European UnionRequired by lawRegulation (EU) 2016/679 (GDPR)

EU: GDPR essentials

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 8 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
35 min
Lessons
7 lessons
Frequency
At induction + annually
Last reviewed
12 Oct 2026
Case practice
What would you do?

Madrid consultant Lucía leaves an unencrypted laptop with client files on a train

Try it: this is one of 15 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 7 lessons, about 35 minutes
  • 2 video slots (you add the videos)
  • Tabs, flashcards, scenario, accordion and quizzes
  • 12-question final check, 80% to pass

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 9 slides
  • Quiz, poll, word cloud, open-ended slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 1.0Achieve ≥ 80% on the final assessment-Whole course
LO 90.1.1Explain the GDPR's purpose, reach and enforcement by supervisory authoritiesArts. 1, 3, 51, 83Lesson 1: Why the GDPR exists
LO 90.2.1Identify personal data, special categories and pseudonymised dataArts. 4(1), 4(5), 9Lesson 2: What's covered
LO 90.3.1Apply the principles, lawful bases and privacy by design to daily workArts. 5, 6, 25Lesson 3: Allowed vs not allowed
LO 90.4.1Recognise and route data subject requests within one month + your infoArts. 12-22Lesson 4: Rights & deadlines
LO 90.5.1Report a personal data breach immediately so the 72-hour deadline can be met + your infoArts. 33-34Lesson 5: Case practice
LO 90.6.1Escalate to the DPO and know rules for international transfers + your infoArts. 37-39, 44-49Lesson 6: Escalate correctly

Your part: what a template can't do for you

  • Language: deliver it in a language and vocabulary your people understand.
  • Your workplace details: fill in the 8 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

7 lessons, about 35 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

Why the GDPR exists

3 pages

8 min
Before you beginNoteList
A fundamental rightKey factTextVideo
Who's whoTabsQuiz
2

What's covered

2 pages

5 min
Personal dataFlashcards
Seven principles & six lawful basesAccordionTabsNoteMulti-select quiz
3

Allowed vs not allowed

2 pages

5 min
Sort itSorting activity
Privacy by designChecklistQuiz
4

Rights & deadlines

2 pages

5 min
Data subject rightsFlashcardsTable
CheckQuiz
5

Case practice

2 pages

5 min
Lost laptopScenario
The ex-employee's requestScenarioQuiz
6

Escalate correctly

1 page

2 min
Who to tellProcessYour infoYour infoTableYour infoYour infoQuiz
7

Final assessment

Assessment

5 min
Final check12 questions80% to passCompletion page

Live deck and surveys

9 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

TitleTitle
PollWhich country are you based in?
QuizIs pseudonymised data still personal data?
QuizDeadline to answer an access request?
Content · customiseOur DPO and breach channel
QuizBest lawful basis for payroll?
Word cloudWhich tools do you use to share files?
Open-endedWhat GDPR rule slows you down most?
Q&AQ&A, then closing
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. Which of these would you report to the DPO straight away? multiple choice
  6. How clear is our retention schedule for the data you handle? 1-5 scale
  7. Which topics do you want more guidance on? ranking
  8. Privacy is treated as part of how we design our work, not an afterthought. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find our DPO and breach reporting channel? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

8 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • DPO contact{{DPO_CONTACT}}
  • Breach reporting channel{{BREACH_REPORTING_CHANNEL}}
  • Lead supervisory authority{{LEAD_SUPERVISORY_AUTHORITY}}
  • Transfer tool policy{{TRANSFER_TOOL_POLICY}}
  • Retention schedule link{{RETENTION_SCHEDULE_LINK}}
  • Approved tools{{APPROVED_TOOLS}}
Show all 8 fields
  • E.g. employee data rules{{NATIONAL_LAW_ADDITIONS}}
  • LMS or record system{{LMS_OR_RECORD_SYSTEM}}

FAQ

Common questions

Can I run EU: GDPR essentials training online?

The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check Regulation (EU) 2016/679 (GDPR) or ask your own counsel.

How often is this training needed?

At induction + annually (Art. 39(1)(b); Art. 5(2) accountability).

Who needs this training?

All staff in the EU/EEA who handle personal data, and non-EU staff processing EU residents' data (Art. 3(2)); variant: managers/data owners.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in Regulation (EU) 2016/679 (GDPR).

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.

Related templates

Often taught together

All International templates →
United KingdomRequired by law

UK: Modern slavery awareness

All UK staff; variant: procurement · International

30 min
United KingdomRequired by law

UK: Display screen equipment (DSE) safety

DSE "users" · International

25 min
European UnionRequired by law

EU: AI literacy (EU AI act article 4)

All staff · International

35 min
European UnionRequired by law

EU: Whistleblower protection

All staff · International

30 min
Last reviewed: 12 October 2026Based on: Regulation (EU) 2016/679 (GDPR) - Arts. 4, 5, 6, 9, 12-22, 25, 32-34, 37-39, 83; EDPB guidelines; national supervisory a…Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck