Data Protection Training (GDPR) for Employees

15 modules · about 53 minutes · final test with 20 questions, 14 correct to pass · certificate of participation as PDF

What this course is about

If you record customer data, read job applications, run payroll or simply write e-mails at work, you process personal data — and you are right in the middle of the General Data Protection Regulation (GDPR). Art. 32(4) GDPR requires that employees process personal data only on instructions; Art.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 15

What this course is about — and what it is not

If you handle names, addresses, e-mails, salaries or sick notes at work, you process personal data — at your desk, on the phone, in the warehouse, in your home office. The General Data Protection Regulation (GDPR, in German: Datenschutz-Grundverordnung, DS-GVO) therefore applies not only to the IT department. It applies to every person who works with such data. Art. 32(4) GDPR requires that employees process personal data only on instructions. Art. 39(1)(b) GDPR names awareness-raising and training of employees as an explicit task in data protection. This course is that training.

This course is written in English for employees who work in Germany. The law that applies is still German and EU law: the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

What you will learn: where the GDPR applies, what personal data is, which data is specially protected, which principles govern processing, which rights data subjects have, who has which role, which protective measures matter in your daily work, how to recognise and report a data breach, what happens in case of violations — and how to decide in an emergency.

What this course provides: the general, legal part of the data protection training, with proof of content, date and result.

What it does not provide: the rules of your own company. Who your data protection officer (Datenschutzbeauftragter) or contact person is, how your reporting path for a breach works, which password rule and which deletion periods apply — only your company knows this. That is what the module "Procedure in our company" is for. The course also does not replace a privacy policy, a record of processing activities or legal advice in an individual case.

Remember

Data protection is not a job for "IT" or "the data protection officer". Most data breaches happen at the workplace: an e-mail to the wrong recipient, an unlocked screen, a file left in the canteen. That is exactly where this course starts.

Module 2 of 15

The legal framework in one place — GDPR and BDSG

Two sets of rules work together. If you have seen them once in context, you will understand the rest of the course faster.

Where the GDPR applies — material scope (Art. 2)

The GDPR applies to every processing that is wholly or partly automated — so everywhere a computer, a smartphone or a server is involved. It also applies without a computer, as soon as personal data is stored, or is meant to be stored, in a filing system: a folder, a card index, a structured archive. Not covered are loose, unsorted notes without a system — and purely private, family activities (Art. 2(2)(c)), such as your own address book at home.

Where the GDPR applies — territorial scope (Art. 3)

• The controller or processor has an establishment in the EU — then the GDPR applies, no matter where the data is actually processed.
• The controller is based outside the EU but offers goods or services to people in the EU, or monitors their behaviour — then the GDPR applies as well (market location principle).

Examples:

Remember

What counts is not citizenship ("EU citizen"), but whether the person is in the Union or the controller is established here. And: paper is not free of data protection — the personnel file in the cabinet falls under the GDPR just like the file on the server.

Module 3 of 15

Personal data and processing

Data protection is about personal data (personenbezogene Daten). Under Art. 4(1) GDPR this means all information relating to an identified or identifiable natural person. What counts is not whether the information is "secret" or "private". What counts is whether you can recognise a human being from it — directly or indirectly.

Examples: first name and surname, date of birth, age, address, e-mail address, telephone number, bank details, personnel number, social security number, ID card number, licence plate, IP address, location data, photos, voice, fingerprint, order history, hair and eye colour. A photo of a person is personal data — the person can be recognised on it. The work e-mail address firstname.lastname@company.de is also personal data — the person is clearly identifiable.

Indirect identification: "The blonde woman from HR" — if only one blonde woman works there, this is personal data, even without a name. The same applies to pseudonyms (personnel number, customer number) as long as a key exists somewhere that leads back to the person (Art. 4(5)). Only truly anonymous data, where nobody can identify the person any more, falls outside the GDPR. Data of legal entities (the company Müller GmbH as such) is not protected — but the data of its contact persons is.

What "processing" means (Art. 4(2))

Practically every handling of personal data is processing: collecting, recording, organising, storing, adapting, retrieving, consulting, using, transmitting, matching, restricting, erasing, destroying.

Remember

Even looking at data is processing. If you open a file that is none of your business, you process data without instructions — and that is already a violation, even if nothing "happens".

Module 4 of 15

Special categories of personal data

Some data can do particular harm to a person if it gets into the wrong hands. It can lead to discrimination, exclusion or persecution. Art. 9(1) GDPR therefore places such data under a general prohibition of processing (Verarbeitungsverbot). Processing is allowed only under the narrow exceptions of Art. 9(2) — for example with explicit consent, or when employment and social law require it (Section 26(3) BDSG, e.g. the sick note for continued payment of wages).

The special categories under Art. 9(1):

• racial or ethnic origin
• political opinions (e.g. membership of a party)
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data for the purpose of unique identification (fingerprint scan, facial recognition)
• health data (diagnoses, sick days, severe disability, pregnancy)
• data concerning sex life or sexual orientation

So the social security number (Sozialversicherungsnummer) is not an Art. 9 category — but it is a sensitive identifier that must still be protected carefully. The other way round: a simple passport photo is not automatically biometric data. It becomes biometric in the sense of Art. 9 only when a technical procedure extracts a feature from it for unique identification.

For your daily work

Sick days, medical certificates, disability cards, religion in the payroll (church tax): this data belongs only to the people who need it for their task — not in the team chat, not in the open filing tray, not in a conversation in the corridor.

Module 5 of 15

The principles of processing

Art. 5 GDPR is the compass. Every processing in the company must measure up to these seven principles — and the supervisory authorities check exactly along this list.

What this means for you

You do not decide on legal bases and deletion periods — but you put the principles into practice every day. If you "just quickly" use data for another purpose, if you ask for more than necessary, or if you keep old records out of convenience, you violate Art. 5, even without bad intent.

Remember

Purpose, amount, duration. Why do I need this data? Do I really need all of it? How long may I keep it? If you ask these three questions, you have understood Art. 5.

Module 6 of 15

Legal bases — when processing is allowed

Data protection works as a prohibition with a reservation of permission: personal data may be processed only if one of the legal bases listed in Art. 6(1) GDPR applies. There are six of them — points a to f.

Consent — the weakest basis

Consent must be freely given, informed, unambiguous and given for the specific purpose (Art. 7). It can be withdrawn at any time — and withdrawing must be as easy as giving it. That is why consent is often the wrong choice in a company: what is necessary to perform a contract does not need consent; and whoever relies on consent must be able to live with the withdrawal.

Employee data — Section 26 BDSG

For the data of employees, the national rule of Section 26 BDSG applies alongside Art. 6(1)(b): processing is permitted if it is necessary for establishing, carrying out or terminating the employment relationship — payroll, time recording, holiday planning, proof of qualifications. Consent from employees is only voluntary if they face no disadvantage (Section 26(2)); it is therefore the exception, not the rule.

For your daily work

You do not have to determine the legal basis yourself — the controller does that and records it in the record of processing activities. But you must know: no basis, no processing. If you want to use customer data for a new purpose, ask before — not after.

Module 7 of 15

The rights of data subjects

The GDPR gives every person whose data is processed enforceable rights. A customer, an applicant, a colleague can exercise them — by e-mail, letter, telephone, also informally. And the request does not land with the data protection officer. It lands with the person who picks up the phone.

The time limit: one month

Art. 12(3) GDPR: requests must be answered without undue delay, at the latest within one month of receipt. For complex or numerous requests, the period can be extended by two further months — then the person must be informed within the first month. The information is free of charge (Art. 12(5)). If you miss the deadline, you risk a complaint to the supervisory authority (Art. 77) and a fine.

What you do when a request lands with you

1. Do not answer it yourself — and do not give out data on the phone before the identity is confirmed.
2. Note the date of receipt. The one-month period runs from receipt, not from forwarding.
3. Pass it on immediately to the responsible person (data protection officer, management, named contact — module "Procedure in our company").

Remember

A data subject request is not a complaint and not an attack. It is a right. The mistake is almost never in the answer — it is that the request sits in a mailbox for three weeks.

Module 8 of 15

Roles — controller, processor, data protection officer

Four terms sort out who is responsible for what in data protection.

Example: Müller GmbH hires a payroll office for its salary accounting. The controller is Müller GmbH, the processor is the payroll office, the data subjects are the employees. Under Art. 28(3) a written data processing agreement is required for this — without it, passing on the data is unlawful. The controller remains responsible for everything the service provider does (Art. 24).

More examples: A print shop that prints and posts your customer mailing with the addresses you supply is a processor. The applicants whose CVs you receive are data subjects — your company is the controller for their data, even though the applicants sent the data themselves.

The data protection officer (DPO)

Under Section 38(1) BDSG a company must designate a data protection officer (Datenschutzbeauftragter, DSB) if, as a rule, at least 20 persons are permanently engaged in the automated processing of personal data — regardless of this number, if particularly risky processing takes place (Art. 37 GDPR, Section 38 BDSG). The DPO informs and advises, monitors compliance and is the contact point for employees, data subjects and the supervisory authority (Art. 39). The DPO is free from instructions in this task and must not be penalised for performing it (Art. 38(3)). The DPO does not decide — and is not liable in place of the management.

Tasks in the company

• Management: sets the rules, provides the resources, carries the organisational responsibility (Art. 24).
• Managers: implement the rules in the team, check, instruct, support the DPO.
• Employees: process only on instructions (Art. 29, Art. 32(4)), follow internal and legal rules, report data breaches and violations immediately to their manager or the DPO.

Remember

The company is responsible, not the DPO. The DPO advises and checks — the DPO is your contact when you are unsure, not the person to point at when something goes wrong.

Module 9 of 15

Technical and organisational measures (TOMs)

TOM stands for technical and organisational measures (technische und organisatorische Maßnahmen). Art. 32 GDPR obliges controllers and processors to ensure a level of protection appropriate to the risk — and explicitly names pseudonymisation and encryption, the confidentiality, integrity, availability and resilience of systems, the ability to restore data after an incident (backup), and regular testing of effectiveness.

What is in your hands

Most TOMs only work if you apply them:

• Lock your screen as soon as you leave your desk — even "just for a moment", even if only colleagues are in the room. Not every colleague may see everything.
• Passwords: long, unique for each service, never shared, not on a note at the monitor, not in the team chat. A password manager is allowed and welcome if the company has approved it.
• Clean desk: lock away personnel documents, customer lists and printouts in the evening; do not use the printer as a filing tray.
• Storage media and paper with personal data do not go in the normal waste — use the shredder or the data protection bin.
• Use access rights as they were granted: what you could see, you may not automatically look at (Art. 32(4)).
• No private devices, cloud services or messengers for company data, unless the company has explicitly approved them.

Remember

The most expensive firewall does not help if the personnel file lies open in the meeting room. Ask yourself at every workplace: Where are our TOMs written down, which ones concern me — and am I following them today?

Module 10 of 15

Data breaches — recognise, report, document

A data breach — the GDPR calls it a "personal data breach" (Verletzung des Schutzes personenbezogener Daten, Art. 4(12)) — occurs when personal data has been disclosed, altered, destroyed or lost without authorisation, or when unauthorised persons had access. Intent does not matter. Most breaches are accidents.

Typical cases:

• a mailing to all customers, with the addresses in the "To" field instead of "BCC"
• an e-mail with a salary list or an offer goes to the wrong recipient
• personnel files are left in the canteen and are read
• a laptop or smartphone with customer data is stolen, a USB stick is lost
• ransomware encrypts the server — loss of availability is also a breach
• in the online shop, a visitor sees the data of the customer who was logged in before
• the IT department accidentally deletes all customers from the CRM without a backup

The time limits

The 72 hours run from the moment the company becomes aware — not from the moment the DPO hears about it. If you keep a breach to yourself for three days, you have already used up the company's time limit. Whether a notification is required is not decided by the person who made the mistake, but by the controller after assessing the risk.

What you do — in this order

1. Report immediately — to the data protection officer or your manager, on the same day, even if you are not sure whether it is "really" a breach.
2. Limit the damage where possible: ask the wrong recipient to delete, have the device blocked, change access credentials.
3. Write down what happened: what, when, which data, how many people, who was informed.
4. Do not cover it up, do not "repair" it yourself, do not call the data subjects on your own initiative — the controller coordinates that.

Remember

A reported breach is a case to handle. A concealed breach is a second violation — and it becomes more expensive than the first one (Art. 83(4)).

Module 11 of 15

Data protection in everyday work — e-mail, phishing, home office, mobile devices

The rules are written in Art. 5 and Art. 32 — the violations happen in your inbox, on your phone and at the kitchen table in your home office. Six situations that affect almost everyone.

E-mail

• Check the recipient before you send — autocomplete likes to suggest the wrong "Müller". A misdirected e-mail with personal data is a data breach (Art. 4(12)).
• Put mailing lists in "BCC", never in "To" or "CC", if the recipients do not need to know each other.
• Encrypt attachments with sensitive data or send them via an approved file exchange; send the password by a separate route.
• Do not forward work e-mails to private mailboxes.

Phishing and social engineering

Attackers do not need technology if a human opens the door. Typical: an e-mail "from the management" urgently demands a salary list or a bank transfer; "the IT department" asks for your password; a link leads to a login page that looks like the real one. Warning signs: time pressure, secrecy, unusual channel, sender address that does not match, spelling mistakes, link target that does not match the text. The right reaction is always: do not click, do not send anything, check back through a known channel (telephone number from the directory, not from the e-mail) and report the message to IT or the DPO. No serious person ever asks for your password.

Home office and mobile work

• Only company devices or explicitly approved devices; use the VPN.
• Position the screen so that flatmates and visitors cannot read along; lock the screen at home too.
• Avoid printouts; if necessary, keep them locked away and shred them at the company, not in the household waste.
• Do not hold confidential phone calls on the train, in a café or in an open-plan office.

Mobile devices and storage media

Laptop, smartphone, USB stick: encrypted, with a lock code, never unattended in the car or on the train. Report a loss immediately — an encrypted device is a documented breach, an unencrypted one is a breach that must be notified.

Telephone and visitors

Do not give information about customers or colleagues to strangers on the phone — not even "just the extension" or "whether he is off sick today". Visitors are accompanied; screens, whiteboards and printouts in the meeting room are cleared beforehand.

Remember

The three seconds before you click "Send" are the cheapest data protection measure there is. Recipient, attachment, BCC.

Module 12 of 15

Liability and fines

Data protection violations have consequences — for the company and for the person who caused them.

Fines (Art. 83)

The supervisory authorities can impose fines at two levels:

In each case the higher amount applies. The amount depends on the nature, gravity and duration of the violation, intent or negligence, cooperation with the authority, and whether the violation was reported by the company itself (Art. 83(2)). In addition, the authority can ban processing (Art. 58(2)).

Compensation (Art. 82)

Every person who suffers damage because of a violation has a right to compensation — material and non-material. Non-material damage means: even the loss of control over one's own data, worry about misuse or exposure can give rise to compensation. The claim is against the controller, and in some cases also against the processor.

Who is liable in the company?

• The company as controller bears the fine and the compensation. The management is responsible for the organisation: rules, resources, checks, training (Art. 24).
• The data protection officer advises and monitors — the DPO is not liable in place of the management (Art. 38, 39).
• Employees are liable in their immediate area of responsibility: violations of instructions can lead to a written warning and dismissal; in case of gross negligence or intent, a share in the damage is possible. Whoever processes personal data without authorisation in order to enrich themselves or to harm someone commits a criminal offence under Section 42(2) BDSG — up to two years' imprisonment; commercially passing on the data of a large number of people without authorisation carries up to three years (Section 42(1) BDSG).

Remember

The company pays the millions. The person who took the personnel file home or told the "colleague from IT" their password loses their job. Both can be avoided — by doing what this course says.

Module 13 of 15

Case study: the salary list goes to the wrong recipient

The situation: Friday, 4:40 pm. Ms K. from the HR department sends the monthly salary list as an Excel attachment to the payroll office. Autocomplete has inserted info@mueller-elektrotechnik.de — a customer — instead of lohn@steuerberater-mueller.de. The list contains names, gross salaries, tax classes, religious affiliation (church tax) and, for two persons, the note "sick pay supplement". Ms K. notices the mistake at 4:55 pm.

The decision path

1. Is this a data breach? Yes. Personal data was disclosed to an unauthorised party (Art. 4(12)). The fact that it was an accident, and that the recipient is a respectable customer, changes nothing. The fact that the list contains Art. 9 data (religion, health) increases the risk.

2. What does Ms K. do immediately — and what not?

3. Who decides on the notification to the supervisory authority? The controller — in practice the management together with the DPO. The 72-hour time limit (Art. 33) runs from Friday 4:55 pm, so until Monday 4:55 pm. The weekend counts. Here a notification is very likely required: salary, religion and health data mean a risk for the data subjects; the recipient's confirmation of deletion can lower the risk, but does not remove the need to assess it.

4. Must the employees be informed? Under Art. 34, in case of a likely high risk — well arguable here, because salary and health data are affected and the recipient knows some of the colleagues personally. The controller takes the decision; the information is given in a coordinated way, not by Ms K. in the corridor.

5. Documentation. The incident is recorded in the breach register under Art. 33(5) — even if, in the end, no notification had been necessary. And it is evaluated: check autocomplete for external addresses, make encryption mandatory for the salary list.

What decided the case

Not the mistake — that happens to everyone. What decided it was the reaction at 4:55 pm: report instead of Monday. Had Ms K. waited over the weekend, 64 of the 72 hours would have been used up before the controller even knew that a decision had to be taken.

Module 14 of 15

Procedure in our company

Your company fills in this module. The general part of this training ends here — what follows now, only your company knows.

This information belongs here:

For the management

The reporting path for data breaches is the most important item on this list — and the one that most often remains unclear. The 72-hour time limit under Art. 33 GDPR runs from the moment the company becomes aware. Whoever does not know whom to call on Friday evening uses up the weekend — not out of carelessness, but because nobody told them.

Module 15 of 15

Proof of training

Finally, what turns this training into proof.

Why proof at all: Art. 5(2) GDPR obliges the controller to be able to demonstrate compliance with the principles; Art. 24 requires proof of appropriate measures. Training employees is such a measure — organisational, part of the TOMs — and Art. 39 explicitly names awareness-raising and training. A supervisory authority that investigates after a data breach asks first: Were the employees trained? Show me.

Repetition: The GDPR sets no fixed interval. Supervisory authorities and certification bodies expect regular training — in practice every year, and also before the first processing when a new employee is hired, when someone changes job, after a data breach in the company and when the rules change.

Who takes part: everyone who handles personal data — so practically all employees, including managers, trainees, temporary staff and agency workers; for external service providers, the contract under Art. 28 regulates this.

Documentation: Your certificate of participation shows name, course, date, result, the complete list of topics and a certificate number that can be verified on the verification page of the Academy. Keep it and give a copy to the person who keeps the data protection records in your company — usually the DPO or the HR department.

What must be documented in addition: the confidentiality obligation (Verpflichtung auf Vertraulichkeit, usually signed when hired) and the company-specific part from the module "Procedure in our company". Only both together — general part with certificate, company part with signature — form the training record that an authority or an auditor wants to see.

Remember

Proof that nobody can find is no proof. File the certificate, note the date, repeat next year — and train new colleagues before their first working day with customer data, not after.

Final test

20 questions, one correct answer each. You need 14 correct answers to pass (70 %). Scoring happens on the server — there is no answer key on this page.

Your result