Step Nine Train Your Employees

Communicating your privacy policy and compliance information to customers (i.e., data subjects) is one pillar of a holistic socialization strategy. Another key pillar is educating your employees on the policy early and often. Help them be part of the solution instead of inadvertently introducing risks due to a lack of awareness.

Many companies create internal training programs and include privacy training as a required annual employee certification. Building an interactive, 20- or 30-minute class that presents the topics and tests the employee’s understanding is a simple way to communicate the same message across the entire company. Either way, a trained employee is more likely to keep your data subjects’ personal information secure.

Employee training shouldn’t be a one-time event. It should occur at least annually and optimally, once every 6 months.

Employee awareness training should generally cover the following areas:

• Applicable privacy laws and regulations: A general overview of the laws and regulations that govern the handling of personal data, like the GDPR or the CCPA 2.0.
• Personal data processing: Covers information about the types of personal data that may be collected and handled by the organization, like personal identification information, sensitive personal data, or financial data.
• Company data protection values: Relating foundational privacy principles to your company’s core values and culture.
• Data security: The measures your Security organization takes to protect personal and organizational data from internal and external threats.
• Incident response: Procedures and protocols to follow in the event of a data security incident, like a data breach or unauthorized access to personal data.
• DSR handling: The process for handling and responding to privacy requests and the responsibilities of designated approvers.
• Employee responsibilities: General employee responsibilities for handling personal data like maintaining confidentiality, reporting suspicious activity, and following security protocols.
• Privacy by design and by default: Covers the Privacy by Design concepts of privacy integration into product innovation, business development, and partnership decisions. Can be paired with an overview of privacy engineering and enhancement technologies for technical teams.
• Up-to-date information: Covers the need to keep employees informed of any changes to the company’s privacy policies and procedures, and new developments in privacy laws and regulations.

Bottom Line:

Train new and existing employees. Update your entire organization on current privacy issues and your company’s data practices. DataGrail is here to help if you wish to outsource your privacy training.

How to Get Started

Refer to our knowledge base to train your team on DataGrail’s capabilities.

Request a demo to learn more about platform training and partnering with us to provide privacy awareness training to your teams.

We can also refer you to trusted awareness training content providers.

Connect with other pros (free) to talk about your privacy training needs and experiences. Join the Privacy Basecamp Community.