Data protection training for UK GDPR
UK GDPR makes awareness-raising and training of staff a task of the data protection officer (Article 39(1)(b)). ICO guidance adds the detail: induction and refresher training for all staff, induction within one month of starting, and evidence that staff understand it. Our courses support that training; the UK edition is finished.
Key facts
| Law | UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 |
|---|---|
| Regulator | The ICO (the Information Commission's Office). Since 30 September 2026 its legal name is the Information Commission. |
| Who it applies to | Every organisation that processes personal data in the UK |
| Training in the law | Article 39(1)(b): a task of the data protection officer |
| How we describe our part | Supports the staff training that UK GDPR (Article 39(1)(b)) and ICO guidance describe |
| Our library | A new UK library of 50 finished courses, with a UK GDPR course for staff. UK GDPR is taught in the UK track only |
awareness-raising and training of staff involved in processing operations
(UK GDPR Article 39(1)(b))
Every quote on this page was checked word for word against legislation.gov.uk and ico.org.uk (October 2026). The ICO notes that some of its guidance pages are under review.
The law, the ICO's guidance and the courses that cover them
Article 32 (security of processing) asks for appropriate technical and organisational measures but does not name training; the training duty in the text sits in Article 39.
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses, 52 in all, all finished. Course names here are the names in that library; they have no course pages of their own yet.
| What it asks | Our course topics |
|---|---|
|
Article 39(1)(b) Tasks of the data protection officer
|
About it: Hidden Data in Shared Files; Secure Disposal of Documents Also: Bcc, Reply All and Email Mistakes; Sensitive Items in Plain Sight; Your Digital Footprint; Cloud Access Reviews; Contractor Requests and Access Standards course: Data Protection for Staff: UK GDPR; Safe Use of AI Tools |
|
Article 47(2)(n) Binding corporate rules (only for groups that use them)
|
About it: Hidden Data in Shared Files; Secure Disposal of Documents Standards course: Data Protection for Staff: UK GDPR |
|
ICO, control measure 2 Induction and refresher training for all staff
|
About it: Hidden Data in Shared Files Standards course: Security Onboarding: Your First Week; Data Protection for Staff: UK GDPR; Annual Refresher |
|
ICO, control measure 4 Evidence that staff complete and understand the training
|
The programme: every course assigned to all staff, with LMS records. |
|
ICO, breach training Staff recognise and escalate personal data breaches
|
About it: Secure Disposal of Documents Also: Bcc, Reply All and Email Mistakes Standards course: How to Report (and why no one is blamed); Data Protection for Staff: UK GDPR |
|
ICO, control measure 3 Additional training for specialised roles |
Training for roles with key data protection duties is yours. |
When training must happen
The law itself sets no timing. ICO guidance asks for induction training before people access personal information and within one month of their start date, then refresher training at appropriate intervals.
Deliver induction training to all staff prior to accessing personal information and within one month of their start date.
(ICO, training and awareness, control measure 2)
What an auditor asks to see
Evidence for UK GDPR
- A record of who completed which training, senior staff included.
- Assessments that show staff understood (our quiz: pass mark 80).
- Copies of the training material (our course pages carry every transcript).
- Completion monitoring, and follow-up of people who did not complete.
What our LMS gives you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
Our library is the all-staff awareness layer. These parts of UK GDPR are yours:
- Additional training for specialised roles, such as the data protection officer and teams that handle large volumes of personal data.
- Following up people who did not complete their training.
- Raising awareness of your own policies in meetings and staff forums.
- Your own data protection policies and procedures.
Questions people ask
Is staff training a legal requirement under UK GDPR?
The law names it as a task of the data protection officer (Article 39(1)(b)), and the ICO's guidance expects induction and refresher training for all staff.
How soon must new starters be trained?
ICO guidance says before they access personal information and within one month of their start date.
Is it the ICO or the Information Commission now?
Both names are in use. Since 30 September 2026 the regulator's legal name is the Information Commission; it is still referred to as the Information Commission's Office, or ICO.
Sources
- UK GDPR Article 39 (legislation.gov.uk)
- UK GDPR Article 47 (legislation.gov.uk)
- ICO data protection audit framework: training and awareness
- ICO data protection audit framework: personal data breach training
- ICO: the Information Commission (30 September 2026)
Last updated: 2026-10-16. This page explains how our training relates to UK GDPR; it is not legal advice.