GDPR guide
GDPR training: who needs what, and the evidence that shows your people know their part
What the GDPR expects of your people, which training everyone, request handlers, incident responders, project and procurement teams, the DPO and leadership need, the evidence regulators and client auditors accept, and a role-by-role matrix you can adapt.
Key points
- The GDPR sets no course list, no hours and no certificate. It makes the controller accountable for showing the principles are met, and people who do not know their part are the fastest way to fail that test.
- Training is named directly among the data protection officer's tasks, alongside awareness-raising and audits, so whoever holds that role owns the programme even when others deliver it.
- Depth follows the data: everyone who touches personal data needs awareness, while request handlers, incident responders, project leads, procurement and the DPO or privacy lead each need a working method.
- A regulator or a client auditor looks for a matrix, tested learning and signs that people act on it, such as requests answered within a month and breaches assessed within 72 hours. A sign-in sheet shows attendance and little else.
Does the GDPR require training?
Not as a stand-alone obligation, but a GDPR programme cannot be demonstrated without it. Article 5(2) makes the controller answerable for proving that personal data is handled lawfully, fairly, transparently, minimally, accurately, for limited periods and securely. Article 24 asks for technical and organisational measures that show processing follows the Regulation, reviewed and updated. Article 32 asks for security measures appropriate to the risk. A retention rule nobody knows about is not a measure, and neither is an incident procedure the service desk has never seen.
The Regulation mentions training in plain words when it lists what the DPO does: monitoring compliance, which includes assigning responsibilities, raising awareness, training staff involved in processing and running audits. Where no DPO is required, the same work still has to sit with someone, usually a privacy lead reporting to senior management.
Processors carry a people duty too. The contract every controller must sign with a processor under Article 28 requires that the people authorised to process the data are bound by confidentiality, and the processor has to be able to show it.
Who needs what GDPR training
Everyone who handles personal data
Awareness for every employee, contractor and temporary worker with access to personal data: what counts as personal data, the principles in everyday terms, how to recognise a rights request or a possible breach, and exactly whom to tell and how fast.
People who answer the public
Customer service, HR and anyone else who receives letters, calls or e-mails from individuals needs the request procedure: checking identity, logging the request, finding every record about the person and replying within one month, extendable only with reasons.
IT, security and incident responders
These teams need the breach workflow: containing the event, assessing the risk to individuals, recording the decision even when nothing is reported, and handing over in time for notification to the supervisory authority within 72 hours of awareness where notification is due.
Project leads, product owners and procurement
Anyone who launches a system, a process or a supplier needs data protection by design and by default, the DPIA screening question and when a full DPIA is due, and the processor route: due diligence, an agreement with the Article 28 terms, sub-processor approval and a transfer safeguard where data leaves the EU or EEA.
The DPO or privacy lead
A designated DPO must have expert knowledge of data protection law and practice. That goes well beyond awareness: the Regulation, national rules, guidance from the supervisory authorities and the way the organisation actually processes data. Legal knowledge of this depth comes from qualified legal training and experience; Sterling's work is consulting, not legal advice.
Leadership and internal auditors
Senior managers need enough to fund the programme and act on the DPO's reports. Internal auditors need the Regulation, the organisation's procedures and auditing skill. GDPR internal audit: planning, conduct and reporting
GDPR training matrix: role, content and evidence
A matrix ties each group to what it must know and to the record that proves it. Use this as a starting point and adjust it to your own processing activities and risks.
| Group | What they learn | Evidence a reviewer accepts |
|---|---|---|
| All staff and contractors with data access | Personal data basics, the principles, spotting requests and breaches, reporting routes, confidentiality | Induction record, test result, signed confidentiality commitment, refresher dates |
| Request handlers (service desk, HR) | Identity checks, the one-month clock, searching all systems, each right and its limits | Rights-request log with response dates, sample replies, supervisor sign-off |
| IT, security and incident responders | Breach triage and risk assessment, the 72-hour route, access, retention and deletion | Breach register including non-notified events, rehearsal report, access reviews |
| Project leads, product owners, procurement | By design and by default, DPIA screening, processor agreements, transfers | DPIA register, completed screening questions, signed agreements, transfer map entries |
| DPO or privacy lead | The Regulation in depth, national rules, supervisory-authority guidance, audit and advice | CV and qualifications, continuing development record, advice given on DPIAs |
| Senior management | Accountability, the risk picture, reading DPO reports, decisions only they can take | Briefing record, management review minutes with decisions and owners |
| Internal auditors | The Regulation, internal procedures, planning, sampling and reporting | Auditor training record, audit reports, findings closed with evidence |
What evidence proves GDPR training works?
Client auditors and supervisory authorities rarely stop at "did you train your people?". The follow-up is "show me", answered in three layers.
Criteria. The matrix itself, showing that you decided what each group needs, based on the data it handles, rather than sending everyone the same module.
Records. Who completed what and when, with a test result where learning was tested, kept for staff, contractors and, for your retention period, leavers.
Proof of use. This is where programmes are judged. A rights-request log with replies inside the deadline, a breach register that shows incidents assessed and decisions reasoned, DPIAs completed before go-live, and staff who can explain in their own words what they would do with a suspicious e-mail asking for a customer's file.
Where GDPR training programmes fall short
- One annual click-through for everybody. The service desk and the developers face different risks; a generic module leaves both unprepared for what they will meet.
- Consent myths repeated. Training that tells staff to "get consent" for everything creates records nobody can defend. People need to know that consent is one of six lawful bases and who decides which applies.
- Contractors and agency staff missing. They often have the same system access as employees and no record at all.
- No link to procedures. Staff learn principles but never see the actual request form, breach channel or DPIA template they are meant to use.
- A DPO appointed without the depth. Naming someone with the title but not the knowledge, time or reporting line leaves the Article 39 tasks undone.
- Content frozen in 2018. New systems, new suppliers, new transfer routes and legal change, such as the UK amendments made by the Data (Use and Access) Act 2025, should trigger updates. GDPR vs UK GDPR: what differs and what does not
Sterling Academy and training within the engagement
Training is built into a Sterling GDPR engagement rather than bolted on at the end. As procedures are written, the consultant trains the people who will run them: request handlers, breach responders, and project and procurement teams. The training record is kept as it happens, in Effivity alongside the rest of the programme.
For the wider workforce, Sterling Academy provides e-learning with learning checks and a final exam, and completion earns a numbered Sterling Academy Certificate of Completion. Users, courses and the access period are confirmed in the proposal.
Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy access
How Sterling builds GDPR training evidence
A role-based matrix, people trained on the procedures they actually use, and the records ready before anyone asks.
Our expert and experienced consultants build the matrix from your data inventory, train each group as its procedures go live, rehearse a breach with your responders and keep every record in Effivity. When a client auditor or a regulator asks how your people know their part, the answer is already on file. Compliance is judged by regulators and your customers' auditors, not by Sterling.
Book a free discovery callGDPR training: questions buyers ask
Is GDPR training mandatory for all employees?
No article says every employee must complete a course, but the controller must be able to demonstrate compliance, and that is very hard for anyone handling personal data without awareness. In practice, everyone with access to personal data needs awareness, and the depth grows with the data and decisions each role handles.
How often should GDPR training be repeated?
The Regulation sets no frequency. An annual refresher is common, but change should drive it: a new system, a new supplier, a breach, a failed request or a change in law is a reason to update and retrain the people affected, whatever the calendar says.
Does a data protection officer need a certification?
No specific certificate is required. The Regulation requires a DPO chosen for professional qualities and expert knowledge of data protection law and practice. Qualifications, experience and continuing development show that your appointee has it.
Do contractors and processor staff need GDPR training?
Contractors who work with your data under your direction should be trained and recorded like employees. For a processor, your Article 28 agreement requires its authorised people to be bound by confidentiality; ask for evidence of that and of its own training during due diligence.
Is a GDPR training certificate proof that we are compliant?
No. A completion certificate shows that one person finished one course. Compliance rests on the whole programme: lawful bases, records, notices, contracts, security and people who apply what they learned. Training evidence is one part of that picture.
Can e-learning replace classroom GDPR training?
For awareness, yes, provided learning is tested and recorded. For roles that operate procedures, such as request handling or breach response, add hands-on practice with the real forms and a rehearsal, because the proof a reviewer wants is people doing the task correctly.
More GDPR guides
Every guide in the GDPR series is written for one question and links back to the hub for the whole picture.
- Data subject access request process
- GDPR compliance step by step
- GDPR compliance cost: what moves the price
- GDPR documentation: records, notices, contracts and DPIAs
- Effivity for the GDPR: the guide
- GDPR internal audit: planning, conduct and reporting
- GDPR requirements explained, article by article
- GDPR training: who needs what, and the evidence
- GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2
- GDPR vs UK GDPR: what differs and what does not
Keep exploring
Explore more about GDPR
Watch a video on how to comply with GDPR here.
Watch a video on GDPR requirements here.
GDPR resources
Services for GDPR
Talk to a consultant
Give your people GDPR training that stands up to a client audit.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice