Data Protection (GDPR)
free online training on the General Data Protection Regulation — in English, with certificate
👥 Target group: All employees in Germany who handle customer, supplier or personnel data and prefer to learn in English — office, sales, service, HR, accounting, International teams and English-speaking staff of German companies, before the first processing of personal data
Which legal duty or standard requirement does this training cover?
About this training
If you record customer data, read job applications, run payroll or simply write e-mails at work, you process personal data — and you are right in the middle of the General Data Protection Regulation (GDPR). Art. 32(4) GDPR requires that employees process personal data only on instructions; Art. 39(1)(b) explicitly names awareness-raising and training of employees as a task in data protection. Most data breaches do not happen in IT, but at the workplace: an e-mail to the wrong recipient, an unlocked screen, a file left in the canteen.
This online training is the English-language edition of our German data protection training. It is written for employees who work in Germany but do not read German: the law that applies is still the GDPR and the German Federal Data Protection Act (BDSG), explained in plain English. It covers the general part: where the GDPR applies, what personal and specially protected data is, the principles of Art. 5, the legal bases of Art. 6 and Section 26 BDSG, the rights of data subjects with the one-month time limit, the roles of controller, processor and data protection officer, technical and organisational measures, how to handle data breaches and the 72-hour time limit, phishing and home office, liability and fines — and a worked case study. 15 modules, 20 questions, certificate of participation with a verifiable number and the complete list of topics.
Was dieser Kurs leistet — und was nicht: The course provides the general, legal part of the data protection training, with proof of content, date and result. It does not provide the company-specific part — who the data protection officer or contact person is, how the reporting path for a data breach works, which password, clean desk and home office rules and deletion periods apply, only your company knows; that is what the module "Procedure in our company" is for. It replaces neither the confidentiality obligation nor the record of processing activities, no privacy policy and no legal advice in an individual case. Social data protection (SGB), patient data protection and sector-specific rules are not covered. The course explains German and EU law in English; it does not cover the data protection law of other countries.
Contents at a glance
- What this course is about — and what it is notScope: general part of the data protection training — does not replace the company's own data protection rules or the advice of the data protection officer
- The legal framework in one place — GDPR and BDSGLegal framework: GDPR (applicable since 25 May 2018), material and territorial scope under Art. 2 and 3, BDSG as the German supplementary law
- Personal data and processingPersonal data under Art. 4(1) GDPR: direct and indirect identifiability; definition of processing under Art. 4(2)
- Special categories of personal dataSpecial categories under Art. 9 GDPR: health, religion, trade union, origin, political opinion, sex life, genetic and biometric data — processing prohibited in principle
- The principles of processingPrinciples under Art. 5 GDPR: lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability (paragraph 2)
- Legal bases — when processing is allowedLegal bases under Art. 6(1) GDPR: consent, contract, legal obligation, legitimate interest; employee data under Section 26 BDSG
- The rights of data subjectsData subject rights under Art. 12 to 22 GDPR: information, access, rectification, erasure, restriction, data portability, objection — time limit of one month
- Roles — controller, processor, data protection officerRoles and responsibilities: controller (Art. 24), processor with contract (Art. 28), data protection officer (Art. 37–39, Section 38 BDSG from 20 persons), duties of managers and employees
- Technical and organisational measures (TOMs)Security of processing under Art. 32 GDPR: technical and organisational measures — access protection, passwords, screen lock, encryption, clean desk, key and visitor rules
- Data breaches — recognise, report, documentPersonal data breach (Art. 4(12)): notification to the supervisory authority within 72 hours (Art. 33), communication to the data subjects (Art. 34), internal reporting path and documentation
- Data protection in everyday work — e-mail, phishing, home office, mobile devicesData protection in everyday work: e-mail and misdirected messages, phishing and social engineering, home office, mobile devices, telephone and visitors
- Liability and finesLiability and sanctions: fines of up to 20 million euros or 4 % of worldwide annual turnover (Art. 83), compensation (Art. 82), criminal offences under Section 42 BDSG, consequences under employment law
- Case study: the salary list goes to the wrong recipientCase study misdirected e-mail: decision path for a data breach — report immediately, limit the damage, document, 72-hour time limit (Art. 33), communication (Art. 34)
- Procedure in our companyProcedure in our company: data protection officer and contact person, reporting path for data breaches, password, clean desk and home office rules, handling of data subject requests, deletion periods
- Proof of trainingProof of training: accountability under Art. 5(2), documented training as part of the TOMs, repetition every year and when new employees are hired, retention of the training record
Frequently asked questions
Is the course really free?
Yes. No registration, no payment details, no trial period. You only enter your e-mail address so that the certificate can be delivered.
Does the course fulfil the training duty under the GDPR?
It fulfils the general part and documents it with a certificate. The company-specific part — data protection officer, reporting path for data breaches, password and deletion rules — must be added and documented by the company; as a fixed-price customisation we fill in the module "Procedure in our company" for your company.
Which law does the course explain?
German and EU law — the GDPR and the German Federal Data Protection Act (BDSG). The course is for employees who work in Germany but do not read German. It is the English-language edition of our German data protection training and has the same content and the same certificate.
How often must data protection training be repeated?
The GDPR sets no fixed interval, but under Art. 5(2) it requires proof of effective measures. Supervisory authorities and certification bodies expect regular training — in practice every year — and an initial training before the first processing when a new employee is hired.
What is on the certificate?
Name, course, date, result, the complete list of the 15 training topics, the legal basis with a note on the company-specific part, and a certificate number that can be verified on the verification page of the Academy — without showing the e-mail address.
Do we need a data protection officer?
Under Section 38 BDSG, if as a rule at least 20 persons are permanently engaged in automated processing of personal data — and regardless of that number for particularly risky processing. The course explains the rule; it does not check it for your company.