With two board decisions: who is the entity manager within the meaning of the KSC Act, and whether the qualification has been documented. Only after these does a gap analysis, implementation plan, and budget make sense.
The GDPR does not specify training frequency. The rhythm is set by changes in processes, staff turnover, conclusions from incidents, and test results — and for entities covered by the KSC Act, there is a strict deadline for management.
Not every one. Reporting to the UODO is the rule, from which one can only deviate based on a documented risk assessment for data subjects. The 72-hour deadline runs from the discovery of the breach, and notifying data subjects is a separate decision.
