What is GDPR Training (& Is It a Legal Requirement?)

Since the introduction of GDPR, there has been a lack of clarity amongst the companies about the bare minimum that they must do to achieve compliance. This uncertainty fuels the possibility of doing things in the wrong manner. This is where training fits in as the perfect solution to simplify the complex regulation and help the staff to perform things in the right manner.

Is training a requirement under GDPR?

The General Data Protection Regulation treats training as an integral component of the overall measures required for compliance with the law. It mentions training three times out of the 99 articles in the GDPR.The prominent ones being article 39 which lays the responsibility upon the DPO to raise awareness and train the staff involved in the processing operations and related audits. Similarly, article 47 of the GDPR elaborates the tasks of the data protection officer in reference to binding corporate rules, which allows for data transfers between a group of companies and states, also has mention of training requirement. To summarise, it clearly lays down that a DPO has to monitor training apart from monitoring compliance with BCR.

Interestingly, the appointment of DPO is not a mandatory requirement and the GDPR only specifies training of individual staff members of a company in relation to the tasks of a DPO.This does not mean, however, that a company can avoid training their staff if they decide not to appoint a DPO. Entities are bound by the legal requirement of conducting training and  mentioning DPO, GDPR only gives a broad explanation of how it expects things to be done but  provides the liberty for flexible interpretation.

In the UK, the ICO discusses training in a number of places, and essentially makes staff training mandatory. To elaborate, the ICO requires that all the organisations must ensure and be able to demonstrate that they are taking the necessary measures to comply with the law. One of the ways to do so is by implementing staff training. It further emphasises that in the situation wherein the employees deal with the Data subject requests and regularly interact with the individuals they would require specific training to identify a request.

How to fulfil the requirements ?

GDPR training is not optional. There is no simple certification that will state that the company is GDPR complaint. This is because GDPR compliance is a set of actions and conducting training is one of them. The real GDPR compliance means ensuring Privacy by design which can conveniently be achieved by starting  a comprehensive training and awareness program which will include:-

Online training that explains the integral concepts of the data protection law and emphasizes the centrality of data protection to the organization’s mission.

Focused role based training for those whose role in data processing has unique requirement like marketing, software development etc

Specialised training for executive level employees who can be held accountable for compliance like DPO, CTO, CISO etc.

What should be included in the training ?

To provide a holistic understanding of the concepts of data protection the following topics should be covered:-

Key Definitions

Data Protection

Rules and Principles

Rights of Individuals

Security Requirements

Sharing, Using, Transferring and Deleting Data

A clear understanding of the above concepts will foster a better interaction of employees with the personal information on a day to day basis.

How often should the training be conducted ?

Staff awareness takes time to get right. There’s little to be gained from rolling out a programme as soon as possible, because you’ll end up with flawed exercises that don’t achieve maximum results.You’d be better off focusing on one thing at a time, deploying it when it’s ready, and refining your programme based on its success. It should be conducted on an annual basis and the exact dates should be noted.

Evaluation is the key

In order to ensure success of a training program a test should be conducted to evaluate the understanding of the employees. The standardised assessment should have a minimum passing score requirement. This will further help those who struggle to qualify and understand the concepts. Once an evaluation is complete the participants should be provided with a certificate of qualification. This certificate is not only evidence of personal qualification but also demonstrates the company's excellence in demonstrating compliance.

Disclaimer

This article does not constitute legal advice in any form and only seeks to break down some of the main points set out by publicly available sources such as the ICO.

‍