{"id":3915,"date":"2026-07-07T09:20:00","date_gmt":"2026-07-07T07:20:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/how-often-should-employees-be-trained-on-personal-data-protection\/"},"modified":"2026-09-27T19:58:31","modified_gmt":"2026-09-27T17:58:31","slug":"how-often-should-employees-be-trained-on-personal-data-protection","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/how-often-should-employees-be-trained-on-personal-data-protection\/","title":{"rendered":"How often should employees be trained on data protection?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for management staff and DPOs \u2022 published July 7, 2026 \u2022 updated September 27, 2026 \u2022 8 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

The GDPR does not specify training frequency \u2014 there is no provision in it that would indicate “once a year” or any other interval. The controller’s obligation is to ensure that individuals processing data know how to proceed in their processes and to demonstrate this state with evidence. An annual cycle is often a reasonable benchmark for the entire organization, but the actual rhythm is set by changes in processes, employee turnover, conclusions from incidents, and test results. It is different in the cybersecurity regime. The amended Act on the National Cybersecurity System (KSC) directly specifies the training frequency for the entity’s manager. <\/p>\n<\/div>\n\n\n\n

Why this question arises at all<\/h2>\n\n\n\n

The question of frequency usually arises at two moments. One is when an organization is building a training schedule for the coming year and needs to enter a number, and the other is when an auditor or authority asks when the last training took place and who it covered. In both cases, a single number is expected, but the regulations do not provide one. <\/p>\n\n\n\n

The source of doubt is the structure of the GDPR itself. The Regulation mentions staff training expressly in only one place \u2014 as an element of the monitoring of compliance carried out by the data protection officer (Art. 39 sec. 1 lit. b) \u2014 and it builds the controller’s obligation around the result, not around the training event. The controller implements appropriate technical and organizational measures to ensure that processing is performed in accordance with the Regulation and to be able to demonstrate this (Art. 24 sec. 1). In doing so it takes into account the nature, scope, context and purposes of processing as well as the risk to the rights or freedoms of individuals. It reviews and updates those measures where necessary (Art. 24 sec. 1). It also takes steps to ensure that every person acting under its authority who has access to personal data processes them only on its instructions, unless required to do so by Union or Member State law (Art. 29 and Art. 32 sec. 4). Among the measures implemented as appropriate, the GDPR also lists regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing (Art. 32 sec. 1 lit. d). Training is one of the tools by which these requirements are met, not a separate obligation with its own deadline. <\/p>\n\n\n\n

This difference has practical consequences. An organization that asks “is once a year enough” is asking something that cannot be resolved in isolation from its processes. An organization that asks “what needs to happen for us to train people before a change” is asking a question for which an answer exists. <\/p>\n\n\n\n

\n

It is worth separating training from technical security. The Provincial Administrative Court in Warsaw, in a case discussed by the UODO, ruled that a controller’s limitation to training alone, without technical safeguards, does not constitute the implementation of appropriate measures.<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

Training changes how people act \u2014 it does not replace encryption, access control, or procedures.<\/p>\n\n<\/div>\n<\/div>\n\n\n\n

What needs to be determined before making a decision<\/h2>\n\n\n\n

Who we are actually training<\/h3>\n\n\n\n

“All employees” is a category that most often dilutes the training program and means that no one receives content useful in their work. The starting point is a division into groups that process data differently and bear different risks. These are newly hired and changing positions, process owners, high-exposure teams (HR, customer service, sales, marketing, recruitment), IT and security departments, management staff, and the Data Protection Officer. <\/p>\n\n\n\n

This division determines frequency more than the calendar. A team where one-third of the members change during the year needs ongoing induction training, not a single event in November. <\/p>\n\n\n\n

What has changed since the last training<\/h3>\n\n\n\n

The training cycle should respond to changes that genuinely alter how data is processed. In practice, this involves four types of events. These are launching or significantly redesigning a processing operation, implementing a new system or changing a vendor with access to data, changing the legal status or regulatory body’s position affecting organizational obligations, and organizational change \u2014 a new structure, acquisition, or centralization of services. <\/p>\n\n\n\n

If none of these events occurred in a given year, repeating the same training “because a year has passed” provides proof of attendance but changes little in behavior. If three occurred, the annual schedule is already outdated at the time of approval. <\/p>\n\n\n\n

What incidents and reports say<\/h3>\n\n\n\n

The most reliable indicator of training needs are events that actually occur in the organization. Incorrect addressing of correspondence, sending to multiple recipients in the “cc” field, handing over documents to the wrong person, opening an attachment from a phishing email, using private tools to process work data \u2014 each of these indicates a specific group and a specific topic. <\/p>\n\n\n\n

In practice, it is worth linking the register of breaches and internal reports with the training plan as a constant input, rather than as an ad hoc reaction after a more prominent event. If the organization is only just organizing the process of identifying and assessing such events, assessing incidents and breaches<\/a> is an earlier step than planning training. <\/p>\n\n\n\n

How do we measure effectiveness<\/h3>\n\n\n\n

Article 32 sec. 1 lit. d of the GDPR lists regular testing, measuring, and evaluating the effectiveness of technical and organizational measures intended to ensure the security of processing \u2014 as one of the example measures, applied as appropriate. Where training serves the security of processing, it falls within this scope; the general requirement to review and update measures follows from Art. 24 sec. 1. Organizations use knowledge tests after training, controlled phishing simulations, review of suspicious message reports, analysis of the repeatability of the same errors in subsequent periods, and short checks as part of internal audits. <\/p>\n\n\n\n

The measurement result is what justifies changing the frequency. A group that repeats the same mistake in a test needs a shorter cycle and a different form of activity \u2014 not another presentation on general principles. <\/p>\n\n\n\n

How do we prove that training took place<\/h3>\n\n\n\n

The controller must be able to demonstrate compliance with the principles of processing (Art. 5 sec. 2). The composition of the training records that serve this purpose is described in How to document training so that it serves as evidence for the authority?<\/a>.<\/p>\n\n\n\n

This is evident in supervisory practice. In decision DKN.5131.34.2023 of June 13, 2026, the President of the UODO found that the controller conducted employee training only after a breach, and the submitted training reports were from the period following the incident. Evidence created after an event does not replace evidence from the period to which the proceedings relate. <\/p>\n\n\n\n

What other regimes cover the same organization<\/h3>\n\n\n\n

Some organizations are subject to both the GDPR and cybersecurity regulations, and the latter treat frequency differently. The amended KSC Act stipulates that the manager of an essential or important entity and the person entrusted with the manager’s cybersecurity duties must undergo training once per calendar year (Art. 8e), and participation in the training must be documented. The scope of that training is set by Art. 8e sec. 2 through a reference to the catalogue of duties for which the manager is responsible. For failure to perform the training obligation, the manager may be fined separately where the duration, scope or nature of the breach justifies it (Art. 73a sec. 1 item 4). The penalty may reach 300% of the remuneration they receive, calculated under the rules for determining cash in lieu of annual leave, and as a rule 100% in a public entity (Art. 73a sec. 4 and 5). This penalty may first be imposed two years after the entry into force of the amendment (Art. 35 of the amending act). The Ministry of Digital Affairs indicates the manager’s training obligation as one of the changes introduced by the amendment. For personnel, the act does not specify an interval \u2014 among the measures that the information security management system is to provide, it lists cybersecurity education for the entity’s personnel and basic cyber hygiene principles (Art. 8 sec. 1 point 2). The exception is an important entity that is a public entity. For such entities the annex to the act lists training of persons involved in information processing as a specific action \u2014 covering types of cyber threats, cyber hygiene principles, incident response, and awareness of the consequences of a breach \u2014 and requires a review of the system at least once a year. <\/p>\n\n\n\n

The ISO\/IEC 27001:2022 standard remains a voluntary reference point, which in Annex A provides for control 6.3 concerning information security awareness, education, and training. Applying the standard is not a legal obligation, but certified organizations must expect an auditor’s question about the cycle and effectiveness. <\/p>\n\n\n\n

In practice, this means one thing. An organization covered by both regimes does not need two independent training programs, but one plan where the strict KSC deadline sets the rhythm for managerial roles, and the GDPR criteria define the scope for other groups.<\/p>\n\n\n\n

Variants by role<\/h2>\n\n\n\n
\n

The following summary is a practical assessment based on the typical organizational structure of a medium to large organization. It does not stem from regulations and requires confrontation with the risks of specific processes. <\/p>\n<\/div>\n\n\n\n

Group<\/th>What triggers training<\/th>Rhythm applied in practice<\/th>How to demonstrate<\/th><\/tr><\/thead>
Newly hired and changing positions<\/td>Granting data access, change of responsibilities<\/td>Before allowing processing, not on an annual cycle<\/td>Linking training to authorization and date of access grant<\/td><\/tr>
High-exposure teams (HR, customer service, sales)<\/td>Process change, recurring errors, conclusions from incidents<\/td>Shorter formats more frequently than once a year, tailored to the process<\/td>Thematic program, test results, incident report summary<\/td><\/tr>
Process owners<\/td>Process launch, DPIA, vendor change<\/td>Upon change and periodically<\/td>Workshop notes, process decisions, trace in process documentation<\/td><\/tr>
IT and security departments<\/td>Architecture change, new threats, post-breach conclusions<\/td>Continuous competence development, regardless of the general cycle<\/td>Competence development plan, certificates, exercises<\/td><\/tr>
Management staff<\/td>Managerial responsibility, KSC obligations<\/td>Statutory requirement under KSC for the head of the entity and the person under Art. 8e sec. 1 \u2014 once per calendar year; under GDPR determined by the organization<\/td>Under KSC (the head of the entity and the person under Art. 8e sec. 1) a program linked to Art. 8e sec. 2 and a named confirmation of participation<\/td><\/tr>
Data Protection Officer<\/td>Legal changes, regulatory guidelines, supervisory practice<\/td>Continuous knowledge updating<\/td>Participation in training and conferences, resources provided by the controller under Article 38(2) of the GDPR<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The obligation to provide the officer with the resources necessary to maintain their expert knowledge follows directly from Article 38(2) of the GDPR; the Guidelines for Data Protection Officers (WP243 rev.01), approved by the European Data Protection Board, develop it by indicating continuous training as an element of those resources. This requirement applies to the DPO role, not personnel \u2014 if the organization is also considering how to fill this function, the appropriate starting point is support from an external DPO<\/a>. <\/p>\n\n\n\n

Most common mistakes<\/h2>\n\n\n\n