GDPR for Employees Course (EU): Lessons 2026

Lesson 1: What personal data is

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679. It entered into force on 24 May 2016 and has applied since 25 May 2018. As one law for the whole EU, it reduces the differences between national systems. It also applies across the European Economic Area (EEA).

What counts as personal data

Personal data is any information that relates to an identified or identifiable living person. The GDPR calls this person the data subject. A person is identifiable if they can be recognised directly or indirectly, for example from a name, an ID number, location data or an online identifier. Information that identifies someone only when it is combined with other data still counts.

Pseudonymised data is data where names are replaced by codes, and the key that links codes to people is kept separately. It is still personal data, because the key can be used to re-identify people. Encrypted data is also still personal data. Data is only outside the GDPR when it is anonymised so that no one can be identified, and this cannot be reversed.

Special categories (sensitive data)

Article 9 lists special categories of personal data that need extra protection. Processing them is generally prohibited unless a specific condition applies:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data, and biometric data used to uniquely identify a person
• Data concerning health
• Data about a person's sex life or sexual orientation

Data about criminal convictions and offences also has strict rules. It is generally handled only by official authorities or where national law allows it.

What "processing" means

Processing means any operation on personal data, whether on a computer or on paper: collecting, recording, organising, storing, changing, looking up (consulting), using, sharing, combining, restricting, erasing or destroying it. Even just opening a record to read it is processing.

Who is who

As an employee you act under the authority of the controller. Article 29 says you may process personal data only on your employer's instructions.

The GDPR does not apply to a purely personal or household activity, such as your own address book of friends at home. Data you handle at work is not covered by this exception.

EU rules, national rules and authorities

The GDPR applies directly in every EU country, but some details are set nationally. For example, the recitals say national law or collective agreements, including works agreements, may set more specific rules on processing employees' data. Each EEA country also has its own independent data protection authority (DPA). It handles complaints, investigates, and can issue warnings, reprimands, orders and fines. The European Data Protection Board (EDPB) brings these authorities together and publishes guidance.

Prueba temática 1: What personal data is

Lesson 2: The data protection principles

Article 5 of the GDPR sets out the principles that all processing must follow. Article 5(1) lists six, and Article 5(2) adds accountability. Many people call them the seven principles.

Putting the principles into practice

• Storage limitation needs retention periods and a deletion procedure. When data is no longer needed, it should be deleted or anonymised. "We might need it one day" is not a reason to keep it.
• Integrity and confidentiality is supported by technical measures such as encryption and pseudonymisation (named in Article 32), and by organisational measures such as access rules and training.
• Accountability includes keeping a record of processing activities. It does not have to be public, but the data protection authority can ask to see it.
• Purpose limitation matters when someone wants to reuse data. Ask: is the new use compatible with the reason we collected it?

Prueba temática 2: The data protection principles

Lesson 3: Lawful bases and consent

Under Article 6, processing is lawful only if at least one of six lawful bases applies. Each basis has its own conditions, and the basis chosen affects which rights people can use.

The contract basis covers only what is truly necessary for the contract. For example, using a customer's past purchases to recommend new books is not necessary to sell a book; it needs consent or possibly legitimate interests. Legitimate interests requires a balancing test: weigh the organisation's interest against people's rights and what they can reasonably expect.

What makes consent valid

Consent must be freely given, specific, informed and unambiguous, shown by a statement or a clear positive action, such as ticking an empty box. The recitals say silence, pre-ticked boxes and inactivity are not consent. People can withdraw consent at any time, and withdrawing must be as easy as giving it. Consent covers only the purposes the person agreed to.

Consent at work: because of the imbalance of power, employees may feel unable to say no to their employer. The EDPB says consent is therefore usually not the right basis for an employer's processing of staff data. Employers normally rely on other bases, such as contract or legal obligation.

Children online: for online services offered directly to children, a child can consent alone from 16. Each EU country may set a lower age by law, but not below 13, so check the national rule.

Special category data needs two things

To process special category data, such as health data, an organisation needs an Article 6 lawful basis and also an Article 9 condition. Article 9 conditions include explicit consent, obligations in employment and social security law, vital interests when the person cannot consent, legal claims, substantial public interest, and preventive or occupational medicine.

Prueba temática 3: Lawful bases and consent

Lesson 4: Data subject rights

The GDPR gives people rights over their data. Not every right applies in every situation, but all requests must be taken seriously.

Rights are not absolute. For example, erasure can be refused in limited cases, such as when the law requires the data to be kept or it is needed for legal claims.

Time limits, fees and identity

• The organisation must respond without undue delay and within one month of receiving the request.
• For complex or numerous requests, it can extend by two further months, but it must tell the person, with reasons, within the first month.
• Responses are normally free of charge. A reasonable fee is possible for extra copies. A reasonable fee, or a refusal, is possible only when a request is manifestly unfounded or excessive.
• If there are reasonable doubts about identity, the organisation may ask for more information, for example when a request comes from an unusual email address.
• If it refuses, it must give reasons and tell the person they can complain to a data protection authority and seek a remedy in court.

Your part as an employee

The one-month clock starts when the organisation receives the request, for example at the service desk or a general contact address, not when it reaches the right team. A request does not need a special form or the word "GDPR". If someone asks you about their data, pass the request at once to the right person under your procedure. Do not ignore it, and do not search systems and send data yourself unless that is your job.

Some organisations must appoint a data protection officer (DPO): public authorities, and organisations that monitor people regularly and systematically on a large scale or process sensitive or criminal data on a large scale. The DPO can be an employee or an outside person, acts independently and reports to top management.

Prueba temática 4: Data subject rights

Lesson 5: Everyday safeguards at work

Everyday habits protect personal data as much as technology does. Most of these safeguards come from EDPB guidance; your employer's own policy sets the exact rules.

Use data only for your job

• Use personal data only for the tasks your employer has instructed you to do (Article 29).
• Never look up records out of curiosity, for example a famous customer or a neighbour. Looking at data is processing, and it is not part of your job.
• Access should be on a need-to-know basis: you can open only the data your role needs.
• Everyone should have their own account. Do not share your login or password, and do not write passwords down where others can see them.
• Before you share data with another team, check that they need it and send only what is needed.

Desk, screen and paper

• Lock your screen whenever you leave your desk. Automatic lock-out is a backup, not a replacement.
• Keep a clean desk: lock paper files with personal data in a drawer or cabinet, and lock offices when they are empty.
• Paper counts too. Printouts, copies and notebooks need the same care as computer files.

Email and sharing

• Check every recipient before you press send. Autocomplete can choose the wrong person with a similar name.
• When you email a group of external people, put their addresses in BCC so they cannot see each other's addresses.
• Check attachments before sending: is it the right file, and does it hold only the data the recipient needs?
• Use only the tools your organisation has approved. Do not send work data through free personal chat apps or personal email or cloud accounts.

Devices and remote work

• Use strong authentication: two different kinds of proof, such as a password (something you know) plus a smart card badge or phone (something you have), or a fingerprint (something you are).
• Laptops and USB sticks with personal data should be encrypted, so the data is unreadable if they are lost or stolen.
• Save work files on the organisation's regularly backed-up network storage, not on your computer's desktop.
• At home, use the VPN and approved tools your employer provides.
• If you use your own phone for work, follow the device rules: your employer remains responsible for the company data on it.

Visitors

Visitors should be accompanied outside public areas, and their arrival and departure should be recorded. Do not lend your badge.

Prueba temática 5: Everyday safeguards at work

Lesson 6: Personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)). It does not have to be deliberate. Not every security incident is a personal data breach: if no personal data is affected, it is not one.

What you must do

If you think a breach may have happened, report it internally straight away, following your organisation's procedure: usually to your manager, the data protection officer or a named incident contact. Do not wait until you are sure, do not try to hide or fix it quietly, and do not contact the affected people yourself unless you are told to. Write down what happened and when.

What the controller must do

• Document every breach: the facts, the effects and the action taken, even if it is not notified.
• Notify the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people. A late notification must explain the delay. If not all the facts are known, it can notify in phases.
• Tell the affected people without undue delay if the breach is likely to result in a high risk to them, in clear and plain language.
• People do not need to be told if the data was protected, for example by strong encryption with the key kept safe, so it is unintelligible.
• A processor must tell the controller without undue delay when it becomes aware of a breach.

Breaches involving special category data, such as health data, usually carry a higher risk.

Sanctions

Data protection authorities can issue warnings and reprimands, order changes, stop processing and impose fines. For the most serious infringements, fines can reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher. Other infringements can lead to fines of up to €10 million or 2%. For example, for a company with a turnover of €2 billion, 4% is €80 million, which is higher than €20 million, so the top limit is €80 million.

Prueba temática 6: Personal data breaches