Importance of Data Protection Trainings

The Data Protection Regulation requires an organisation, regardless acting as a controller or processor, to be able to ensure that its employees are properly trained and do not compromise personal data in its possession. 

In order to prevent a potential data breach or at least to reduce the risk of one occurring, the organisation’s employees must know how to handle the personal data in their possession. It is therefore important to regularly train personnel, as well as revise their knowledge and awareness on the data processing aspects.

One of the most effective ways to train personnel is to involve a data protection officer (DPO) in the trainings, their organization, monitoring and provision of explanations to follow up questions. If the DPO is not appointed, the organisation may consider involving another competent data protection specialist, mainly a lawyer or IT specialist, who understands data protection issues sufficient enough to train other employees. 

The main goal is that employees can reasonably answer to the questions from the clients, customers, partners about why they are being asked to provide their personal data and, where appropriate, to indicate that further information is available in the privacy policy published on the organization’s website. In specific cases such basic knowledge can be not enough to suit person’s interests. 

Therefore, the training process should focus not only on basic data protection education, but also on education appropriate to the scope of the organization’s activities and the data it holds, whether it be customers, partners, other individuals, or its own employees. 

Attention should also be paid to the regularity of training, keeping up to date with the developments in the field of data protection, as well as to the training of new employees. As provided by the Latvian supervisory institution, preferred content of trainings shall coved following topics:

Although initially it may seem like a time-consuming and resource-intensive tool, it is a way to avoid intentional or accidental data leaks and other unforeseen events, that can result in financial losses for the organisation, lost customers and reputation, and fines for unlawful data processing that an employee will have carried out within the organisation, perhaps simply because the organisation did not invest enough in training of its employees or did not train them at all.

Therefore, we kindly recommend you – reflect and evaluate the knowledge of your organization’s personnel on the data protection aspects.