Phishing and Security Awareness Training for Your Team

Most security incidents in a small business do not start with a hacker breaking through a firewall. They start with an employee who clicks a link, shares a password or sends a file to the wrong person. The GDPR expects you to prepare your team for that. This article explains what the law asks, what a sensible training routine looks like for a small team, and what the two free GDPRWise courses and the official exam in the app cover.

Why people are the weak spot, with the most common scenarios, is explained in The Human Factor: Why Most Data Breaches Start with Your Employees. This article is about the training itself.

What the GDPR expects from you

The GDPR does not prescribe a specific training programme. It does set a few obligations that are hard to meet without one:

• Integrity and confidentiality (Article 5(1)(f)). Personal data must be protected against unauthorised access, loss and damage. That is a core principle, not a technical detail.
• Appropriate measures (Article 32(1)). You must take appropriate technical and organisational measures. Training the people who handle personal data is one of the most common organisational measures.
• Working on instructions (Article 32(4)). Anyone who works under your authority and has access to personal data may only process it on your instructions. Staff can only follow instructions they know about.
• Reporting breaches (Article 33). Where a personal data breach must be notified, you have 72 hours after becoming aware of it to notify the supervisory authority. That clock only works if employees report a suspicious mail or a mistake to you straight away.
• The DPO’s task (Article 39(1)(b)). If you have appointed a Data Protection Officer, awareness-raising and training of staff is explicitly one of the DPO’s tasks.

So the question is not whether you train your team, but how you do it in a way that is practical and that you can show afterwards.

When NIS2 applies to your business

Some businesses also fall under NIS2, the EU cybersecurity directive (Directive (EU) 2022/2555). For businesses in scope, training is spelled out more explicitly:

• Article 21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the risk-management measures.
• Article 20(2) requires members of management to follow training, and encourages businesses to offer similar training to their employees on a regular basis.

Whether NIS2 applies depends on your sector and size, and each country has its own transposition law. Read GDPRWise and NIS2 for who falls under it.

What the free courses cover

GDPRWise offers two free courses for exactly this topic. They run in the browser, need no account, consist of short modules in plain language, and end with a free practice quiz.

Recognising phishing covers the most common way things go wrong:

1. What is phishing?
2. Inspecting email
3. Smishing and chat
4. At work and what to do

Security awareness covers the everyday habits around it:

1. Why security matters for everyone
2. Securing accounts: password, 2FA, and passkeys
3. Access and systems
4. Handling data safely
5. Spotting and reporting a data breach

Together they cover both sides: recognising an attack, and the habits that limit the damage when one gets through.

The official exam in the app and the certificate of attendance

The practice quiz helps employees check what they learned, but it does not leave a record. For that, the GDPRWise app has a training feature with an official exam per course. It is included in the paid plans.

The two do different jobs:

• The practice quiz on the website has five questions to check yourself. Nothing is recorded and there is no certificate.
• The official exam in the app has 15 questions per course from a separate pool that is not on the website, and a pass mark of 70%. It gives each employee who passes a certificate of attendance in their name.

In the app, the account owner assigns the training to staff and follows each person’s progress, completion and score, so you do not have to keep a separate list.

Each employee who completes the official exam receives a certificate of attendance. It shows that this person took the training, which gives you simple, documented evidence of an organisational measure under Article 32. It is not a professional certification, and the courses on their own do not make your business compliant; they are one part of your security measures.

A practical training plan for a small team

1. Everyone takes both courses. Not only office staff: anyone with an email address or access to customer or staff data.
2. Set one reporting route. Agree on a single way to report a suspicious message or a mistake, for example a named colleague or a shared address. Make clear that reporting quickly is always right, even after a click.
3. Run simulations only with notice. If you test with fake phishing mails, tell staff that this happens, and use the results to learn, never to punish.
4. Refresh yearly and after incidents. Repeat the courses once a year, and add a short refresh after a near miss, a new kind of scam, a new system or a new hire.
5. Keep a record. The app shows who completed the official exam, when and with which score. Together with the certificates of attendance in the app, that record shows what you did.

For the follow-up when something does go wrong, see the data breach guide.