For the person who has to sign, GDPR training for employees is a phrase that gets searched by two people: the one who wants a definition for a memo and the one who has to sign an attestation about it next quarter. This page is written for the second. For a business processing personal data of people in the EU, GDPR training for employees comes down to a record and a set of figures: the record is the record of processing, the processor agreements, the lawful bases and the requests handled, kept with an owner, a date and a status; the figures are the evidence load that record puts on its reviewers, the days an audit of it takes, the gaps an audit will find and what they cost, the incidents and cases it produces, and the training it requires. The sections below explain GDPR training for employees in those terms, say what it is not, and show where the free sheets on this site work each figure from the program's own numbers with no account.
What GDPR training for employees means in practice
For a business processing personal data of people in the EU, it means being able to show, for each obligation, which control satisfies it, what evidence proves the control operated, who reviewed the evidence and who attested to the result. The record is the record of processing, the processor agreements, the lawful bases and the requests handled. The regulator's own material, linked below, says what the obligations are; this site publishes none of that and no legal advice. What it publishes is the arithmetic: the obligations register sheet turns the count of obligations, controls and evidence items into reviewer hours and the months to a full attestation.
The figures behind GDPR training for employees
Evidence items and reviewer hours; audit samples, days and coverage; expected gaps, remediation hours and cost; incident hours; case backlog months; training seats outstanding. Each is a free sheet on this site and each computes from the program's own inputs. For GDPR the sheet to start with is the GDPR data-mapping sheet, which works the figure a business processing personal data of people in the EU is examined on first. A program that knows those numbers has stopped estimating its own compliance.
Training that leaves a record an auditor can use
The record matters as much as the content. For each person it needs the material version they saw, the date, and evidence they completed it rather than opened it, and for a leaver it needs to survive their departure. Annual refreshers are the default, and the two triggers people forget are a new joiner mid-year and a material change to a procedure, both of which need their own round rather than waiting for the anniversary. A single spreadsheet with names, dates and versions meets this; a completion percentage in a portal you cannot export does not.
Employee compliance, by employee
Employee compliance software keeps the trainings, acknowledgements, certifications and postings by employee rather than by policy, so the question about one person is a lookup. The HR compliance report sheet on this site works the outstanding seats and acknowledgements across the headcount; the paid plan keeps them per person and emails the reminders.
What GDPR training for employees is not
It is not a certificate, a piece of software or a consultant's memo, although all three are sold under the name. It is a record and the figures that follow from it, kept by the business that owes the obligations. The guide this page supports covers scoping regulatory compliance consulting from the register, the help a small business buys around that record. Attestvio Pro keeps the record at one flat price; the sheets are free with no account.
Questions people ask about GDPR training for employees
What is GDPR training for employees?
For a business processing personal data of people in the EU: keeping the record of processing, the processor agreements, the lawful bases and the requests handled as a record with an owner, a date and a status, and being able to show for each obligation the control, the evidence and the attestation. The regulator's own material, linked below, defines the obligations; the free sheets on this site work the arithmetic.
Who is responsible for GDPR training for employees in a small business?
The compliance officer, or the owner wearing that hat, who signs the attestation. The sheets on this site are written for that person and need no account.
Does Attestvio make a business compliant with GDPR?
No. The business meets the obligations; Attestvio keeps the record and works the figures, and publishes no rule and no advice. Counsel and the regulator's own material say what the obligations are.