Who to train, on what and how often, so that training changes decisions. Requirements under the GDPR and the KSC Act, and how to evidence them.
Legal status: August 2026
See also: DPO and GDPR NIS2 and KSC Incidents and Breaches AI Act
Training matched to roles and processesThe programme, its frequency and the way you verify the effect depend on who makes the decisions and what data they work with. Tell me how this looks in your organisation and I will propose a scope. Explore the service
The KSC Act requires the entity’s staff to be aware of their cybersecurity duties and to know the internal rules (Article 8d(4)). It names the head of the entity and the person entrusted with their duties. Depth for everyone else is differentiated by the organisation itself — by the tasks under Articles 8 and 11, by system access and by risk.
Attendance and a final test describe how the training went, not its effect. The effect shows in data the organisation collects independently of the session, and assessing the effectiveness of organisational measures is required by both the GDPR and the Polish KSC act.
The scope of training for the head of the entity is set by Article 8e(2) of the Polish KSC Act. It covers the very obligations the head is answerable for. The Act says nothing about form, length or level of detail — that is for the organization to settle.
The GDPR does not specify training frequency. The rhythm is set by changes in processes, staff turnover, conclusions from incidents, and test results — and for entities covered by the KSC Act, there is a strict deadline for management.
