GDPR and staff training: The awareness obligation most organizations overlook

Ask most people what GDPR is about, and they will mention consent forms, the right to be forgotten, and large fines. Few would mention employee training. Yet buried in the regulation, and in the guidance of European data protection authorities, is a clear expectation that organizations train their staff on data protection. It is one of the most overlooked obligations in the GDPR, and one of the most frequently cited in enforcement actions when things go wrong. Here is what the regulation actually requires.

Where training lives in the GDPR

The GDPR does not contain a single article titled training, but the obligation is present in several places. Article 39, on the tasks of the data protection officer, includes monitoring compliance with the regulation and the organization's policies, and raising awareness of those obligations. Article 32, on security of processing, requires measures appropriate to the risk, which regulators read to include a trained workforce. Article 24, on the controller's responsibility, requires organizations to implement measures that demonstrate compliance. Taken together, these provisions make training part of the accountability principle that runs through the whole regulation.

The awareness obligation

The most direct training obligation comes through the data protection officer's awareness-raising role. Even organizations without a formal DPO have the underlying duty to ensure staff understand their data protection responsibilities. The supervisory authorities have consistently emphasized that training is a key part of demonstrating accountability. An organization that cannot show its staff were trained on data protection is in a weak position to argue it took the required measures, regardless of what its written policies say.

Why it is so often overlooked

The training obligation gets overlooked for a simple reason: it is not headline news. Consent, data subject rights, and the threat of fines dominate the conversation, while the quieter obligation to train staff slips through. Many organizations produce a privacy policy, appoint a DPO, and consider themselves done, without ever educating the people who actually handle personal data day to day. This is precisely where breaches happen, an employee mishandles data, misdirects an email, or falls for a phishing scheme, and the organization discovers its policies were never more than paper.

What a compliant program looks like

A GDPR-aligned training program has a few clear characteristics. It covers the basics of data protection: what personal data is, the principles of processing, data subject rights, and how to handle a breach. It is delivered to all staff who handle personal data, not just a compliance team, and it is refreshed regularly. Crucially, it is documented, with records of who completed training and when. The documentation is what turns training into evidence of accountability, which is what supervisory authorities actually look for.

What supervisory authorities expect

European data protection authorities have made their expectations clear through guidance and enforcement. In breach investigations, they routinely ask about the training provided to staff and request records. Organizations that can produce evidence of a documented, recurring training program are treated far more favorably than those that cannot. The absence of training is not just a technical gap, it is read as a sign that the organization has not embedded data protection into its culture, which is exactly what the accountability principle demands.

The practical takeaway

The lesson of GDPR training is that the quiet obligations are often the ones that matter most in practice. A consent mechanism can be audited, but a workforce that mishandles data because it was never trained is where real harm, and real fines, originate. Organizations that treat staff training as a core, documented part of their data protection program, delivered to everyone and refreshed regularly, will find themselves far better positioned than those that treated it as an afterthought. In the accountability era, the ability to prove your people were trained is as important as the policies themselves.