If your organisation handles personal data, you may have asked whether you are legally required to train your staff on data protection. UK data protection law does not contain a stand-alone duty to provide training. In practice, though, it is very hard to meet the obligations that do exist without it, and the Information Commissioner’s Office (ICO) expects every organisation to train the people who handle personal data on its behalf.
This article explains where that expectation comes from, what the ICO says about who to train and how often, what changed in 2026, and how to keep records that show the training took place. It was updated in October 2026.
What has changed in 2026
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025 and has been brought into force in stages. Most of its changes to UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) took effect on 5 February 2026. A new duty for organisations to handle data protection complaints followed on 19 June 2026. Our article on what changed on 5 February 2026 covers these in more detail.
The DUAA does not add a training requirement. It does change several procedures that staff carry out day to day, including how subject access requests are timed, how complaints must be handled, and when cookies can be set without consent. Training material written before 2026 is likely to be out of date on these points.
The regulator itself has also changed. On 30 September 2026 the Information Commissioner’s Office became the Information Commission, a body run by a board rather than a single commissioner. It keeps the ICO abbreviation, and its powers and guidance are unchanged by the transition. This article uses “ICO” throughout.
Where the training expectation comes from
The legal basis in UK GDPR
Three provisions of UK GDPR together create the expectation that staff are trained:
- Article 5(2), the accountability principle. Controllers must be able to demonstrate that they comply with the data protection principles. Training records are one of the main forms of evidence the ICO looks for.
- Article 24. Controllers must put in place appropriate technical and organisational measures, including data protection policies where proportionate. A policy that staff have not been taught has little effect.
- Article 32(4). Controllers and processors must take steps to ensure that anyone acting under their authority who has access to personal data only processes it on the controller’s instructions. Training is the usual way of making sure people know what those instructions are.
What the ICO says
In its advice for small organisations, the ICO states that the law does not say what staff training should include or how often it should be given. It says training should be relevant to each person’s role, refreshed regularly, and given to everyone who works for you, including temporary staff and volunteers. As a minimum, it suggests covering the data protection basics, what to do if something goes wrong, and the privacy information you give to customers or members.
The ICO’s accountability framework section on training and awareness, which it uses when auditing organisations, sets out more detailed expectations. These include:
- induction training for all staff before they start working with personal information
- refresher training at appropriate intervals, whatever a person’s contract type, grade or length of service
- a system that tells staff and managers when refresher training is due, with a set timeframe for completing it
- removing access to personal information from staff who do not complete refresher training in that timeframe
- extra, role-specific training for staff with particular data protection responsibilities
- checking understanding after training, and keeping training records
The ICO’s guidance is under review following the DUAA. Its plans for new and updated guidance page lists which documents are being revised and when.
“Anyone acting under your authority”
Article 32(4) applies to anyone acting under your authority who has access to personal data. That includes:
- permanent and part-time employees
- temporary and agency staff
- contractors working under your direction
- volunteers
Contract type and hours worked make no difference. If someone can access personal data you are responsible for, they need to know how to handle it.
Who needs training
All staff
Everyone who handles personal data needs some training. The depth and frequency can vary by role. A typical structure is:
- induction training covering data protection basics and your own policies, completed before the person is given access to personal data
- refresher training at a set interval; many organisations choose once a year, and the ICO’s small-business advice gives yearly formal training plus reminders as an example
- additional training when someone changes role, when a new system or type of processing is introduced, or when the law changes, as it did in 2026
Our article on refresher training covers how to set and justify a refresher interval.
Part-time, temporary and agency staff
These groups are often missed because they join outside the normal recruitment cycle. To cover them:
- include data protection training in every onboarding route, whatever the contract type
- make sure your HR or rota system flags every new starter for training
- use short online modules that can be completed around shift patterns
- track completion for all staff types in the same place
Contractors and volunteers
Where possible, give contractors and volunteers the same core training as employees, adjusted to their role. As a minimum:
- set out data protection obligations in contracts or volunteer agreements
- give clear written instructions on how they should handle personal data
- get a signed acknowledgement that they understand their responsibilities
- tell them who to contact with questions and how to report a possible breach
Where a contractor is a separate organisation acting as your processor, its own staff training is its responsibility, but you should check it as part of your due diligence and set it out in the processing contract.
Role-specific training
Some roles need more detailed training because of the type or volume of personal data they handle. A training matrix is a practical way to map roles to the training each one needs.
Data protection officers
DPOs, and anyone in an equivalent lead role, need specialist knowledge of:
- UK GDPR, the Data Protection Act 2018 and PECR as amended by the DUAA
- ICO guidance and enforcement trends
- data protection impact assessments
- international data transfers
- privacy risks from new technology, including AI
Under Article 39 of UK GDPR, the DPO’s tasks include advising staff and overseeing awareness-raising and training. The DPO needs to keep their own knowledge current to do this.
HR and IT staff
HR teams handle sensitive employee data and need training on:
- special category data, such as health information, and criminal records data
- subject access requests from employees and former employees
- retention and deletion of employee records
- confidentiality in disciplinary and grievance matters
IT staff control security infrastructure and need training on:
- information security measures
- detecting and responding to breaches
- access controls and audit logging
- secure data disposal
Marketing teams (including PECR)
Marketing teams need to understand:
- consent requirements for electronic marketing, and when the soft opt-in applies
- PECR rules on calls, emails and texts
- when legitimate interests can be relied on
- the DUAA exemptions that allow some low-risk cookies, such as certain analytics cookies, to be set without consent
This matters more since 5 February 2026. For breaches on or after that date, PECR fines are no longer capped at £500,000 and can reach the UK GDPR maximum of £17.5 million or 4% of global annual turnover, whichever is higher.
Records management and customer-facing teams
Staff who manage records or deal directly with the public need training on:
- retention schedules and secure disposal
- recognising a subject access request or other rights request, however it is worded
- recognising a data protection complaint and passing it to the right person
- Freedom of Information requests, where applicable
What training should cover
Data protection basics
The UK GDPR principles (Article 5):
- lawfulness, fairness and transparency
- purpose limitation
- data minimisation
- accuracy
- storage limitation
- integrity and confidentiality
- accountability
What counts as personal data: staff should be able to recognise personal data in all its forms, including names and addresses, IP addresses, device identifiers, location data and any information that could identify someone when combined with other data.
Individuals’ rights:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- rights related to automated decision-making, including the right to challenge a significant decision and obtain human review
- the right to complain to your organisation about how their data is used (in force since 19 June 2026)
DUAA changes to add to existing training
If your training was written before 2026, check that it reflects these changes:
- Subject access requests. You only need to carry out a reasonable and proportionate search (in force since 19 June 2025). Since 5 February 2026 there is a statutory “stop the clock” rule: if you reasonably need more information from the requester, such as proof of identity or details to locate the data, the one-month response period pauses until you receive it.
- Complaints. Since 19 June 2026 organisations must make it easy for people to complain about how their data is used, for example with a complaint form that can be completed electronically. Complaints must be acknowledged within 30 days, dealt with without undue delay, and the person told the outcome. Front-line staff need to recognise a complaint and know where to send it. Our guide to the complaints procedure sets out what is required.
- Recognised legitimate interests. A new lawful basis covers a fixed list of purposes, such as crime prevention, safeguarding and responding to emergencies, without the usual balancing test.
- Automated decision-making. Significant decisions based solely on automated processing are permitted in wider circumstances than before, provided safeguards are in place. Staff who use or oversee these systems need to know what those safeguards are.
- Cookies and PECR. Since 5 February 2026, three new exceptions allow cookies and similar technologies to be used without consent:
- Statistical (analytics) cookies, where the information is collected only to improve the website or service and is used only by its operator. Sharing the data with a third party, such as an advertising platform, takes the cookie outside the exception.
- Appearance and functionality cookies, which adapt how a site looks or works to the user’s choices, such as language, display or accessibility settings.
- Emergency assistance, where a device’s location is identified so that emergency help can be provided.
Your own policies and procedures
Training should link the legal requirements to the way your organisation works.
Privacy notices:
- what you tell customers and staff about how you use their data
- how to direct people to that information
- who to tell if a new use of data means the notice needs updating
Security procedures:
- password and multi-factor authentication policies
- recognising phishing emails
- checking recipients before sending emails, letters or attachments
- clean desk rules and secure remote working
Breach response:
- how to recognise a possible personal data breach
- who to report it to internally, and how quickly
- that reportable breaches must be notified to the ICO within 72 hours of the organisation becoming aware of them, which is why internal reporting needs to be immediate
- how to contain a breach and limit the harm
Role-specific topics
Subject access requests: who can receive them, the one-month time limit and when it can be extended or paused, what must be provided, and the available exemptions.
Data sharing: when sharing is permitted, which lawful basis applies, how to share securely, and when a data sharing agreement is needed.
Information security: encryption, access controls, physical security and incident response.
Personal data breaches: what counts as a breach, how to assess risk, when to notify the ICO and the people affected, and how to record the decision.
Does training have to be a course?
The ICO does not require a particular format. What it looks for is training that is relevant to the role, kept up to date, and can be evidenced.
Format options
Structured courses, online or in person, are useful because they:
- give everyone the same content
- allow you to test understanding
- make completion easy to record
- can be updated in one place when the law changes
The ICO’s framework also expects awareness to be raised between formal training sessions. Methods include:
- email bulletins on specific issues
- posters and screensavers
- short team briefings
- quick reference guides
- simulated phishing exercises
Most organisations combine a formal course with these smaller reminders through the year. Our staff training checklist sets out a practical routine.
Evidence and documentation
Why records matter
Under the accountability principle you need to be able to show that training happened. Good records also help you:
- find gaps in coverage
- plan refresher training
- show the steps you had taken if a breach occurs
- respond to ICO enquiries or an audit
What to record
Training materials: keep a copy of each version of the course content, presentations and handouts, with the date it was in use.
Who completed training: record every individual, with their role and department.
When: record dates for induction and every refresher, and when the next one is due.
Assessment results: if you test knowledge, keep scores and a note of follow-up for anyone who did not pass.
Overdue training: record who is overdue, who has been told, and what action was taken.
Review these records regularly. Completion figures are only useful if someone acts on them, which was a central point in the ICO’s 2026 action against the Metropolitan Police described below.
What happens when training is missing
Higher breach risk
Untrained staff are more likely to:
- send data to the wrong recipient
- open phishing emails or attachments
- publish or disclose data that should have been removed or redacted
- access records they have no work reason to see
- fail to recognise and report a breach in time
ICO enforcement cases involving training
The ICO assesses whether an organisation had appropriate technical and organisational measures in place. Training is one of those measures, and gaps in training regularly appear in its enforcement decisions. Three examples:
Metropolitan Police Service (August 2026). On 5 August 2026 the ICO issued the Metropolitan Police with an enforcement notice and a reprimand after two disclosures in sensitive cases. In one, a stalking victim’s new contact details were sent to the defendant. In the other, a bulk email exposed the names and email addresses of people connected to an investigation. The ICO found that the officer who sent the email had not completed data protection training for more than four years, and their line manager had not done so for almost four years. The enforcement notice requires the force to improve training completion, monitoring and governance. Our analysis of the Metropolitan Police case covers what employers can learn from it.
London Borough of Hammersmith and Fulham (May 2025). On 21 May 2025 the ICO reprimanded the council after a Freedom of Information response published in October 2021 left the personal information of 6,528 people, including 2,342 children, exposed for almost two years. The ICO’s recommendations included reviewing and updating the council’s online training and guidance, and its head of investigations said all staff should be trained regularly.
Interserve Group (October 2022). The ICO fined the construction and outsourcing company £4.4 million after a 2020 cyber attack compromised the personal data of up to 113,000 current and former employees. The attack began with a phishing email. The ICO found that Interserve lacked adequate staff training, and that one of the two employees who received the email had not completed the data protection training required by the company’s own policy.
Training as a mitigating factor
When deciding whether to take action and how severe it should be, the ICO considers the measures an organisation had in place and the steps it took after an incident. Up-to-date training records help show that a breach was an individual error despite reasonable measures, rather than the result of a systemic gap. In the Hammersmith and Fulham case, the ICO noted the staff training the council had carried out after the breach when deciding its response.
Summary
UK data protection law does not set a training schedule, but the accountability principle and the security requirements in UK GDPR mean you need to train anyone who handles personal data on your behalf and be able to show that you have. The ICO expects induction training before people access personal data, regular refreshers, extra training for higher-risk roles, and records that are monitored and acted on.
Practical steps for 2026:
- Provide induction training before new starters, including temporary staff and volunteers, are given access to personal data.
- Set and document a refresher interval, and follow up anyone who is overdue.
- Update training content for the DUAA changes, particularly subject access timing, complaints handling and the cookie exemptions.
- Add role-specific training for HR, IT, marketing, customer-facing staff and anyone handling sensitive data.
- Keep records of who completed what training and when, and review them regularly.
- Support formal training with regular awareness activity during the year.
If you have not reviewed your training programme since the DUAA changes came into force, start by listing who has access to personal data, what training each person has completed, and whether the content reflects the law as it stands in 2026. Measured Collective offers data protection training courses that can help you meet these obligations.
