Who to train, on what and how often, so that training changes decisions. Requirements under the GDPR and the KSC Act, and how to evidence them.
Legal status: August 2026
See also: DPO and GDPR NIS2 and KSC Incidents and Breaches AI Act
Training matched to roles and processesThe programme, its frequency and the way you verify the effect depend on who makes the decisions and what data they work with. Tell me how this looks in your organisation and I will propose a scope. Explore the service
Training records serve best as evidence when they establish the person, the content and the day of training before the event examined by the authority. It is worth making a programme with references to procedures and their versions the core of the record, with the attendance list as its annex.
The head of the entity ensures that staff are aware of cybersecurity obligations (Article 8d(4) of the KSC Act). The Act requires annual training of the head and of the person entrusted with the head’s duties in that area (Article 8e(1)). Other people are best selected by their tasks under Articles 8 and 11.
Attendance and a final test describe how the training went, not its effect. The effect shows in data the organisation collects independently of the session, and assessing the effectiveness of organisational measures is required by both the GDPR and the Polish KSC act.
The scope of training for the head of the entity is set by Article 8e(2) of the Polish KSC Act. It covers the very obligations the head is answerable for. The Act says nothing about form, length or level of detail — that is for the organization to settle.
The GDPR does not specify training frequency. The rhythm is set by changes in processes, staff turnover, conclusions from incidents, and test results — and for entities covered by the KSC Act, there is a strict deadline for management.
