Data protection training for employees: a duty under Art. 32 GDPR

Anyone who processes personal data needs more than a privacy policy on the website: your own employees must also be trained regularly on data protection and committed to confidentiality.

In brief: Employees who process personal data must be trained regularly on data protection and committed in writing to data confidentiality. This affects practically every company with staff, since even the processing of employee data falls under it. Without this organizational measure, fines are possible in the event of data breaches, and human error is one of the most common causes.

Who is affected?

Every company that has employees working with personal data is affected. This includes not only customer or patient data but also the data of your own colleagues, such as personnel files, payroll or applicant data. Practically every company with staff therefore falls under this duty, regardless of size or industry. If you are unsure whether and to what extent employees in your business are affected, you can have this checked as part of a Company Audit.

Why is the training mandatory?

Raising awareness among and training employees is part of the organizational measures that Art. 32 GDPR requires for the security of processing and, where a data protection officer has been appointed, is among that officer's tasks under Art. 39 GDPR. The reason lies in practice: human error is among the most common causes of data breaches, for example an email sent to the wrong recipient, a lost device or a click on a phishing link. Technical safeguards such as encryption or access rights come to nothing if employees do not know how to handle personal data and how to recognize and report an incident. That is why the GDPR expressly requires organizational measures such as this training alongside technical ones.

What do you need to do in practice?

Implementation follows a fixed sequence of identification, training content, delivery and documentation.

1. Identify employees who work with personal data (including employee data).
2. Define the training content (basics, confidentiality, handling requests, reporting incidents).
3. Deliver the training on hiring and recurrently thereafter.
4. Commit employees to data confidentiality.
5. Document attendance with date and signature.

In practice, short, recurring awareness sessions have a more lasting effect than a one-off basic training. A particular focus on phishing and the handling of email attachments noticeably reduces the risk of data breaches, since human error is especially often the entry point here. If you tailor the training content to the actual data categories in your own business, such as customer data in sales or employee data in HR, you achieve higher acceptance than with a purely general presentation.

By when / how often?

The training takes place with every new hire and is repeated annually thereafter. If you hire new employees, you should build the basic training firmly into the onboarding process so that nobody works with access to personal data without training. The annual repetition keeps topics such as handling data subject requests or reporting incidents fresh, even when processes or legal requirements in the company change. It makes sense to put fixed dates for the annual refresher in the company calendar so that the repetition does not get lost in day-to-day business.

What are the consequences of non-compliance?

Inadequate organizational measures, such as missing training and confidentiality commitments, can be punished with fines of up to EUR 10 million or 2% of worldwide annual turnover. In practice this matters above all when harm occurs: if a data breach caused by human error happens, supervisory authorities regularly check whether employees were adequately trained and committed to confidentiality. If proof of training and commitment is missing, the breach weighs more heavily in the authority's assessment, even if the data breach itself stems from a single slip.

Frequently asked questions

Do I also have to train temporary staff, working students and interns?

Yes. What matters is not the type of employment relationship but whether the person works with personal data. Temporary staff, working students and interns must also be trained accordingly and committed to data confidentiality if they have access to such data.

Is a one-off training on hiring enough?

No. Training is intended on hiring and an annual repetition thereafter. A one-off basic training without regular refreshers does not meet the duty of ongoing awareness, since risks such as phishing and the handling of requests are constantly evolving.

Does the commitment to data confidentiality have to be in writing?

The commitment should be documented so that it can be proven if in doubt. This includes recording attendance at the training and the confidentiality commitment with the date and signature of the person concerned.

Who is responsible for delivering the training?

Raising awareness among and training employees is among the organizational measures for which the company is responsible under Art. 32 GDPR. If a data protection officer has been appointed, monitoring this training is among that officer's tasks under Art. 39 GDPR.

Does the duty also apply to small companies without a data protection officer?

Yes. The duty to train and raise awareness among employees follows from Art. 32 GDPR and applies regardless of whether a data protection officer has been appointed. Smaller companies must also train and commit employees who process personal data accordingly.

Source: Art. 32 GDPR · Art. 39 GDPR. This article is general information and does not replace legal advice in individual cases. As of: July 2026.