Is GDPR training for staff mandatory, and how do we run and document it?

Three reasons, and none of them is "because everyone does it":

1. Instructions must be known. Article 29 and Article 32(4) GDPR: staff process data only on the controller's instructions. An instruction nobody knows about does not work.
2. The employer's duty to train. Article 29(1) of the Labour Code: the employer must train an employee to the extent needed for their job. In our view, if someone handles customer data every day, data protection rules are part of their job.
3. Customers ask. If you process another business's data on its behalf, its questionnaire may ask "are your staff trained?". "Yes, 2026-03-10, 14 attendees" is evidence; "yes" without a date is not.

Also, breaches in a small company are often human error: an email to the wrong recipient, a reply to a phishing email, documents left on a desk.

1. Group people by what they do with data

One presentation for everyone is dull and of little use. Two or three groups are enough:

2. Pick 5–7 topics, not 30

For a small company, these fill an hour:

1. What personal data is – with your examples: customer list, invoices, camera footage, HR files.
2. Where data sits in your company – systems, folders, paper.
3. Four mistakes to watch for – wrong recipient, CC instead of BCC, a file sent via private email, an unlocked computer.
4. Phishing emails – how to spot them and whom to tell.
5. A breach: what to do in the first hour – whom to call. The key message: report at once, even if the mistake is your own.
6. A person's request about their data – whom to pass it to, because the reply is due without undue delay, normally within one month (extendable by two months for complex requests).
7. Whom to ask – the name and contact of the person in your company.

3. Choose the format

• Live or online, 45–60 min – best for the annual session, because people can ask questions.
• A recording + a short quiz – suits new hires between annual sessions.
• A one-page reminder – not training, but a good extra next to the screen or on the intranet.

4. Document it

Keep in one folder:

• date and length;
• attendee list – signed, or the attendance report of the video call;
• materials – the slides or reminder you showed;
• quiz results, if there was a quiz;
• who delivered it – an internal employee or an external trainer.

That shows the training happened, who attended and what it covered. The accountability principle in Article 5(2) GDPR requires you to be able to show what you do, not only to do it.

5. Repeat

• Every new employee – within the first month.
• Everyone once a year – shorter, with new examples.
• After a breach – a short debrief with those concerned, without looking for someone to blame.

If you process other companies' data on their behalf, Article 28(3)(b) GDPR requires the people authorised to process the data to have committed to confidentiality or to be under an appropriate statutory obligation of confidentiality. Have the undertaking signed on hiring, before access to data is granted – not later, when training takes place.

First know where your data is and which processes are risky – the training content depends on it. With the tool (in Lithuanian) you can find out free of charge, in a few questions, whether you must keep a record of processing activities and which processes need more attention. If you want lawyers to run the training, dat.lt does that (link below).

Is GDPR training mandatory?
The GDPR does not set it as a separate duty. But you must take steps to ensure staff process data only on instructions (Article 32(4)) and be able to prove it (Article 24(1)). Training is the usual way.

Can the manager deliver the training?
Yes. The law sets no trainer qualification. What matters is that the content is correct and relevant to your company.

How long should the training be?
There is no set length. For a small company, 45–60 minutes a year is usually enough if the topics fit people's roles.

Do staff need a certificate?
No. An attendee list, the date and the materials are enough.

• We sent data to the wrong person – do we have to report it? (in Lithuanian)
• Who in the company may see employee data? (in Lithuanian)
• Technical and organisational security measures: a description for a small company

The law and the risk: Data protection training for organisations – dat.lt

• Staff process data only on the controller's instructions – Article 29 GDPR; Article 32(4) GDPR.
• Duty to demonstrate compliance – Article 24(1) GDPR; accountability principle – Article 5(2).
• Confidentiality undertaking of a processor's staff – Article 28(3)(b) GDPR.
• The employer's duty to train an employee as needed for the job – Article 29(1) of the Labour Code.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). Labour Code – e-tar.lt consolidated version from 2026-06-07; English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.