How to build an annual training plan for the GDPR and NIS2?

Why this question arises at all

The training plan is usually drawn up in the last quarter, together with the budget. It is often a list of courses from a provider’s offer or a copy of the plan from the previous year. Such a document does not say which risk the training is meant to reduce.

The year 2027 is special in this respect. Entities that met the conditions on the day the amendment entered into force implement the obligations under Chapter 3 of the KSC Act, including personnel education, by 3 April 2027 (Article 33(1) of the Act of 23 January 2026). Their plan for 2027 will usually be the first in which the two regimes meet in one calendar.

The third source of difficulty is organisational. Data protection training is usually run by the data protection officer or the legal department, and cybersecurity training by the security department. Two plans are created for the same people and neither tells the employee that a single report of a suspicious message is enough. On the basis of that single report the organisation assesses whether the event is a personal data breach or an incident within the meaning of the KSC Act.

What has to be established before a decision

Is a training plan mandatory

The GDPR does not use the concept of a training plan and does not make it a separate obligation. The controller and the processor take steps to ensure that any natural person acting under their authority who has access to personal data does not process them except on instructions from the controller, unless required to do so by Union or Member State law (Article 32(4)). Training is one of those steps. The controller implements the measures and reviews and updates them where necessary (Article 24(1)).

The data protection officer informs and advises the controller or the processor and the employees who carry out processing of their obligations (Article 39(1)(a)). The officer also monitors compliance with data protection provisions and policies, including the training of staff involved in processing operations (Article 39(1)(b)). The controller or the processor ensures that the officer is involved properly and in a timely manner in all issues which relate to the protection of personal data (Article 38(1)). Those issues therefore also include the work on the plan. The officer may prepare the content of the data protection layer and run the sessions, but the plan is adopted by the controller or the processor, in practice by a management decision. In my assessment it is advisable to make another person the owner of that layer in the plan, because the officer later monitors staff training (Article 38(6) and Article 39(1)(b)).

The KSC Act does not use the concept of a training plan either. Cybersecurity education for personnel and basic cyber hygiene practices are two of the elements of the system under Article 8(1)(2). According to the Minister of Digital Affairs this education should take place on an ongoing basis (Q&A 3.8). It should also take into account the obligations of personnel in the system and the existing procedures, as well as cyber threats and examples of incidents the entity faces. The head of the entity ensures that personnel are aware of the obligations in the area of cybersecurity and know the entity’s internal rules in that area (Article 8d(4)).

An essential or important entity keeps documentation of the information security management system (Article 10(1) and (3)(1)), which according to the minister should cover all the elements of Article 8 (Q&A 3.5). In my assessment the training plan is the natural place where that documentation describes personnel education. Records from the implementation of the plan are then operational documentation (Article 10(4)). According to the minister, however, documentation alone is not enough (Q&A 3.6).

The head of the entity takes decisions on the information security management system at every stage, from preparation to supervision (Article 8d(1)). The head plans adequate financial resources for the obligations in the area of cybersecurity (Article 8d(2)) and assigns tasks (Article 8d(3)). Under Article 2(8a) the head of the entity is the head of the unit within the meaning of Article 3(1)(6) of the Accounting Act. Where the management board or another management body has several members, the head is each member of that body, excluding proxies appointed by the unit. In a public finance sector unit it is the head of that unit. The head may entrust some or all of the obligations to another person with that person’s consent but remains responsible for them (Article 8c(3)).

More detailed rules apply among others to three groups of entities.

• An important entity that is a public entity or an entity of the higher education and science system indicated in that provision does not apply Article 8(1), and its system meets the requirements of Annex 4 (Article 8(3)). The Annex lists training of persons involved in processing information (point 17 of Part I). The training takes into account in particular the types of cyber threats, basic cyber hygiene practices and incident response. It also covers awareness of the consequences of breaching information security rules. According to the minister an important entity that is a public entity formally does not have to assess risk, but risk analysis is necessary to apply Article 32 GDPR (Q&A 3.15).
• The entities listed in Article 8b(1), among others cloud computing service providers and managed service providers, apply within the system under Article 8(1) the measures set out in Commission Implementing Regulation (EU) 2024/2690. According to the Minister of Digital Affairs they apply them only to the extent of the activity covered by the Regulation (Q&A 3.47). The Regulation requires an awareness raising programme for employees, including members of management bodies, and where appropriate also for direct suppliers and service providers (point 8.1.2). The programme is scheduled over time so that the activities are repeated and cover new employees (point 8.1.2(a)). It is updated and offered at planned intervals (point 8.1.3). Where appropriate, contracts with suppliers and service providers also specify requirements regarding awareness, skills and training of their employees. They do so based on the supply chain security policy and taking into account the results of the risk assessment (point 5.1.4(b)). The entity identifies employees whose roles require security relevant skill sets and expertise and ensures that they receive regular training under a programme for roles and positions (points 8.2.1 and 8.2.2). The effectiveness of that training is assessed (point 8.2.3).
• The banking and financial market infrastructure sectors do not apply the provisions of the KSC Act concerning the information security management system or the notification of significant incidents, with the exceptions in Article 8i(1). The exceptions include Article 8(1)(2)(j) on cyber hygiene, and Articles 8c to 8f apply accordingly (Article 8i(2)). Compulsory training modules for all employees and senior management staff follow from Article 13(6) of the DORA Regulation. Members of the management body keep their knowledge of ICT risk up to date, including by following specific training on a regular basis (Article 5(4)).

Where to start the training plan

The plan answers the question of which human behaviours create risk today and which changes in the organisation will create it next year. The answer comes from four inputs.

1. Results of risk assessment. The system under Article 8(1) of the KSC Act starts with systematic risk assessment (point 1), and the measures must be proportionate to the assessed risk (point 2). The GDPR links measures to the risk to the rights and freedoms of natural persons (Article 24(1) and Article 32(1)). It is worth assigning a topic and a group in the plan to each high-rated risk whose source is human behaviour.
2. Lessons from breaches and incidents. The controller documents any personal data breaches (Article 33(5) GDPR), including those not notified to the authority. A breach caused by human error points to a group and a topic for the plan. Lessons from incident management work in the same way (Article 8(1)(4) of the KSC Act).
3. Changes planned for the year. A new system and a new supplier with access to data change what people do with data and systems. A new processing activity or a reorganisation has the same effect. The training goes into the plan before the date of the change.
4. Measurement results from the previous year. The GDPR lists a process for regularly testing, assessing and evaluating the effectiveness of measures among the measures to be implemented as appropriate (Article 32(1)(d)). The KSC Act lists policies and procedures for assessing the effectiveness of measures as an element of the system (Article 8(1)(2)(h)). The measure of effect may be the share of reported messages in a phishing simulation and the time from an event to its report. The number of entries in the breach register may rise after good training because people report more often, so a better measure is the recurrence of the same error. How to distinguish an effect from mere activity is described in How do you know that training produced a real effect?.

Whom to include in the training plan and how often

Among the provisions of the GDPR and the KSC Act only the training under Article 8e(1) has a fixed interval. The rhythm for the other groups is a practical assessment for a medium-sized or large organisation, adjusted to the results of risk assessment.

Group	Layers	Rhythm in the plan	Training outside the calendar
Head of the entity (in a capital company as a rule each member of the management board) and the person entrusted with the head’s duties in the area of cybersecurity	scope under Article 8e(2) and the common core	once per calendar year (Article 8e(1)), preferably in the first half of the year	new board member
New hires and persons changing position	common core and the layer relevant to the position	before access is granted	every hire, change of role and return after a long absence
High-exposure teams (HR and customer service, sales and finance)	common core and data protection in their process	short formats several times a year	recurring error in the breach register
Process owners, procurement and permission administrators	common core with data protection and cybersecurity in their decisions	workshop once a year	new process, system or supplier
Security and incident handling team (tasks under Articles 8 and 11 of the KSC Act) and persons responsible for maintaining contacts with the entities of the national cybersecurity system (Article 9(1)(1))	common core, cybersecurity layer and reporting procedure	continuous development and an exercise once a year	change of procedure, lessons from an incident
Other personnel	common core	a session once a year and short reminders	new threat in the organisation
Data protection officer	common core, changes in the law and practice of authorities	ongoing maintenance of expert knowledge, for which the controller or processor provides resources (Article 38(2) GDPR)	new guidelines and decisions of authorities

Under the GDPR what matters is access to data and acting under the authority of the controller or processor (Article 32(4)), not the type of contract. The KSC Act refers to the entity’s personnel and does not define that term (Article 8d(4)). In my assessment it also covers persons on civil law contracts who work in the entity’s systems. They will not reach training through the HR system, so the plan sets a separate route for them, for example a training obligation in the contract. For the personnel of an external supplier the minister points to contractual provisions on security and confidentiality (Q&A 3.3), and the same contract may include a training obligation. Employees of a shared services company in a group are usually treated in the same way. A joint group plan may have one core, but each company that is an essential or important entity adopts its part by a decision of its own management (Article 8d(1)). The head of that company undergoes the training under Article 8e(1). The circle of persons under the KSC regime is described in Who else needs NIS2 training besides the management board?.

How to combine the GDPR and NIS2 in one training plan

The topics form three layers.

• A common core for everyone. Recognising an event, a single internal reporting path and basic cyber hygiene practices. The practices themselves are a separate measure of the system (Article 8(1)(2)(j)), and the training teaches how to apply them. The employee does not need to know which regime is triggered. The employee needs to know whom to tell about the event and how quickly. Deadlines in the two regimes are counted from different moments, as described in What to do after detecting an incident?.
• Data protection layer. The principles of processing in the process of the given group and the scope of authorisation and instructions from the controller (Article 29 GDPR). Customer service and HR learn to recognise requests from data subjects, while process owners and procurement learn to recognise the need for a data processing agreement or a data protection impact assessment.
• Cybersecurity layer. The obligations in the system and the procedures the given group applies. Persons designated to maintain contacts with the entities of the national cybersecurity system (Article 9(1)(1)) learn the reporting procedure.

It is advisable for management to designate an owner of the whole plan who coordinates its preparation and changes. The content of the data protection layer is usually prepared by the officer or the legal department, and that of the cybersecurity layer by the person responsible for the information security management system. The common core is agreed by the owners of both layers.

Fixed points in the calendar

Training of the head of the entity and the person under Article 8e(1). It takes place once per calendar year, and participation in it is documented (Article 8e(1) and (3)). As a rule it covers each member of the management board, even where a responsible person has been indicated under Article 8c(2). This is because the addressee of Article 8e(1) is the head of the entity within the meaning of Article 2(8a), and the indication changes only the circle of persons responsible. The provision refers to a calendar year, not to an interval of 12 months. According to the Minister of Digital Affairs in entities that met the conditions on 3 April 2026 the first training of the head of the entity must take place no later than in 2027 (Q&A 3.46). An entity covered by the Act later has 12 months for the obligations under Chapter 3, counted from meeting the conditions or from the delivery of the decision recognising it (Article 16(1), Article 7l(7)(1) and Article 7m(6)(1)). The scope of the training covers the performance of the obligations listed in Article 8e(2), among others in the information security management system (Article 8) and in handling and notifying incidents (Articles 11 to 12b). The programme of that training is described in What should NIS2 training for the board cover?.

Common core before 3 April 2027. In entities that met the conditions on 3 April 2026 I recommend scheduling the common core for all personnel and the training of the security team for January and February 2027. By 3 April personnel education must already be in place (Article 33(1) of the amending act), and March remains a buffer for rescheduling sessions. From 3 October 2026 at the latest, former operators of essential services notify significant incidents under the amended Articles 11 to 12b (Article 33(4) of the amending act). If they have not yet practised the reporting path, it is worth doing so without delay.

Training before access is granted. It has no date in the calendar because it depends on hires and changes of position. The plan reserves a budget and a trainer for it based on the number of hires, role changes and returns in the last year. The GDPR, the KSC Act and Regulation 2024/2690 do not make the granting of permissions conditional on training. Making it conditional is good practice in implementing Article 32(4) GDPR.

Review of the plan. The measures under Article 24(1) GDPR are reviewed and updated where necessary. An important entity that is a public entity reviews its system at least once a year or without delay in the situations indicated in Part III of Annex 4. It is worth scheduling a mid-year review and a final review with a report for management.

Incident response exercise. The KSC Act requires testing of business continuity plans (Article 8(1)(2)(f)). Regulation 2024/2690 requires incident response procedures to be tested at planned intervals (point 3.5.5), and Annex 4 requires testing of the procedure in the event of a failure or an incident (point 12 of Part I). The exercise involves the same people as the training, so it is worth setting its date in the same calendar.

A sample year may look like this.

• First quarter. Common core for all personnel and training of the security team.
• First and second quarter. Training of the management board and the mid-year review.
• Third quarter. Incident response exercise, workshops for process owners and collection of the inputs.
• Fourth quarter. Final review and costing of the plan for the following year.
• All year. Training before access is granted and short formats for high-exposure teams.

What a training plan should contain

Each item of the plan, that is a group with a topic, has several fixed fields.

• Entity (controller), group and number of persons.
• Layer, topic and form of the sessions.
• Source of the item, that is one of the four inputs of the plan.
• Date, duration per person and total hours.
• Trainer and owner by name.
• Cost.
• Objective with a threshold and a source of measurement.
• Coverage, that is the share of persons in the group trained on time.
• During the year the result and the next step.

The largest budget item is often the working time of participants rather than the provider’s invoice, so the total hours go to management together with the amount. Training from the plan that an employee attends on the instruction of a superior, or that is necessary for a given type of work or work in a given position and required among others by law or by internal regulations, takes place at the employer’s expense and as far as possible during working hours. The time of such training outside normal working hours, including a course completed in the evening, counts as working time (Article 94¹³ of the Labour Code). The provision applies only to employees. For contractors and B2B associates the contract sets the rules for participation in training and payment for its time.

For e-learning the plan records the completion deadline and the moment at which an overdue item goes to the superior. Named results of tests and phishing simulations are personal data of employees. The plan specifies how long they are kept and whether they are reported for individuals or for groups. The contract with an external platform, usually a processor, meets Article 28 GDPR. It is worth recording in it the form in which results are handed over after the end of cooperation. Whether the data are deleted or returned is the choice of the controller (Article 28(3)(g)).

Plan element	What to record	Source of the requirement	Exceptions and limitations
Groups	Roles and scope of access, persons with tasks under Articles 8 and 11 by name	Article 8d(4) and Article 8f(1) of the KSC Act, Article 32(4) GDPR	point 17 of Part I of Annex 4 refers to persons involved in processing information, point 8.2.1 of Regulation 2024/2690 to roles requiring security relevant skills
Topics	Common core, data protection layer, cybersecurity layer	Article 8d(4) of the KSC Act and point 17 of Part I of Annex 4, Regulation 2024/2690 points 8.1.2(c) and 8.2.3, Article 13(6) DORA	the choice of other topics is up to the organisation
Training of the head of the entity	Date in the calendar year, scope under Article 8e(2), method of documenting	Article 8e of the KSC Act	essential and important entities; in banking Article 8e applies accordingly (Article 8i(2)), alongside Article 5(4) DORA
Training before access	Reserve of budget and trainer, link to the permission request	Article 32(4) GDPR, Regulation 2024/2690 points 8.1.2(a) and 8.2.4	Regulation 2024/2690 requires the programme to cover new employees and training for staff who transfer to positions relevant to security; making access conditional on training is good practice
Form	Training or workshop, e-learning, simulation or exercise	good practice	the GDPR and the KSC Act do not specify the form; cost and working time of employees for training attended on the instruction of a superior or for training necessary for a given type of work or position and required among others by law or by internal regulations (Article 94¹³ of the Labour Code)
Measure of effect	Objective, measurement before and after, result that triggers a correction	Article 32(1)(d) GDPR, Article 8(1)(2)(h) of the KSC Act, Regulation 2024/2690 points 8.1.3 and 8.2.3	GDPR — “as appropriate”; the awareness raising programme under Regulation 2024/2690 is tested “where appropriate”, and not testing it requires documented reasoning (Article 2(2)); training under point 8.2.1 is assessed without that qualification (point 8.2.3); point (h) does not apply to entities under Article 8(3) or to banking
Documentation	Programme, named list with the date, result of the check	Article 8e(3), Article 10(4) and Article 53c of the KSC Act and Part IV of Annex 4, Article 5(2) GDPR	in my assessment Article 10 does not apply in the banking and financial market infrastructure sectors (Article 8i(1))
Budget and owner	Amount and total hours, owner of each item, approval by management	Article 8d(2) and (3) of the KSC Act, Article 24(1) and Article 32(1) GDPR	on the GDPR side the decision lies with the controller or the processor
Review	Review date and list of events that change the plan	Article 24(1) GDPR, Part III of Annex 4, Regulation 2024/2690 point 8.2.5	no act sets an annual review of the training plan itself

In supervision the authority may request documents for a specified period, with a deadline appropriate to the scope of the request and not shorter than 7 days (Article 53c(1) and (2) of the KSC Act). Documentation of the implementation of the plan should make it possible to put together the lists, results and decisions for each year quickly. The composition of the documentation confirming implementation of the plan is described in How to document training so that it serves as evidence for the authority?.

How the training plan changes during the year

Alongside the calendar the plan contains a list of events that change it. They include in particular a breach or an incident caused by human error and a new system, process or supplier. The plan is also changed by a change in the law or in the position of an authority, a reorganisation and a measurement result that falls short of the threshold.

It is advisable for the plan owner to record each change with its date and reason. Such a record is simple evidence of the review of measures under Article 24(1) GDPR. It is worth leaving a reserve in the budget for unplanned training.

Common mistakes

• Two plans for the same people. A separate GDPR plan and a separate KSC plan duplicate the common core and may give conflicting instructions for reporting events.
• Board training at the end of the year. Moving December sessions pushes them outside the calendar year under Article 8e(1).
• A condition without a block in the process. The plan provides for training before access, but the permission request does not require confirmation of the training. A new person may then receive access on the first day.

Conclusions and next steps

It is worth collecting the inputs to the training plan two or three months before the budget is closed and preparing the costing a month later. An organisation that starts in November may first present the fixed points of the calendar to management for adoption and complete the other items in the first quarter.

1. Appoint the plan owner and set the date by which they will present the draft to management together with the budget. If a data protection officer has been designated, involve the officer from the start of the work.
2. Task the risk assessment owner, the officer and the security team with providing the lessons and measurement results from the ending year. Collect the list of changes for the following year from IT and HR.
3. Approve the groups by role and access together with a named list of persons performing tasks under Articles 8 and 11 of the KSC Act.
4. Appoint the owners of the data protection layer and of the cybersecurity layer, who agree the common core together. It is worth making a person other than the officer the owner of the data protection layer, although the officer may prepare its content. For each group record the objective and the threshold that triggers a correction.
5. Enter in the calendar the training of the head of the entity and the person under Article 8e(1) in the first half of the year, the exercise and two reviews of the plan. In an entity that met the conditions on 3 April 2026 schedule the common core and the training of the security team for January and February 2027.
6. Cost the plan in money and working hours, with a reserve for training before access is granted and for changes during the year.
7. Adopt the plan by a management decision.

Related materials

• Who else needs NIS2 training besides the management board? — the circle of persons under the KSC regime.
• How often should employees be trained on data protection? — the rationale for the rhythm for individual groups.
• What should NIS2 training for the board cover? — the scope of the mandatory training of the head of the entity.
• How do you know that training produced a real effect? — indicators of effect instead of indicators of activity.

Sources

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) — Article 5(2), Article 24(1), Article 28, Article 29, Article 32(1) and (4), Article 33(5), Article 38(1), (2) and (6) and Article 39(1)(a) and (b) — eur-lex.europa.eu.
• Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 — Article 2(8a), Article 7l(7), Article 7m(6), Article 8, Article 8b(1), Articles 8c to 8f, Article 8i, Articles 9 to 12b, Article 16, Article 53c and Annex 4 (in Polish) — isap.sejm.gov.pl.
• Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) — Article 33(1) and (4) and Article 49 (in Polish) — isap.sejm.gov.pl.
• Act of 29 September 1994 on Accounting, consolidated text (Journal of Laws 2026, item 522, as amended; consolidated text of the Chancellery of the Sejm) — Article 3(1)(6) (in Polish) — isap.sejm.gov.pl.
• Act of 26 June 1974 — Labour Code, consolidated text (Journal of Laws 2026, item 1245) — Article 94¹³ (in Polish) — isap.sejm.gov.pl.
• Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 — Article 2(2) and Annex, points 3.5.5, 5.1.4(b), 8.1.2, 8.1.3 and 8.2.1 to 8.2.5 — eur-lex.europa.eu.
• Regulation (EU) 2022/2554 of the European Parliament and of the Council (DORA) — Article 5(4) and Article 13(6) — eur-lex.europa.eu.
• Minister of Digital Affairs, National Cybersecurity System — questions and answers on the amendment of the KSC Act, update of October 2026 — Q&A 3.3, 3.5, 3.6, 3.8, 3.15, 3.46 and 3.47 (in Polish) — cyber.gov.pl.