Since the GDPR came into effect, it brought a sea-change in how organizations must treat data and protect it. The GDPR necessitates the drafting of policies and to have security measures in place and there is no explicit obligation under the Regulation to train employees in data protection. However, the GDPR imposes indirect obligations on organizations to train their employees accordingly. There is no point in fulfilling all the steps of the GDPR compliance only for one of your employees to mishandle your organizations’ personal data by mistake or fall victim to a cyber-attack resulting in a data breach. This is why it is of paramount importance that your staff understands the requirements and changes the Regulation brings as it will certainly affect their work and your organization as a whole.

In order to avoid any data breach which results in hefty GDPR fine and reputational loss, organizations require to create a privacy-first culture. An organization cannot be fully compliant with the GDPR without raising awareness and providing training to the staff involved in data processing operations. For example, if your product development team does not understand its responsibilities, non-compliant products will be released which could lead to customer complaints. If your marketing team sends out marketing emails to individuals when they have no right to do so, a complaint could be made to the Supervisory Authority. If your IT department does not understand what good security looks like there could be a data breach which has to be notified to the Supervisory Authority and if your Company does not respond to an information request from an individual (a client, a service provider or an employee), a claim could be made against your organisation by that individual.

In all these scenarios, there is a risk of bad publicity and hefty fines resulting directly from a failure to train your employees. However, there are very positive reasons and benefits to train all your staff in GDPR compliance.

• Your clients will trust you more. If you put the protection of personal information at the heart of your organisation and can show that you do this then potential clients will be more likely to use your services.

• Your employees will be more encouraged to get involved. If your staff are aware about data protection and you achieve a cultural shift in how the protection of personal information is viewed, your staff will become involved in making your organisation more compliant, rather than reluctantly attending another boring training session.

• The risk of GDPR fines and bad reputation is reduced. If your staff are trained, mistakes do not happen, or they are spotted early when something can be done about them and before the mistake costs your organisation fine.

How does a GDPR compliant organization look like?

An organization that is GDPR compliant handle clients or customers personal data with dignity and has processes in place for data retention, minimisation and deletion. It organizes regular training and refreshers sessions about data protection. Every new employee receives the appropriate GDPR training and the compliance culture is part of the organisational culture.