The GDPR does not prescribe a training format. No frequency, no minimum length, no test.
That sounds like freedom, and in practice it produces the opposite. Because nothing is specified, almost every organisation ends up with the same answer: one annual off-the-shelf course for everyone, thirty minutes, multiple choice at the end, completion logged in the LMS. Whether that is the right answer for you depends on four questions. Work through them in order and the shape of your training more or less designs itself.
Who handles what
The first branch decides whether you are building one course or several.
If most of your workforce touches personal data only at the edges, meaning email, calendars and the occasional customer address, one shared foundation module is enough. It explains what personal data is, what counts as a breach and who to call when something goes wrong. That group needs nothing more, and would not retain more if you gave it to them.
If certain teams work with sensitive data every day, those teams need a module of their own. Four groups come up again and again:
- HR and line managers, who deal with applications, sick notes and performance reviews
- Sales and marketing, where consent, objections and mailing lists are daily business
- IT and system administration, where access rights, logs and retention periods are actually enforced
- Customer service, who decide on the phone whether a caller is entitled to information
For context: the GDPR lists awareness-raising and training of staff among the tasks of the data protection officer (Art. 39(1)(b) GDPR). How deep each group needs to go is a question for that person, not for a blog post.
Generic content or your own case
The second branch is about content, and both directions have a legitimate case.
If your processing looks like what happens in any organisation of your size, a ready-made course from a library is a sensible choice. It is carefully worded, quick to assign and costs almost no internal effort. For a foundation module that should surprise nobody, that is often enough.
If the mistakes in your organisation happen in your own systems, though, a generic course helps very little. The CRM with the free-text field. The shared spreadsheet of applicant data. The ticketing tool where customers type in their bank details. A generic course talks about principles, and your people fail at specific screens. Only a quarter of learners finish a classic mandatory course at all (Continu, 2025). That does not prove people don't care about data protection. It shows they abandon content that is visibly not about their job.
The middle route has become the obvious one: generic content as the frame, adapted to your systems, your terminology and the three mistakes your privacy team sees most often. It is less work than it sounds, provided the tool is built for it.
How often things change
A caveat belongs here. There is no reliable figure for how often privacy training actually needs revising. Annual repetition is a convention, not a rule. It caught on because it fits neatly into audit calendars, and that may well be the whole reason.
What can be said with confidence is this: your training does not go out of date because the GDPR changes. It goes out of date because your organisation does. A new HR system, a new processor, a breach you learned something from. Each of these makes a section wrong, and nobody has the job of noticing.
That gives you the third branch. If your system landscape is stable and you train in one language, one update a year is manageable with any tool. If you operate across sites and languages and add more than one new system a year, the effort per change determines the state of your training. A single changed line cannot mean re-shooting a video, re-commissioning five translations and re-uploading a package to the LMS. What that costs across languages is covered in the post on multilingual training videos.
What the evidence has to show
The fourth branch is the one projects argue about most, usually too late.
If your goal is documentation alone, proof that training took place, an attendance record in the LMS will do. There is nothing wrong with that. The accountability principle in Art. 5(2) GDPR requires you to be able to demonstrate compliance, and a clean attendance record is part of it.
If you want to know whether the training works, you need more than a tick. You need questions tied to your own situations rather than definitions. "An applicant calls and asks you to delete her documents. What do you do?" tells you more than "What is processing?". And you need results per question, so you can see where the course did not land.
Technically that means a quiz inside the course and a SCORM or xAPI export, so the LMS records the results. Both are standard. Without them, the question of impact stays open.
Once the branches are set
Organisations that have answered the four questions usually land in one of three places. A small organisation with stable systems does well with a library course and should save itself the effort. A mid-sized organisation with two or three sensitive areas needs a foundation module plus deeper modules, ideally from one source so a change is not made in four places. And an organisation with several sites, languages and a steady flow of new systems needs, above all, a production route where an update takes hours rather than weeks.
That third case is what Omnora's AI Learning Factory is built for. You start from a standard training and adapt it to your systems with a short prompt, or your data protection officer describes the typical failure cases in an AI-guided interview, around 30 minutes of her time. Course, quiz and SCORM package come out of one process, in 140+ languages for voice-over and subtitles. For a single mandatory training, time to market is under 24 hours; that is an experience value, not a promise. How the costs of these routes break down is set out in what a training video costs, and why three separate tools usually end up more expensive than one in the post on best of breed in the L&D stack.
Before you commission any of it, call your privacy team with a single request. "Tell me the three mistakes you saw most often last year."
Are they in your current training?
