Skip to content

Data Protection

Data protection relates to how personal and sensitive data is collected, used and stored by all organisations.

Our Data Protection Refresher will remind your staff what personal and sensitive data are, why it needs protecting and how to ensure compliance with the General Data Protection Regulation (GDPR).

Start your trial Course details
  • 15 Minutes
  • For all staff

Learning objectives

  • Recognise the importance of data protection to all of us
  • Know what is expected of you to comply with data protection laws
  • Comply with the data protection principles and our Company's legal obligations to safeguard personal information
  • Feel confident in reporting any data breaches promptly

Start your compliance e-learning journey with a free trial

Our no-obligation free trial gives you access to our libraries and compliance platform. 

Ready to start your free trial? Complete the form, and a member of the Skillcast team will be in touch with further details.

Your questions, answered

Data Protection (GDPR)

Where can I track incidents involving personal data?

Tools such as a Data Breach Register enable you to log, track, and respond to data breaches and similar incidents efficiently. Skillcast offers this tool, making it easy to document and manage incidents in line with compliance requirements.

How can I ensure that employees formally attest to our internal Data Protection Policy?

Our Policy Hub tool allows you to easily assign policies, track when employees read them, and capture their attestation with a simple digital acknowledgement. The tool also provides automated reminders to employees who haven't yet acknowledged the policy, ensuring full compliance and a clear audit trail.

What makes a password secure?

A secure password is long (ideally 12+ characters), contains a mix of letters, numbers, and symbols, and avoids obvious choices like names, birthdays, or simple sequences.

What is a passphrase, and is it better than a password?

A passphrase is a string of unrelated words (e.g., "BlueMonkeySkyLadder!") that's easier to remember but harder to crack. It’s often more secure and user-friendly than traditional complex passwords.

How can organisations help staff manage secure passwords?

Encourage the use of password managers, provide cybersecurity training, and implement policies that support strong, unique password creation.

What exactly must be included in a DSAR response under GDPR?

Under Article 15 of the GDPR, a controller must provide confirmation of processing, access to the personal data, and supplemental information such as:
  • Purposes of processing
  • Types of personal data involved
  • Recipients of data (including third countries)
  • Retention period or criteria
  • Data source (if not collected directly)
  • Rights to rectification, erasure, restriction, or to object
  • Right to lodge a complaint with a supervisory authority
  • Automated decision-making logic and consequences
Plus, where relevant, safeguards for international transfers.

Can I ask for identification before fulfilling a DSAR?

Yes. Controllers should apply reasonable identity verification measures to ensure that they don't disclose data to the wrong person. However, it is important not to request excessive or unnecessary documentation, especially formal ID, if other reasonable methods (such as email verification or an identity-proofing platform) are available.

How is the one-month response deadline calculated precisely?

GDPR mandates response "without undue delay" and within one month from receipt of the request, or from receipt of necessary information to verify identity or a valid fee. That deadline runs to the same calendar date the following month; if that date doesn't exist (e.g., from 31 January), the deadline is the last day of the next month. If it falls on a weekend or holiday, the next working day applies.

When and how can the response deadline be extended?

A controller can extend the deadline by up to two months if the request is complex or the data subject has submitted multiple rights requests simultaneously (e.g., access, erasure, portability). However, the extension must be issued within the initial one-month period, providing reasons for the delay.

How is data privacy different from data security?

They’re closely related but differ: data privacy is all about how personal info is collected, used and shared, centring on policies, consent and ethical handling, whereas data security focuses on protecting information using technical measures.

Who is responsible for data privacy in compliance training?

Your organisation (the data controller), even if training is delivered through a third-party vendor (data processor) such as Skillcast.

What is multi-factor authentication?

Multi-factor authentication is a security protocol that requires two or more steps of verification when attempting to gain access to an account/system. The first is typically a username/email combination and the second can be one-time passcodes, biometrics, verification codes through email or text, authentication apps or FIDO2. It’s more secure than relying on passwords alone because it requires a device or biometrics, which cybercriminals don't typically have access to.

What is the difference between MFA and 2FA?

Two-factor authentication (2FA) is a type of multi-factor authentication that uses a two-stage verification process. For example, you may be required to login using your password and username, and then a one-time passcode, which is sent through your email. MFA can include two, three or more factors of verification but the government recommends using the authentication method that is best suited to the specific needs and risks of what is being protected.

How to log in with MFA?

With Skillcast, once you've entered your username and password, you will be presented with a one-time passcode screen. Click 'Get OTP' and you will be sent a code to your registered email address. The code is time-limited, so enter it into the screen quickly and then click 'Validate OTP' to sign in.

Related courses

Boost your compliance efforts with our range of courses. Varying in length and topic, our courses equip you with the tools to create an ethical and resilient workplace.

Data Protection Compliance Training Course

Data protection relates to how all organisations collect, use, and store personal and sensitive data.

Read more

In-depth 45 Minutes Data Protection (GDPR) For all staff

Privacy and Electronic Communications Regulations (PECR)

PECR are new regulations that, along with the GDPR and Data Protection Act 2018 (in the UK), give consumers specific rights in respect of electronic communications.

Read more

Express 15 Minutes Data Protection (GDPR) For all staff

Understanding the GDPR

The General Data Protection Regulation (GDPR) sets out key principles for handling personal data and protecting individuals' rights.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

Personal Data Breaches

Personal data breaches can occur through hacking, human error or unauthorised access, leading to serious legal and reputational consequences.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

Data Protection Impact Assessments

Data Protection Impact Assessments (DPIAs) are used to evaluate our data processing activities and mitigate risks to individuals.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

General Data Protection Regulation (GDPR)

Data protection relates to how all organisations collect, use, and store personal and sensitive data.

Read more

In-depth 30 Minutes Data Protection (GDPR) For all staff

Controllers and Processors

The differences between data controllers and data processors are crucial to understanding data protection obligations.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

Special Category Data

In many workplaces, sensitive data, including special category data, is collected and requires extra care.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 1

The first principle of the GDPR requires that personal data must be processed lawfully, fairly and transparently.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 2

The second principle of the GDPR, purpose limitation, requires that personal data be collected for specified, explicit and legitimate purposes.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 3

The third principle of the GDPR, data minimisation, requires that personal data collected must be adequate, relevant and limited to what is necessary.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 4

The fourth principle of the GDPR, accuracy, requires that personal data must be correct, up to date and not misleading.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 5

The fifth principle of the GDPR, storage limitation, requires that personal data be retained only for as long as necessary for its intended purpose.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 6

The sixth principle of the GDPR, integrity and confidentiality, requires that personal data be protected against unauthorised access, loss or damage.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Principle 7

The seventh principle of the GDPR, accountability, requires organisations to take responsibility for compliance and demonstrate good governance in data protection.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR and Consent

Consent is one of the six lawful bases for processing personal data under the GDPR, requiring individuals to give clear, informed and voluntary agreement.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Lawful Bases for Processing

The General Data Protection Regulation (GDPR) requires organisations to have a lawful basis for processing personal data, chosen from six legal grounds.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Legitimate Interests

Legitimate interests is a flexible lawful basis for processing personal data, but it requires balancing business needs with individuals' rights.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR International Transfers

The international transfer of personal data is restricted to ensure individuals' privacy rights are protected when data is sent abroad.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Individual Rights

The General Data Protection Regulation (GDPR) grants individuals eight specific rights over their personal data, ensuring transparency and control.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

GDPR Subject Access Requests

Individuals have the right to access their personal data and organisations must respond to subject access requests (SARs) within legal timeframes.

Microlearning 5 Minutes Data Protection (GDPR) For all staff

Legitimate Interest Assessments

When relying on legitimate interests as a legal basis for processing personal data, you are taking on additional responsibility for protecting people's rights and interests.

Read more

Express 10 Minutes Data Protection (GDPR) For all staff

PCI Data Security Standard Compliance Training Course

PCI Data Security Standard (PCI-DSS) is the information security standard for organisations that process credit card payments.

Read more

In-depth 60 Minutes Data Protection (GDPR) For all staff