What does GDPR require for staff training and awareness?

Yes, in effect, although no article says "train all staff". As at September 2026, the GDPR makes training a practical necessity through its accountability and security duties, and names staff training explicitly in two places: the tasks of the data protection officer (DPO) and the content of binding corporate rules.

The GDPR is an EU regulation, so the same text applies directly in every Member State from May 25, 2018 (Article 99). That differs from an EU directive, which each country must transpose into its own law. Member States can still add national rules in areas the GDPR leaves open, such as employment data, so a multinational should check the national law of each country where it employs people.

Six provisions together create the expectation that people who handle personal data are trained. Two mention training by name; the others require outcomes that an untrained workforce cannot reliably deliver.

The DPO informs and advises staff and monitors whether awareness raising and training happen; the DPO is not required to deliver the training personally. Article 39(1)(a) requires the DPO to inform and advise the controller or processor "and the employees who carry out processing" of their obligations. Article 39(1)(b) adds monitoring of "awareness-raising and training of staff involved in processing operations, and the related audits".

Article 38(2) also requires the organization to give the DPO the resources needed to maintain their expert knowledge, which means the DPO's own continuing professional development is a GDPR matter. Because the DPO reports to the highest management level (Article 38(3)), training coverage and results are a natural item in the DPO's board reporting. See how to report training compliance to the board.

Training is one of the organizational measures that Article 32 expects for the security of processing. The European Data Protection Board's data protection guide for small business states that it is essential to make employees who handle personal data aware of the privacy risks, the measures taken to address them, and the potential consequences of failure.

The EDPB guide lists awareness sessions, regular updates on procedures relevant to each role, and internal communications such as email reminders as ways to raise awareness. It also recommends information security training and awareness sessions with periodic reminders, and confidentiality agreements or clauses with employees. Breaches can start with simple human error, such as a misdirected email or a lost device, so incident recognition and the internal reporting route are core content, because Article 33 requires notification to the supervisory authority within 72 hours of the controller becoming aware of a notifiable breach.

Failing to train is not a separate offense, but it can contribute to infringements that carry the GDPR's two fine tiers under Article 83. Infringements of the controller and processor obligations in Articles 25 to 39 can attract fines of up to EUR 10,000,000 or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)).

Infringements of the basic principles in Articles 5, 6, 7 and 9, data subject rights, or international transfer rules can attract up to EUR 20,000,000 or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). When a supervisory authority investigates an incident, evidence that staff were trained and that training was current is relevant to how it views the organization's measures.

A defensible program has a baseline for everyone with access to personal data and deeper modules for roles with specific GDPR duties. The mapping below is illustrative, not a legal minimum; it shows how each obligation can become a testable learning outcome and a record.

Link each module to an entry in a compliance obligations register, and set refresh cycles by risk, as described in how to set mandatory training refresh cycles. The GDPR does not set a frequency, so the organization's own policy should state and justify one.

Keep evidence that shows who was trained, on what version of the content, when, and whether they understood it. Because Article 5(2) places the burden of demonstrating compliance on the controller, the absence of records is itself a weakness.

• A training needs analysis linking roles to GDPR obligations.
• Content versions with dates, updated after policy changes, new guidance or incidents.
• Per person completion and assessment results, including contractors.
• DPO monitoring reports on training coverage and results (Article 39(1)(b)).
• Records of policy attestation and confidentiality commitments.

Preparing these records is covered in how to prepare training records for an audit.

Knowledge Foundry maps GDPR articles to role based concepts and assessment points before content is written, so every module traces to the obligation it serves. When a policy or regulator guidance changes, the affected concepts and learners can be identified from the map rather than by reviewing the whole library.