01
ICO Accountability Framework — adequate, regular, refreshed staff training is a documented control
Loading...
We deliver mandatory UK GDPR, EU GDPR, and broader data privacy training across your workforce — Data Protection Act 2018, ICO guidance, lawful basis, data subject rights, and breach response. Managed rollout, audit-ready evidence accepted by the ICO, EU supervisors, and customer due-diligence reviewers. Live for your team in under a week.
The UK GDPR (incorporating the EU GDPR into UK law via the Data Protection Act 2018) and the EU GDPR both make data protection accountability a controller obligation. The ICO's Accountability Framework explicitly lists 'adequate, regular and refreshed' staff training as a documented control. ICO investigations and EU supervisory authority decisions consistently cite inadequate training as an aggravating factor. Customer audits, ISO 27001 certifications, SOC 2 reviews, and procurement due-diligence reviews all require evidence of staff training.
ICO Accountability Framework — adequate, regular, refreshed staff training is a documented control
UK GDPR / DPA 2018 — controllers must demonstrate compliance under Article 5(2) accountability
EU GDPR Article 39(1)(b) — DPO is responsible for staff training; supervisors expect documented evidence
Customer audits, ISO 27001 (A.6.3), and SOC 2 reviews routinely require training evidence
Different roles face different risks. Training tailored to job responsibilities.
A 60-min working session with a specialist. We map your obligations, current training gaps, and regulator priorities in your jurisdiction.
Your processes, contacts, and policies go into the modules. We brand the LMS, wire SSO, and connect HRIS so enrolment is automatic.
Roll out to all staff. Automated nudges hit non-completers. Manager dashboards in real time. Audit-ready records when regulators ask.
Ready to scope your programme?
Book a 30-min discovery call — no slides, no pitch, just specifics.
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Dated certificates per learner, exportable completion logs, and role-mapped curriculum records that meet ICO Accountability Framework expectations and EU supervisor documentation requirements.
Track completion across teams, jurisdictions, and entities. Export evidence packages for ICO investigations, EU supervisor queries, and customer due-diligence.
SAML 2.0, OIDC, and SCIM provisioning. New joiners enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Multi-year licensing rolls learners forward each year with content updates as the ICO, EDPB, and member-state supervisors release guidance and the UK Data Protection and Digital Information Bill progresses.
Your logo on certificates, co-branded learner emails, and the option to attach your privacy policy, ROPA, breach response procedure, or DSAR handling playbook to any module.
We have UK and EU operations and our DPO needed evidence of consistent training across both. The single rollout covered UK GDPR for our London office and EU GDPR for our Munich and Paris teams — same dashboard, jurisdiction-aware reports, ICO-ready and BfDI-ready in one package.
Don't see your question? Send us a note — we usually reply same day.
Ask a questionTell us your jurisdictions (UK, EU, multi-jurisdiction), your sector, and your headcount. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.