GDPR training: a free data protection training pack for your staff and managers
A staff session, a manager briefing, a quiz with a training record, and a rollout guide, built on UK GDPR and the ICO's expectations for staff training, and free by email. Or have us tailor it and run it for you, on a branded company site, £24.99 per employee.
UK GDPR makes you responsible for keeping personal data secure, and the ICO expects every member of staff to complete data protection training before they work with personal information, with refreshers at appropriate intervals.
Take the free pack and run it yourself, or have us tailor it and run it for you: a branded company site with your training content, every member of staff invited and reminded by email, and a certificate for every completion, £24.99 per employee.
| Question | Short answer |
|---|---|
| Is training required? | UK GDPR requires appropriate security for personal data, and the ICO expects a data protection training programme for all staff. |
| Who needs it? | All staff, at every grade, with volunteers, temporary and contract staff included. |
| What must it cover? | The ICO’s key areas: handling requests, data sharing, information security, personal data breaches and records management. |
| How often? | At induction, before anyone works with personal information, then refresher training at appropriate intervals. |
| What to keep | A record of when each person last trained, and a training needs analysis you review periodically. |
What UK GDPR and the ICO expect of your training
UK GDPR makes you responsible for how your staff handle personal data:
- Keep it secure. You must process personal data with appropriate security, using appropriate technical or organisational measures (article 5(1)(f)).
- Show that you comply. You’re responsible for compliance with the data protection principles, and must be able to demonstrate it (article 5(2)).
- Staff act on your instructions. You must take steps to make sure anyone working under your authority who has access to personal data processes it only on your instructions, unless the law requires otherwise (article 32(4)).
- Your data protection officer, if you have one, monitors compliance, including the training of staff involved in processing (article 39).
The ICO’s data protection audit framework sets out what it expects of the training:
- A programme for every staff group with access to personal information, based on a training needs analysis you review periodically.
- Induction before access. All staff, at every grade, complete induction training before they work with personal information, with volunteers, temporary and contract staff included.
- Refreshers at appropriate intervals, with complete, up-to-date records of when each person last trained.
- The key areas: handling requests, data sharing, information security, personal data breaches and records management, plus national and sector-specific requirements.
- A knowledge check with a minimum pass mark, and support for anyone who consistently misses it.
- Senior sign-off. Senior management signs off the content, and your data protection officer, information governance manager or equivalent oversees and approves the training.
The ICO warns that letting staff work with personal information before their induction training greatly increases the risk of a personal data breach. It adds that training which doesn’t fit each role may leave staff without the competence to protect personal information, and that both may breach articles 5(1)(f) and 32. It’s reviewing this guidance after changes made by the Data (Use and Access) Act.
What you’ll get
Run the free pack yourself, or have us tailor it to your organisation and run it for you.
| Free pack | Tailored and run for you, £24.99 per employee | |
|---|---|---|
| The content | Complete the general training template | Tailored to your organisation for you |
| How staff complete it | Staff and manager slides with speaker notes, a quiz and a rollout guide, to deliver however suits you | A branded company site with your training content loaded for all staff to complete |
| Getting it to staff | You organise it | Every member of staff emailed for you |
| Reminders and chases | No automation included | Reminders and chases automated for you |
| Certificate of completion | Not included | A dated certificate for every person who completes it |
| Format | PowerPoint slides and Word documents | Audio and video, or a format to upload into your own learning or training hub |
| Managers and employees | A staff session and a manager briefing | Distinct manager and employee training |
| Cost | Free | £24.99 per employee |
The free pack, file by file
- Staff session. PowerPoint, with speaker notes: handling personal information safely at work, and spotting and reporting a breach.
- Manager briefing. PowerPoint, with speaker notes, for managers and the people who handle requests, data sharing and breaches.
- Quiz and training record. Word: questions with an answer sheet for the presenter, and a training record for everyone to sign.
- Rollout guide. Word: how to tailor, deliver, record, refresh and check the training.
You fill in the gaps for your organisation and its policies, present the sessions and keep your own records. It doesn’t include a certificate of completion.
Request received
Thanks. The team will send the four files to your inbox within one working day.
Could not send that request
Something went wrong on our side. Please try again, or use our contact form and our team will send you the pack.
The tailored training, part by part
- Tailored to your organisation. We tailor the training content to your organisation, its processes and likely scenarios, with distinct manager and employee training.
- A branded company site, or your own learning hub. Your training content in audio and video, with an understanding check, ready for all your staff to complete; or in a format to upload into your own learning or training hub.
- Distribution taken care of. Invite all your staff, and each person gets an email to complete the training.
- Reminders and chases, automated. We remind anyone who hasn’t finished until they complete it.
- A certificate for every completion. A dated certificate for each person who completes it, to save for your records.
Our team will be in touch with follow-up questions to tailor the content to your organisation.
Request received
Thanks. Our team will be in touch within one working day with follow-up questions to tailor the training to your organisation.
Could not send that request
Something went wrong on our side. Please try again, or use our contact form and our team will be in touch.
What the training covers
Staff session:
- What personal data is, and where you handle it at work
- The data protection principles in your everyday tasks
- Keeping personal information secure: devices, passwords, email and paper
- Spotting a personal data breach, and how to report it
- Requests from individuals, such as subject access requests, and who to pass them to
- Sharing personal data: what to check first
- Keeping, storing and getting rid of records
- Your organisation's policies, and who to ask
Manager briefing:
- Your role in data protection in your team
- The personal information your team handles, and its risks
- Confirming new starters have done their training before they get access
- Handling requests from individuals that reach your team
- Deciding whether to share personal data
- Responding to a personal data breach in your team
- Spotting new training needs, temporary and contract staff included
After the training
Keep your training needs analysis current. Reassess the training needs of every staff group regularly, with volunteers, temporary and contract staff included, and review the analysis so it stays relevant.
Use your own reports to update the training. Where your data protection, information security or quality reports show a concern, cover it in the next round of training.
Involve senior staff. Ask senior staff to encourage completion in their messages to all staff, and to attend sessions with their teams when you train face to face.
Our free fire safety and manual handling training packs work the same way.
Common questions
Is GDPR training a legal requirement?
UK GDPR requires appropriate security for personal data, through technical and organisational measures, and makes you responsible for showing you comply. The ICO expects a data protection training programme for all staff, and warns that training which doesn't fit each role may leave staff without the competence to protect personal information, which may breach articles 5(1)(f) and 32.
Who needs GDPR training?
All staff, at every grade, senior managers included, plus volunteers, temporary and contract staff, says the ICO. It expects you to assess the training needs of people with specific data handling or security responsibilities as well.
How often should staff refresh their training?
The ICO expects induction training before anyone works with personal information, then refresher training at appropriate intervals, with records of when each person last trained. It suggests setting a timeframe for staff to complete each refresher.
What should the training cover?
The ICO lists key areas: handling requests, data sharing, information security, personal data breaches and records management, plus any national and sector-specific requirements. It expects a knowledge check with a minimum pass mark too.
Who should run the training in our organisation?
The ICO expects your data protection officer, information governance manager or equivalent to oversee and approve induction and refresher training, senior management to sign off the content, and appropriately trained staff to deliver it.
What's in the free data protection training pack?
Four editable files: a staff session (PowerPoint, with speaker notes), a manager briefing (PowerPoint, with speaker notes), a quiz with answers and a training record to sign (Word), and a rollout guide (Word).
What's the difference between the free pack and the tailored training?
The free pack is the template: four editable files you fill in, present and record yourself, with no certificate of completion. We build the tailored training for your organisation and run it for you: a branded company site with your training content, every member of staff invited by email and reminded until they complete it, and a dated certificate for every completion.
References
- UK GDPR, article 5: principles relating to processing of personal data
- UK GDPR, article 32: security of processing
- UK GDPR, article 39: tasks of the data protection officer
- ICO data protection audit framework: all-staff training programme
- ICO data protection audit framework: induction training
- ICO data protection audit framework: refresher training
General information, not legal advice. It reflects our understanding of the law and official guidance as of October 2026, so check the sources above for the current position.