What Counts as GDPR Training? (UK GDPR Explained)

GDPR does not require a specific course, format, or qualification. What counts as GDPR training is any structured learning that is appropriate to the role, improves understanding of data protection responsibilities, and can be evidenced. The ICO cares about four core criteria: relevance to the role, structure (not ad-hoc), evidence that it happened, and ongoing refreshers (not one-off).

The following formats are generally acceptable if they meet the ICO criteria: online GDPR courses, instructor-led training sessions, structured onboarding training, role-specific briefings, refresher or update sessions, and documented internal training materials. The format matters far less than appropriateness and evidence. What matters is that training is appropriate to the role, structured, documented, and refreshed.

The following are rarely sufficient by themselves: sending a policy by email, asking staff to read the GDPR policy, informal chats with no record, relying on prior knowledge, or assuming managers will figure it out. These may support training but don't replace it. Training must be intentional (not accidental), structured with planned sessions and defined content, and evidenced with records of who received training, when it was delivered, and what it covered.

Full GDPR courses are appropriate for high-risk or decision-making roles (core understanding and accountability), role-specific briefings are for targeted responsibilities (practical application in day-to-day work), refresher training provides periodic updates (reinforce knowledge and reflect change), induction training establishes baseline awareness for new starters, and incident-led training prevents repeat failures after issues or near-misses. A strong approach usually combines more than one of these.

Regulators are interested in outcomes, not expensive courses or long slide decks. They look for: staff understanding their responsibilities, consistent behaviour, correct incident reporting, decision-making aligned with policy, and evidence that training influenced practice. Training that doesn't change behaviour is treated as ineffective. What matters is that training is appropriate to the role, structured, documented, and refreshed.

The ICO looks at whether training meets four core criteria: relevance to the role (training must match what people actually do with personal data), structure (training must be intentional with planned sessions and defined content, not ad-hoc), evidence that it happened (organisations must show who received training, when it was delivered, and what it covered), and ongoing refreshers (training must be kept up to date with refreshers, updates after incidents, and updates after role or system changes).