*This post may contain Affiliate Links which means we may earn from qualifying purchases you make via our website. Check out our Affiliate policy and what this means here.
One of the challenges of implementing GDPR for businesses is the technical GDPR staff training.
But, you need to be prepared.
Your organisation’s compliance depends on having informed and well-trained staff, and the larger your business, the more difficult and vital this becomes.
We’ve dealt with many GDPR staff training sessions approaching from the technical standpoint and often consult with organisations to ensure they are passing on their knowledge correctly.
As such, we’ve decided to put together this brief list of essentials for a technical GDPR staff training session to get you started.
Before Your GDPR Staff Training
Data protection should already be part of the company culture meaning that your staff aligns with a privacy-first approach.
In practice: Incorporating privacy and data protection to your core values ensures you adhere to the GDPR “data protection by design and default” guideline – this means that your default settings should be privacy friendly, and all processes and operations, from sending GDPR Compliant emails to app development, include data protection measures at their core.
What To Include in GDPR Training Sessions
A well-rounded GDPR training should start with the basics and work towards the technical aspects of GDPR compliance like new policies and frameworks that you’ve adopted as an organisation. Key points to include are:
1. Consent
GDPR is all about consent, and ‘legitimate interest’ cases when contacting others and this needs to be thoroughly understood and explained.
If not, any one of your employees could contact someone without permission and it could lead to a complaint to the ICO and fines. This is one of the most misunderstood points of GDPR currently, particularly for marketers and businesses that thrive from reaching out to potential customers. You and your staff need to understand where the line is, and how not to cross it.
2. The Risk of Non-Compliance
Your staff should learn about all the principles of data protection and be aware of the financial risk of not being compliant, how it hurts reputation, and what disciplinary measures the business (and they) can face. When they can connect the risks and arguments on why GDPR is necessary, they will understand just how important it is.
3. Understanding Your Business’ Role
Ensure your employees understand where your business stands. Participants should learn the difference between data processors and collectors, which category the business falls into, and the category of any other third party they conduct data-related business with.
4. Knowing Regulations & Regulatory Bodies
For example, your staff should know the role of the ICO and relevancy of the Data Protection Act 2018 and Privacy and Electronic Communications Regulations.
5. Being Specific To Your Business
There’s no point in explaining the rationale behind GDPR and the fines without some context. Your employees need specific guidelines about data-related operations and processes they do daily.
For example, your GDPR email training might be highly technical, so make sure that everyone understands how new regulations affect their daily email communication and work in general, with a focus on how it makes it better.
6. New Company Policies
Your business’ policies should be at the core of the staff training. Ultimately, you’re the ones to police your own staff and if it is enforced companywide, it’s more likely to be adopted (and stuck to.)
Every department should be aware of new company policies that ensure GDPR compliance and how they affect them – from developers working on a new app to the sales team dealing with customer data, to marketing staff sending out emails.
7. How To Spot Data Breaches
The staff should also learn how to recognise red flags – because a data breach has to be reported to ICO within 72 hours, knowing to spot one is crucial. They should also learn the correct procedure in case of a data breach, such as who to report it to in the company and whether additional measures are needed.
8. SAR Requests
Under GDPR, a company has to respect a subject access request – request for data. SAR requests need to be handled within 24 hours of being received, so having a policy in place and making sure your staff knows the correct way to respond to it is key, because the public and customers don’t always send requests to the right location straight away.
The Technical Side of GDPR Staff Training
Implementation of new technologies and software solutions that ensure data safety is the next logical step for GDPR compliance. But this can be difficult to implement itself.
This means that you and your staff will have to learn about new encryption technologies and software you decide to integrate into your business operations.
Article 32 of GDPR states that this can be achieved through:
- Pseudonymisation and encryption of personal data
- Ensuring your processing systems and services are confidential and resilient
- Being able to restore access to personal data quickly if there was a physical or technical issue that prevented access
- Regular testing and evaluation of technical and organisational measures that were implemented to ensure data security
For example, your email communications should be secured through solutions like Azure Information Protection – which provides email and file encryption that protects data in such a way that it’s secure no matter where it goes. Deploying systems like Azure Information Protection across your organisation can be tricky if you don’t know what you’re doing, but training your staff to use AIP should be easy – from GDPR email training to sharing documents securely – to ensure the highest security and your ‘best effort’ towards GDPR.
Continuous GDPR Training Ensures Compliance
The last point to note is that reminders and refreshers are the way to really reiterate the importance of GDPR to your business, to staff.
Hold refresher sessions after the initial GDPR staff training on a regular basis. Data protection should be ingrained into every single business process. Make sure new members understand this too – make GDPR training an integral part of the onboarding process and make sure it becomes part of your company culture.
If you need help with implementing Azures Information Protection in your small business, check out our fully comprehensive and supported course here:
