Last reviewed 5 November 2026 against the sources linked in this post.
Data protection training for employees works best when it matches the job, and analysts handle more personal data than most. The European Data Protection Board reports that national authorities issued EUR 1.15 billion in fines in 2025, which shows how seriously regulators in Europe treat the way organisations handle personal data. The risks in an analyst's week are everyday ones: exporting a table to a spreadsheet, or pasting a slice of it into an AI assistant.
This is a list of 9 ready-made courses for heads of data and BI managers who set the rules for their teams. They cover classification, personal data, sharing data with AI tools and the security habits that protect the warehouse. Each entry says what the course covers, why an analyst needs it and what the room does in the session. Each group ends with an Our pick. After the list comes a rollout order and a way to run the courses on AhaSlides.
All 9 courses at a glance
| Course | What it covers | Length | Legal duty on the organisation? |
|---|---|---|---|
| Data classification & handling | Deciding what may leave a warehouse or dashboard | 25 min | No duty cited here |
| Handling personal data day to day | Consent, minimisation, retention and sharing | 40 min | No duty cited here |
| Your data and AI tools | What you can and cannot paste into AI tools | 30 min | No duty cited here |
| Secure use of generative AI | Data leaks, shadow AI and AI-enabled attacks | 35 min | No duty cited here |
| AI security for everyone | Shadow AI, prompt injection and manipulated outputs | 30 min | No duty cited here |
| Security awareness essentials | Baseline habits for people with broad access | 35 min | No duty cited here |
| Phishing & social engineering | Spotting and reporting phishing | 30 min | No duty cited here |
| Passwords, passkeys and multi-factor authentication | Strong sign-in for data tools | 30 min | No duty cited here |
| Social engineering, fraud and deepfakes | Fake requests by phone, payment and impersonation | 35 min | No duty cited here |
Data classification and personal data
Data classification & handling
Analysts need classification rules to decide what may leave a warehouse, a dashboard or a shared drive. This course covers how to label data and what each label allows. In the session, run a Pick Answer quiz with five sample columns, such as a postcode, a job title and a payroll number, and ask the room which label each one gets. The disagreements show where your own rules are vague.
Handling personal data day to day
This course applies consent, minimisation, retention and sharing rules to everyday data work. The European Commission describes data minimisation as the principle that an organisation must collect and process only the personal data that is necessary for its purpose, which is a habit analysts can practise on every query. In the session, show a request for "all customer fields" and use a Word Cloud to ask which fields the analysis needs.
Our pick: Handling personal data day to day. Minimising a dataset is a skill analysts use daily, and the Word Cloud exercise makes the habit visible in minutes.
AI and data sharing
Your data and AI tools
This course sets clear lines for what an analyst may paste into an AI tool, and what stays out whatever the tool promises. In the session, give the room four snippets, including a table of names and a query with no personal data, and run a Pick Answer poll: paste, mask or never? Compare the votes with your acceptable-use policy and fix whichever side is wrong.
Secure use of generative AI
This course covers data leaks and shadow AI when analysts use generative tools on datasets, including attacks that use AI against the analyst. It matters because the quickest tool is often one nobody has approved. In the session, ask an Open Ended question: "Which AI tool have you used for work that IT has not approved?" Anonymous answers tell you what people use.
AI security for everyone
Prompt injection and manipulated outputs can corrupt an analysis or expose data when an analyst uses an AI assistant on documents from outside the company. This course covers shadow AI, prompt injection and how to check an AI answer. In the session, show a poisoned document and ask on a Rating Scale how likely the room would have caught it.
Our pick: Your data and AI tools. It turns a vague policy into four concrete yes-or-no calls an analyst makes every week.
Security basics and fraud
Security awareness essentials
Anyone with broad access to data is a high-value account, so the baseline habits matter more for analysts than for most roles. The course covers the everyday security behaviours every employee should have. In the session, run a short quiz on a realistic day: a USB stick in the car park, a shared password, a laptop left at a cafe.
Phishing & social engineering
Analysts with warehouse access are prime phishing targets, because one stolen login can open many tables. This course teaches how to spot and report phishing and social engineering. In the session, show three emails and run a Pick Answer poll on which one is fake, then discuss how each could land in an analyst's inbox.
Passwords, passkeys and multi-factor authentication
Strong authentication protects the datasets and BI tools analysts use every day. The course covers passwords, passkeys and multi-factor authentication for staff. In the session, ask the room on a Rating Scale how confident they are that their data tools use multi-factor sign-in, and list the tools that score lowest.
Social engineering, fraud and deepfakes
Fake requests for data exports and payments are common impersonation scams, and a convincing voice or message is now easy to fake. This course covers phone, payment and impersonation scams and the habit of verifying on a second channel. In the session, play a short scenario of a "director" asking for an urgent export and poll the room on whether they would send it.
Our pick: Passwords, passkeys and multi-factor authentication. One control protects every tool on the list, and the Rating Scale exercise gives you a tool-by-tool gap list.
How to roll the plan out
Start with the data basics: classification and day-to-day personal data handling, plus any onboarding your organisation already requires. Then add the AI courses, because that is where new habits are forming fastest. Finish with the security refreshers each year, and add your own country or state rules where your teams work.
Anchor each session to the same fact. National data protection authorities issued EUR 1.15 billion in fines in 2025, according to the EDPB. The Commission's page on the GDPR principles lists seven principles, including lawfulness, purpose limitation, data minimisation and storage limitation among the rules organisations follow, so keep a dated record of who completed which course and the questions raised.
If your team also covers data protection for the whole company, the data protection officer course list goes deeper on GDPR and CCPA duties. Analysts who write code will find more in the post on security training for developers, and the guide to AI training for employees covers the wider AI rollout.
Ways to run these courses on AhaSlides
You can offer all 9 in three formats:
- Self-paced courses. Use the AhaSlides course creator to assign each analyst a course to complete.
- A live Q&A deck. Collect questions about real datasets ahead of the session, then answer them in the room.
- Pre and post surveys. Measure what changed in the same session.
Four slide types do most of the work:
- Pick Answer. Ask: "A colleague asks for a customer export for a quick test. Share, mask or decline?" Show the split before you reveal the answer.
- Word Cloud. Ask: "Which fields does this analysis need?" The biggest words show what people reach for first.
- Rating Scale. Ask, before and after: "How confident are you about what you can paste into an AI tool?" Rate from 1 to 5 and compare the averages.
- Open Ended. Ask: "Where could this dataset leak without anyone noticing?" Answers can be anonymous, so people say what they think.
FAQ
What training do data analysts need?
Beyond technical skills, analysts need data privacy, classification and secure handling training. The 9 courses above are grouped that way, with AI tool use as its own group.
Can data analysts use AI tools on company data?
Only within your organisation's policy, and never on personal or confidential data in tools nobody has approved. This post cites no law on the point, so your acceptable-use policy and your data protection lead decide.
What is data minimisation?
It means using only the personal data needed for a defined purpose. The European Commission puts it as collecting and processing only the personal data that is necessary to fulfil that purpose.
Who owns data in a company?
There is no single rule, so check your own governance policy. A common set-up is that a data owner is accountable for how a dataset is used and protected, while analysts and stewards work with it.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
