. If you collect a customer’s email address to confirm a booking, you cannot then add it to a marketing list without a separate legal basis.

3. Data minimisation

Organisations should only collect and retain the personal data that is necessary for the stated purpose. Staff should be trained to avoid collecting excessive information. Asking for a date of birth when only an age range is needed is a common example.

4. Accuracy

Personal data must be accurate and, where necessary, kept up to date. Employees should know how to correct inaccurate records and should have processes in place to verify data regularly.

5. Storage limitation

Data should not be kept for longer than is necessary. Retention schedules should be in place, and staff should understand when and how to securely delete or anonymise data that is no longer needed.

6. Integrity and confidentiality (security)

Personal data must be processed in a way that ensures appropriate security, including protection against unauthorised access, accidental loss, destruction, or damage. This principle underpins everything from password policies to physical document security.

7. Accountability

The data controller (the organisation) must be able to demonstrate compliance with all of the above principles. This means keeping records, conducting impact assessments where required, and having clear policies and training in place.

Data subject rights

Staff should recognise requests for access, correction, deletion, restriction and objections to use of personal data. The applicable right, response deadline and any exception depend on the circumstances. Route requests promptly to the person responsible, who should check the current ICO guidance, including the rules on automated decision-making, rather than relying on an old course slide or a blanket promise to delete everything.

Every employee who might receive a data subject request needs to know how to recognise one and who to escalate it to. A Subject Access Request does not have to use specific language. An email saying “Can you tell me what information you hold about me?” is a valid SAR, and your team needs to recognise it as such.

Data breaches: what staff need to know

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Common examples include sending an email containing personal data to the wrong recipient, losing an unencrypted laptop or USB drive containing customer records, a cyberattack that exposes customer or employee data (our Cyber Security course covers how to recognise and prevent these threats), leaving paper records containing personal data in an unsecured location, and a staff member accessing records they are not authorised to view.

The ICO’s breach-reporting guidance distinguishes incidents that need notification from those that do not. Reportable breaches must be notified without undue delay and, where feasible, within 72 hours of awareness. A high risk to affected people also triggers a duty to inform them without undue delay.

An employee’s immediate task is to report a suspected incident through the organisation’s own route. They should not wait for a scheduled meeting or try to decide the legal notification threshold alone. The person managing the incident should record when it was discovered, assess the risk and follow the ICO’s reporting guidance.

Practise that reporting route during induction. A short scenario about a misdirected attachment or a lost device can reveal whether staff know whom to contact before a real incident occurs.

Why GDPR training is essential for every employee

It is an employer obligation

The ICO expects organisations to provide appropriate data protection training to all staff who handle personal data. There is no specific legal requirement to hold a certificate, but the ICO considers training to be a fundamental part of accountability. If your organisation suffers a data breach and cannot demonstrate that staff were adequately trained, this will count against you during any investigation.

Training should connect general data protection knowledge to the policies and procedures that staff actually use.

It reduces risk

Misdirected emails, lost records and shared passwords are useful scenarios for staff training. Pair awareness with practical controls such as appropriate access permissions and approved ways to store and share information.

It protects your reputation

Data breaches make headlines. Customers, clients, and partners are increasingly aware of their data rights, and a breach can destroy trust that took years to build. Demonstrating that your organisation takes data protection seriously, through regular and documented training, helps maintain confidence and credibility.

It applies across every sector

GDPR training applies far beyond office-based or tech roles. Hospitality businesses hold customer booking data, dietary requirements, payment details, and staff records. Care providers handle sensitive health information. Retail businesses process customer transactions and loyalty scheme data. Manufacturing firms hold employee records, supplier details, and CCTV footage. If your organisation processes personal data (and virtually all do) your staff need to be trained. Anyone taking card payments has a second standard to meet as well, which our PCI DSS course covers.

What good GDPR training covers

Effective GDPR training should cover the legal framework (UK GDPR and the Data Protection Act 2018, the role of the ICO, and the consequences of non-compliance), key definitions (what counts as personal data, special category data, data controllers, and data processors), a practical understanding of the seven principles and how they apply to daily work, lawful bases for processing, data subject rights and how to handle requests, data security (password management, encryption, secure storage, clean desk policies, and secure disposal, complemented by our Cyber Security course), how to identify, report, and respond to breaches, and practical scenarios relevant to the employee’s role and sector.

The best training uses examples that relate to the learner’s actual work environment. A hospitality worker needs to understand GDPR in the context of customer bookings, staff rotas, and CCTV. A care worker needs to understand it in the context of patient records and care plans.

Our Data Protection and UK GDPR course is designed to give employees a solid, practical understanding of their data protection responsibilities, with real-world scenarios that bring the principles to life.

Common GDPR mistakes in the workplace

Even with good intentions, GDPR mistakes are surprisingly common. Training can help prevent the most frequent ones.

Using BCC instead of CC (or vice versa)

Sending a group email where all recipients can see each other’s email addresses is a data breach if those addresses are personal data. Staff should understand when to use BCC and when to use mailing lists or distribution groups.

Sharing login credentials

Sharing passwords between team members is common in busy workplaces, but it undermines data security and makes it impossible to audit who accessed what. Each employee should have their own credentials. No exceptions.

Keeping data longer than necessary

Without clear retention schedules, data accumulates. Old customer records, former employee files, outdated supplier information. All of it creates risk. Staff should know the organisation’s retention periods and follow them.

Discussing personal data in public spaces

A phone conversation on public transport, a chat in a busy reception area, a screen visible to passers-by. Personal data can be exposed in ways that many employees do not think about. Training should raise awareness of physical and verbal data security as well as digital.

Failing to recognise a Subject Access Request

As mentioned earlier, SARs do not have to be formally worded. Training should ensure that all customer-facing and HR staff can recognise a data subject request when they receive one.

ICO enforcement: real consequences

The ICO has issued significant fines and enforcement actions across a range of sectors. British Airways was fined £20 million in 2020 for a data breach affecting approximately 400,000 customers, caused by poor security measures. Marriott International was fined £18.4 million in 2020 for a breach that exposed 339 million guest records worldwide. Various NHS trusts and local authorities have been reprimanded and fined for breaches including misdirected emails, lost records, and inadequate access controls.

These cases show that the ICO takes enforcement seriously, and that organisations of all sizes and sectors face scrutiny. For smaller organisations, even a modest fine can be devastating, and the reputational damage of an ICO investigation often costs more than the fine itself.

How to get your team trained

Getting your employees trained in UK GDPR and data protection does not have to be complicated or expensive.

Compare the published outline of Chefs Bay Academy’s Data Protection and UK GDPR course with the awareness topics your employees need. Add specialist instruction and your own policies where the role requires them.

The entry plan costs £35 per learner for 12 months and gives access to the GDPR course and the rest of the library. The course is entirely self-paced, so staff can complete it around their shifts and other commitments. Learners pass an end-of-course assessment to confirm their understanding, and a CPD accredited certificate is available immediately upon completion.

The 12-month entry-plan licence also includes workplace courses such as health and safety, fire safety, manual handling and Anti-Bribery and Corruption. Select the subjects relevant to your team; the library does not replace specialist qualifications or training in your own procedures.

Frequently asked questions

Does online GDPR training count as evidence?

An online course completion record can form part of your training evidence. Keep the course topic, learner and completion date alongside your own policy instruction, checks of understanding and any follow-up needed. A certificate is not an ICO approval of the course or proof that the organisation is compliant.

Who in the business needs GDPR training?

Anyone who handles personal data, which in most organisations means everyone. Reception staff take names and contact details. Managers hold performance and sickness records. Marketing runs mailing lists. Kitchen teams record dietary requirements and allergy notes against a customer booking. The depth of training varies by role, but the awareness baseline applies across the payroll.

Does GDPR apply to small businesses?

Yes. UK GDPR applies to any organisation that processes personal data, regardless of size. Small businesses that process personal data (customer details, staff records, supplier contacts) are subject to the same principles and obligations as large corporations. The ICO does take organisational size and resources into account when assessing compliance, but ignorance of the law is not a defence.

What is the difference between a data controller and a data processor?

A data controller determines the purposes and means of processing personal data. They decide why and how data is processed. A data processor processes personal data on behalf of a controller. For example, a hotel is the data controller for guest records, while a third-party booking platform that processes those records on the hotel’s behalf is a data processor. Both controllers and processors have obligations under UK GDPR.

Related guides

If you found this guide helpful, you might also want to read:

• Safeguarding Training: Who Needs It and What It Covers for the intersection between safeguarding and handling sensitive personal data
• Equality, Diversity and Inclusion Training for where EDI and data protection meet around special category data and employee records
• Mental Health Awareness in the Workplace for understanding confidentiality obligations around mental health data

Getting a dated GDPR certificate on file for every employee

Build a training record that shows both learning and how it applies to the person’s work. The Data Protection and UK GDPR course provides a completion certificate after assessment and is included in the 12-month entry plan at £35 per person. The same licence includes Cyber Security and the rest of the workplace compliance library. Compare the course outlines with your team’s needs, then add instruction in your own systems and procedures.

---

130+ courses. One price. Compare individual and team access plans.