GDPR training for employees: is it mandatory and what must it cover

No article of the General Data Protection Regulation (GDPR) says “train your employees”. But several articles together require measures that are hard to meet and prove without training. The controller is responsible for compliance with the data processing principles and must be able to demonstrate it (Article 5(2) GDPR). It implements appropriate organisational measures to be able to demonstrate that processing is performed in accordance with the Regulation (Article 24(1) GDPR). It must also take steps to ensure that employees process data only on its instructions (Article 32(4) GDPR). In our view, training is the clearest, but not the only, way to meet these duties and show that they are met.

Since 2 February 2025 the Artificial Intelligence (AI) Act adds to this (Article 4 and Article 113, point (a), of the AI Act). Until July 2026 it required organisations to ensure staff AI literacy; now it requires measures to support it. Below: what the law actually says, what follows from it for the content of training, and what is at stake when an employee makes a mistake and the organisation cannot show what measures it took.

Which GDPR duties make staff training necessary

Accountability. Complying with the principles is not enough. The controller must be able to demonstrate compliance (Article 5(2) GDPR). It chooses its measures by reference to the nature, scope, context and purposes of the processing and the risks to people’s rights. Those measures are reviewed and updated where necessary (Article 24(1) GDPR). The GDPR mentions training expressly in only two places. Binding corporate rules must provide for appropriate data protection training for personnel with permanent or regular access to personal data (Article 47(2)(n) GDPR). And a data protection officer monitors staff training (Article 39(1)(b) GDPR).

Employees act on instructions. Any person acting under the authority of the controller who has access to personal data may process it only on the controller’s instructions, unless the law requires otherwise (Article 29 GDPR). The controller and the processor must take steps to ensure this (Article 32(4) GDPR). In our view, an instruction the employee does not know about does not discharge this duty.

Processors. If you process data on someone else’s behalf, the contract with the controller must provide that you ensure that the persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). The security duty applies to the processor directly (Article 32(1) GDPR).

Data protection officer. If a data protection officer (DPO) has been designated, they inform the employees who carry out processing of their obligations and advise them (Article 39(1)(a) GDPR). They also monitor compliance, including awareness-raising and training of staff (Article 39(1)(b) GDPR). The DPO monitors training, but the duty to implement measures stays with the controller (Article 24(1) GDPR). When a DPO is mandatory is covered in our article Do we need a data protection officer?.

What the AI Act requires now

Regulation (EU) 2024/1689 (the AI Act) calls a “deployer” any person or organisation using an AI system under its authority, except in a personal non-professional activity (Article 3(4) of the AI Act). This includes a company whose employees use AI tools at work on its behalf or with its permission.

Since 27 July 2026 a new wording of Article 4 of the AI Act applies, introduced by Regulation (EU) 2026/1744 (Article 1, point 5). Under it, providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The measures take into account these people’s technical knowledge, experience, education and training, the context the systems are to be used in, and the people on whom they are to be used. No specific level of AI literacy has to be guaranteed (Article 4(1) of the AI Act).

The recital of the amending regulation states that the previous wording imposed an obligation to ensure AI literacy of staff, and that a strict obligation to ensure a sufficient level did not suit everyone and created an additional burden, particularly for smaller enterprises (Recital 8 of Regulation (EU) 2026/1744). The Commission and the Member States must support providers and deployers, in particular small and medium-sized enterprises (SMEs), and the Commission publishes practical examples (Article 4(2) of the AI Act). The duty itself has applied since 2 February 2025 (Article 113, point (a), of the AI Act).

So the duty remains, but its content has changed: the regulation requires action, not a result.

What training must cover: what follows from the law

The GDPR does not set a training syllabus. But from what employees do every day one can derive what they cannot afford not to know. What follows is not a list from the law, but a conclusion drawn from it.

• Principles. Data is processed lawfully, fairly and transparently, only for specified purposes, only as much as needed, accurately, no longer than necessary and securely (Article 5(1) GDPR).
• Legal basis. Processing is lawful only if at least one of the conditions in Article 6(1) GDPR applies. Processing health data, biometric data used to uniquely identify a person, and other special category data is prohibited unless an exception applies (Article 9(1) and (2) GDPR). Employees must know that “I need it” is not a legal basis.
• People’s rights. A person may ask for access to their data, rectification, erasure and the other rights (Articles 15–22 GDPR). The answer to such a request is given without undue delay and in any event within one month of receipt. Where necessary, the period may be extended by two further months, with the person told within the first month (Article 12(3) GDPR). Because the period runs from receipt, an employee who receives a request must know whom to pass it to.
• Recognising a breach. A breach is not only a hack. It also covers accidental loss, alteration or unauthorised disclosure of data (Article 4(12) GDPR). A breach is notified to the State Data Protection Inspectorate (VDAI) without undue delay and, where feasible, within 72 hours of the controller becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33(1) GDPR). All breaches, including those not notified, are documented (Article 33(5) GDPR). When people must also be told is covered in our article Personal data breach: when to notify VDAI and people.
• Security and internal rules. Who may see which data, how to send it, where to keep it, what to do when a device is lost (Article 32(1) and (4) GDPR). What Article 32 requires is described in our article GDPR security measures.
• AI tools. If they are used: which personal data must not be uploaded (Article 5(1) and Article 32(4) GDPR), and what risks and harm AI can cause, so that staff assess the output critically (Article 3(56) and Article 4(1) of the AI Act).

The scope depends on the risk. An employee who handles patients’ or children’s data needs more than one who only sees colleagues’ names (Article 24(1) and Article 32(1) GDPR).

What can happen when employees are not trained

The first risk is a breach nobody recognised. An employee sends a file to the wrong recipient or loses a laptop and tells no one. The 72-hour period for notifying VDAI runs from when the controller becomes aware of the breach. If notification comes later, the reasons for the delay must be given (Article 33(1) GDPR). An employee’s silence does not protect the controller. Once the breach comes to light, VDAI assesses the measures taken under Article 32 (Article 83(2)(d) GDPR), and a breach that was not documented, or not notified when notification was required, is itself an infringement of Article 33 (Article 83(4)(a) GDPR).

The second risk is measures that cannot be proven. When deciding on a fine, VDAI takes into account whether the infringement was intentional or negligent (Article 83(2)(b) GDPR) and the controller’s degree of responsibility, assessed against the measures it implemented under Articles 25 and 32 (Article 83(2)(d) GDPR). In our view, an organisation that cannot show it gave its employees instructions will struggle to prove the measures it implemented under Article 32 (Article 24(1) and Article 32(4) GDPR).

Infringing the controller’s and processor’s obligations under Articles 25 to 39, including the security and breach notification duties, can lead to a fine of up to ten million euros or, for an undertaking, up to two per cent of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) GDPR). If the principles themselves are infringed, the caps double: up to twenty million euros or up to four per cent of turnover (Article 83(5)(a) GDPR).

For public authorities and bodies, the Lithuanian Law on the Legal Protection of Personal Data (ADTAĮ) sets lower caps. For infringements of Article 83(4)(a)–(c) GDPR: up to half a per cent of the budget and other income, but no more than thirty thousand euros (Article 33(1) of ADTAĮ). For infringements of the principles and other provisions in Article 83(5): up to one per cent, but no more than sixty thousand euros (Article 33(2) of ADTAĮ). These caps do not apply to a body that carries out commercial economic activity; the general GDPR fines apply instead (Article 33(3) of ADTAĮ). More in our article GDPR fines for state and municipal institutions.

The third risk is damages. Any person who has suffered material or non-material damage as a result of an infringement has the right to compensation from the controller or processor (Article 82(1) GDPR). The fact that an employee made the mistake does not in itself relieve the controller. It is exempt from liability only if it proves that it is not in any way responsible for the event giving rise to the damage (Article 82(3) GDPR). And it was the controller that had to take steps to ensure the employee processed data only on instructions (Article 32(4) GDPR). Without such steps, proving that it is not in any way responsible will be hard.

When to call a lawyer

• when an employee has sent, published or lost personal data and you must decide within 72 hours whether to notify VDAI;
• when VDAI asks you to show what organisational measures you have taken;
• when employees handle health, children’s or other sensitive data and there are no written instructions;
• when the organisation starts using AI tools and you need to decide what to do under Article 4 of the AI Act;
• when a client or partner requires you, under a contract, to prove staff training or confidentiality commitments.