GDPR training for staff: what UK law and the ICO expect

Data protection training is the one most businesses assume is "a GDPR requirement". The law is less direct than that, but the ICO's expectations are specific. This is what the UK GDPR and the ICO say, quoted from legislation.gov.uk and ico.org.uk on 19 October 2026. The ICO notes these pages are under review after the Data (Use and Access) Act. It is a summary, not legal advice.

Key takeaways

• No stand-alone "train all staff" article, but the UK GDPR's security duties make it the expected route.
• Induction before access: the ICO expects training before staff handle personal information.
• Refresher at appropriate intervals; no fixed number.
• A knowledge check with a minimum pass mark, says the ICO.
• Everyone, including senior managers, temporary and contract staff.

What the UK GDPR says

Article 32(4) says the controller and processor "shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller". Where you have a data protection officer, article 39 lists among their tasks monitoring compliance, "including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations". The ICO's guide to data security says: "You should provide appropriate initial and refresher training".

What the ICO expects at induction

The ICO's audit toolkit on induction training warns that "allowing staff to begin working with personal information before undergoing induction training, greatly increases the risk of a personal data breach. This may breach UK GDPR articles 5(1)(f) and 32." Its expectations include:

• "Ensure staff have completed the induction training before being permitted to process personal information."
• "Require all grades, including senior managers, to complete induction training."
• "Deliver induction training to all staff including voluntary, temporary and contract staff."
• Cover "handling requests, data sharing, information security, personal data breaches and records management".

Refresher training and proof

On refresher training, the toolkit says to "Require staff complete refresher training at appropriate intervals" and "Document when staff last received refresher training by keeping complete and up-to-date records." Both pages also say: "Assess staff understanding of the training using a knowledge check with a minimum pass mark."

So the evidence an auditor looks for is simple: who completed which module, when, and whether they passed.

Turn your data protection slides into a course

Reigniter turns your existing data protection deck into a short interactive module: a voiceover, your slides and a question at each step, such as "a customer emails asking for their data: what do you do?", with branching for wrong answers. Your first module is free and shared by link. On paid plans, learners sign in, you set a pass mark, and you see each person's result and certificate, which is the record the ICO describes; see training without an LMS.

For fire safety, display screens, manual handling, COSHH and induction, see what training UK law requires.