GDPR Awareness Training for UK Staff: What to Cover and Why

GDPR awareness is the working knowledge staff need to handle personal data lawfully: what counts as personal data, why and how it can be used, what individuals are entitled to ask for, and what to do when something goes wrong. In the UK, this means UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

Most data protection failures are not clever attacks. They are an email sent to the wrong person, a laptop left open in a café, or a customer request that nobody recognised. Training aimed at those moments reduces risk more than a policy document that nobody reads.

This article sets out what to include, the points staff most often get wrong, and the legal changes in force as at October 2026. It is practical guidance, not legal advice.

Why GDPR awareness matters for every employee

Organisations are accountable for how personal data is handled, and that accountability is carried out by people. A receptionist, a sales executive and a finance clerk all make decisions about personal data daily. If they do not recognise a risk, the organisation cannot control it.

Awareness also supports the rest of your security. Many incidents begin with a phishing email, and our guide to phishing types and prevention is a useful companion to any data protection session. Awareness is not a substitute for technical controls, but it fills the gap that technology cannot.

It also helps with trust. Customers and clients increasingly ask how you protect their information, and being able to describe a regular, documented training routine is a credible answer. Regulators look for the same evidence when they review how an organisation meets its accountability duties.

Small firms are not exempt. The duties are the same, which is why a plain, practical approach matters. Our page on cyber security for small business covers the technical side of the same problem.

The principles every member of staff should know

UK GDPR sets out seven principles. Present them in plain language, with one workplace example each.

Link each principle to your own retention schedule and approved tools, so staff know the rule that applies to them.

Lawful bases in plain English

Every use of personal data needs a lawful basis. There are six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Most staff do not need to choose one, but they should know that the organisation has recorded one for each activity, and that the basis affects what individuals can ask for.

Two points are worth stressing. Consent must be freely given, specific and easy to withdraw, so it is a poor fit for employees' data in most cases. And the Data (Use and Access) Act 2025 introduced a category of recognised legitimate interests, which covers certain purposes such as protecting public security. For those listed purposes, the usual balancing test is not required. For most staff, the practical message is unchanged: if you are unsure whether you may use data for a new purpose, ask the person responsible for data protection first.

Data subject rights and DSARs

Individuals have rights over their data, including the right to be informed, to access it, to have it corrected or deleted in some circumstances, to restrict or object to its use, and to data portability. Rights relating to automated decisions also apply.

The right of access is the one staff meet most. A data subject access request (DSAR) can arrive by email, letter, social media or verbally, and it does not need to use any special wording. The ICO explains the right in its guidance on the right of access. Staff only need to do three things:

• Recognise that a request has been made, even if it is informal.
• Forward it to the designated contact on the day it arrives.
• Avoid deleting or altering anything that might be relevant.

The normal response time is one month, which is why speed at the first step matters. Under the Data (Use and Access) Act, organisations need only carry out reasonable and proportionate searches, a change the ICO lists as now in force.

Breach reporting and the 72-hour rule

A personal data breach is a security incident that affects the confidentiality, integrity or availability of personal data. It includes loss, accidental disclosure and unauthorised access, not only hacking.

The ICO's personal data breach guide states that a notifiable breach must be reported to the ICO without undue delay and no later than 72 hours after the organisation becomes aware of it. If the risk to individuals is high, those people must be told directly. Every breach must be recorded internally, whether or not it is reported.

Make the route obvious: one email address, one phone number, and a promise that honest early reports will not lead to blame. Where you use an outsourced IT helpdesk, agree how security incidents are escalated.

Common staff mistakes to cover

Build your scenarios around real behaviour:

• Wrong recipient. Autocomplete sends a client file to a similarly named contact.
• Visible email lists. Using To or CC instead of BCC for a mailing.
• Unapproved tools. Sending files through personal messaging or storage accounts.
• Devices left open. Laptops and screens left accessible in shared or public spaces.
• Phishing. Entering credentials on a fake login page.
• Ignoring requests. Treating a verbal or social media access request as casual conversation.
• Keeping everything. Old spreadsheets with personal data stored indefinitely.
• Late reporting. Hoping a mistake will go away.

Pair each with a simple behaviour: check the recipient, use BCC, use approved storage in Microsoft 365, lock the screen, report early.

What changed under the Data (Use and Access) Act 2025

The ICO's guidance on the Act, updated on 19 June 2026, states that all the data protection provisions in the Act are now in force. As at October 2026, the changes it highlights for organisations are these:

• Complaints. Organisations must help people make complaints, for example through an electronic form, acknowledge them within 30 days and respond without undue delay.
• Subject access requests. Searches need only be reasonable and proportionate.
• Recognised legitimate interests. Certain purposes no longer need a balancing test.
• Automated decision-making. More lawful bases are available for significant automated decisions, with safeguards, though not for special category data.
• Cookies. Some cookies, such as those for statistics or website functionality, can be set without consent.

Details are on the ICO's page on the Data (Use and Access) Act for organisations. The ICO has also said it will publish final enforcement procedural guidance in due course. For staff, the main training update is the complaints process: anyone who might receive a complaint about data handling should know where to send it.

How to deliver GDPR awareness training

Keep sessions short and repeat them. A 20 to 30 minute induction module, a yearly refresher and brief prompts after incidents work better than one long annual course. Add role-specific content for HR, marketing, finance and anyone who handles customer records.

• HR: employee records, references, sickness and disciplinary data, and retention periods.
• Sales and marketing: contact lists, consent and objections to direct marketing, and cookies on the website.
• Finance: bank details, invoices, and checking payment change requests.
• Managers: spotting incidents, supporting staff who report, and handling complaints.

Test understanding with scenarios, keep a record of who completed what, and update the content when your tools or processes change. Technical safeguards such as device encryption, access control and baseline controls under Cyber Essentials support the training. If you are unsure where your gaps are, a cyber security audit is a sensible first step.

Conclusion

Good GDPR awareness is practical: the principles, a clear sense of lawful use, fast handling of rights requests and immediate breach reporting. The Data (Use and Access) Act 2025 changes are in force as at October 2026, so refresh your materials to cover complaints, reasonable searches and the other updates. Build short, repeated sessions around real mistakes, and make reporting easy. If you would like help with the security side of data protection for your team, contact NetMonkeys.

Frequently Asked Questions (FAQs)