Last reviewed 3 November 2026 against the sources linked in this post.
A colleague in marketing asks if she can upload last year's customer list to a new AI tool, and nobody told her it counts as personal data. That is why data protection officer training cannot stop at the DPO's own certificate. The European Data Protection Board's 2025 annual report says that national data protection authorities issued a total of €1.15 billion in fines. Everyday handling of data is where compliance is won or lost.
Certification bodies teach you the law. This list covers the other half: what your staff need to know across several privacy regimes at once. You get 14 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The legal points describe EU, UK, US and Singapore rules, so use this as a syllabus, not a ruling.
All 14 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| EU: GDPR essentials | Lawful bases, rights and breach duties | 35 min | Yes (EU law) |
| UK: Data protection (UK GDPR & DPA 2018) | UK principles, rights and breach reporting | 35 min | Yes (UK law) |
| California consumer privacy (CCPA/CPRA) | Consumer rights and opt-out signals | 35 min | Yes (California law) |
| US state privacy laws overview | State-by-state differences and duties | 35 min | Yes (state laws) |
| Singapore: Personal data protection (PDPA) | PDPA obligations and breach reporting | 30 min | Yes (Singapore law) |
| Data protection laws beyond Europe: India, Brazil, South Africa and Asia | Shared principles and local differences | 45 min | Varies by country |
| Handling personal data day to day | Consent, minimisation, retention and sharing | 40 min | No |
| Data classification & handling | Classifying and handling data | 25 min | No |
| Your data and AI tools: what you can and cannot share | A five-step check before pasting data | 30 min | No |
| Code of conduct | A decision test and speaking up | 35 min | No |
| Conflicts of interest | Disclosing and deciding on conflicts | 25 min | No |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Anti-bribery & corruption (FCPA) | Gifts, third parties and hospitality | 40 min | Yes (US federal law) |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | No |
A law behind a course does not mean the law requires the course. It sets the duties the course teaches.
Regional privacy laws
EU: GDPR essentials
Your Europe, the EU's official business guidance, says a company must appoint a DPO when it regularly or systematically monitors people, or processes special categories of data, as a core activity on a large scale. This 35-minute course teaches everyone else what to do: lawful bases, data subject rights, and escalating to the DPO. In the breach lesson, learners report a case in time for the 72-hour window that the same guidance gives for notifying your authority when a breach risks people's rights.
UK: Data protection (UK GDPR & DPA 2018)
GOV.UK states that UK data protection is governed by the UK GDPR and the Data Protection Act 2018, so a DPO with UK staff may want a UK-specific module. This 35-minute course covers the seven principles, rights and complaints, and what to escalate to the data protection lead. A scenario asks learners to spot and report a breach.
California consumer privacy (CCPA/CPRA)
The California Attorney General lists consumer rights under the CCPA, including the right to know, to delete, to opt out of the sale or sharing of personal information and to non-discrimination. This 35-minute course teaches staff to handle a consumer request on time, honour opt-out signals and avoid dark patterns. A case-practice round is a natural Pick Answer quiz.
US state privacy laws overview
Several US states have their own privacy laws, so a DPO who covers more than one needs to know where they differ. This 35-minute course explains the state-by-state landscape, common definitions such as controller and processor, and duties like consent for sensitive data and data protection assessments. Learners route a new data use to the privacy team.
Singapore: Personal data protection (PDPA)
Singapore's Personal Data Protection Act is administered by the Personal Data Protection Commission, Singapore's data protection regulator. This 30-minute course covers NRIC numbers, access and correction requests, Do Not Call checks and reporting a suspected breach quickly.
Data protection laws beyond Europe: India, Brazil, South Africa and Asia
For a global programme, "is it just GDPR?" is the first question to retire. This 45-minute course walks through the laws at a glance, shared principles, roles in plain words and grey areas such as transfers, children and marketing, ending with a market checklist. It opens with one customer file handled in three countries.
Our pick: the EU GDPR essentials course. It is a common reference point for other privacy laws, so it gives every learner the shared vocabulary for rights, breaches and escalation.
Day-to-day data handling
Handling personal data day to day: consent, minimisation, retention and sharing
Incidents can start in routine work, not in a legal grey area. This 40-minute course starts with "the helpful spreadsheet" and teaches collecting only what you need, retention, copies and approved routes for sharing. It includes a "what would you do?" round on requests, mistakes and favours.
Data classification & handling
Classification underpins retention, access and breach response decisions. This 25-minute course covers why classification protects customers, what is allowed at each level, red flags and how to escalate a misclassification. Learners practise labelling, storing and sharing data by level.
Your data and AI tools: what you can and cannot share
Staff can paste data into AI tools faster than policy updates. This 30-minute course opens with an AI assistant that exposes salary files, then teaches four confidentiality classes, shadow AI and a five-step check before you paste or connect. Learners also work through an incident-reporting lesson.
Our pick: Handling personal data day to day. It turns principles into habits for every employee, which is where a DPO has a lot to gain.
Ethics, security and fraud
Code of conduct
A shared standard helps colleagues accept a DPO's advice. This 35-minute course gives teams a four-question decision test and works through grey areas and speaking up. It ends with a 10-question final check at 80% to pass.
Conflicts of interest
An undeclared conflict can undermine a DPO's advice on operational data decisions. This 25-minute course defines actual, potential and perceived conflicts, teaches "disclose, then decide" and has learners complete a disclosure. A Rating Scale asking how confident people feel about when to disclose works well here.
Phishing & social engineering
Phishing is a common route to a personal data breach, and breaches are what your organisation may have to report to its regulator. This 30-minute course traces a business email compromise, teaches red flags across email, text, voice, QR codes and deepfakes, and ends with a 12-question final check.
Anti-bribery & corruption (FCPA)
Bribery risk can reach the third parties a DPO assesses, such as data brokers. The US Department of Justice says the FCPA's anti-bribery provisions prohibit corruptly offering, paying, promising or authorising payment of anything of value to a foreign official to influence them and help win or keep business. This 40-minute course adds a decision framework for gifts and hospitality and third-party red flags.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Impersonation and invoice fraud often use stolen personal data. This 35-minute course follows a convincing request for new bank details and teaches verifying money requests with a known number. A lesson on tactics asks why people comply, which a Word Cloud captures quickly.
Our pick: Phishing & social engineering. Phishing is one of the common ways breaches begin, so this course targets a frequent cause of incidents.
How to roll the plan out
Order it by exposure. The €1.15 billion in fines issued by national authorities in 2025, as reported by the EDPB is a reminder that enforcement is real, so start with the regional law that covers where your people and customers are.
- At onboarding: handling personal data day to day, data classification, phishing and the code of conduct, for every employee.
- Within the first quarter: the regional course for each place you operate, plus the AI tools course for anyone who works with customer data.
- Each year: a refresher quiz on each course, and after any significant breach or legal change.
- Role-specific depth: the beyond-Europe course for global programmes, conflicts of interest for staff who make data decisions, and the FCPA and fraud courses for finance and procurement teams.
Add your own country or state rules where your teams work, and ask your lawyer or the regulator what applies. For a wider programme view, see our guide to compliance officer training.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show four situations and ask which one is a reportable breach, or which of four requests is a data subject request.
- Word Cloud: ask "What is the riskiest thing you did with data last month?" The biggest words show where to train.
- Rating Scale: before and after, ask "How confident are you that you would know what to do with a data subject request?" from 1 to 5.
- Open Ended: collect anonymous questions at the end of a live session, so doubts surface that never reach the DPO's inbox.
FAQ
What training does a data protection officer need?
Good DPO training builds privacy law knowledge, data protection impact assessment skills and breach response experience. Their colleagues need the practical courses above.
Is a DPO certification required?
Not by the EU guidance: Your Europe's page on appointing a DPO names no certificate, only when an appointment is needed, so check your national law and regulator. Certification can still evidence your knowledge.
What is the difference between a privacy officer and a DPO?
A DPO is a defined role: the same guidance says they monitor how personal data is processed, advise staff and act as the contact point for the authority. Privacy officer is a general job title.
How often should privacy training be repeated?
Annual repeats are a common choice, and again after any significant breach or legal change. A new AI tool or a new market is a good reason to run a short refresher sooner.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
