Step Nine Train Your Employees

Many companies create internal training programs and include privacy training as a required annual employee certification. Building an interactive, 20- or 30-minute class that presents the topics and tests the employee’s understanding is a simple way to communicate the same message across the entire company. Either way, a trained employee is more likely to keep your data subjects’ personal information secure.

Employee training shouldn’t be a one-time event. It should occur at least annually and optimally, once every 6 months.

Employee awareness training should generally cover the following areas:

• Applicable privacy laws and regulations: A general overview of the laws and regulations that govern the handling of personal data, like the GDPR or the CCPA 2.0.
• Personal data processing: Covers information about the types of personal data that may be collected and handled by the organization, like personal identification information, sensitive personal data, or financial data.
• Company data protection values: Relating foundational privacy principles to your company’s core values and culture.
• Data security: The measures your Security organization takes to protect personal and organizational data from internal and external threats.
• Incident response: Procedures and protocols to follow in the event of a data security incident, like a data breach or unauthorized access to personal data.
• DSR handling: The process for handling and responding to privacy requests and the responsibilities of designated approvers.
• Employee responsibilities: General employee responsibilities for handling personal data like maintaining confidentiality, reporting suspicious activity, and following security protocols.
• Privacy by design and by default: Covers the Privacy by Design concepts of privacy integration into product innovation, business development, and partnership decisions. Can be paired with an overview of privacy engineering and enhancement technologies for technical teams.
• Up-to-date information: Covers the need to keep employees informed of any changes to the company’s privacy policies and procedures, and new developments in privacy laws and regulations.