Myles Dacres

S2 Ep27: Creating Training Which Changes Behaviour

Creating Training Which Changes Behaviour

Data Protection Made Easy podcast with Caine Glancy and Amber Sivill

Data protection training should do more than record attendance. It should help people recognise risks, understand their responsibilities and know what action to take.

In this episode of the Data Protection Made Easy podcast, Caine Glancy and Amber Sivill discuss why generic training often fails to engage staff. They explore how organisations can make training practical, relevant and easier to apply during everyday work.

Why Generic Training Often Falls Short

Training can be technically accurate without being effective.

A presentation may explain the law correctly, but staff are unlikely to remember it if the content does not relate to their role. Long presentations, legal language and broad examples can make data protection feel more complicated than it needs to be.

Amber explained:

“Poor training for me is where organisations design training and it may be very well researched, but it is not tailored.”

Training should connect data protection requirements to real decisions. Staff need to understand how the subject affects their work, their customers and the personal data they handle.

Make Training Relevant to Each Role

Different teams use personal data in different ways.

Human resources teams, senior managers, IT staff and customer service teams may face very different risks. Giving everyone exactly the same training can leave important gaps.

Amber said:

“Tailoring it to different departments and different scenarios, and bringing some sort of personal element in, really makes people think.”

Role-based training allows an organisation to focus on the situations each team is likely to encounter. This could include recognising a subject access request, reporting a personal data breach or handling sensitive information securely.

Build Trust Rather Than Fear

Training should make people feel able to ask questions and report mistakes.

Using fear to encourage compliance can have the opposite effect. Staff may become less willing to report an incident if they believe they will automatically be blamed or disciplined.

Amber explained:

“Leading by fearmongering can push people towards being less open and honest about the things they may be doing wrong or the difficulties they are facing.”

A supportive approach does not remove accountability. It helps staff understand that mistakes should be reported quickly so the organisation can assess the risk and respond appropriately.

Caine highlighted the importance of education alongside formal training:

“Education is also the time spent with people to help them understand an element of the law that is relevant to them and their role.”

Make Training Conversational

People often learn more when they can ask questions and discuss realistic examples.

A conversational session gives the trainer an opportunity to understand where staff are struggling. It also helps employees connect data protection principles with situations they have experienced.

Amber said:

“It needs to be more conversational and more on a case-by-case basis.”

Quizzes, practical exercises, visuals and group discussions can all help. A mixture of formats also supports different learning styles.

Support Staff After the Session

Training should not end when the presentation closes.

Staff need somewhere to find clear information when they face a data protection question. This could be a company handbook, an intranet page or a central collection of practical guidance.

Amber explained:

“It is always good to have some sort of central archive, a company handbook or an intranet, where people can easily access that information.”

Resources should answer practical questions, including:

• How to recognise a potential personal data breach
• Who to contact when something goes wrong
• How to recognise a request for personal information
• Where to find the organisation’s policies and procedures
• What responsibilities apply to a particular role

Create a Culture of Accountability

Effective training needs support from across the organisation.

The Data Protection Officer cannot build a strong data protection culture alone. Senior leaders, line managers, IT teams and other key employees all have a part to play.

Amber described accountability as the overarching principle:

“Ultimately, it is about accountability. You look at what has gone wrong, what you could do better next time and what you can put in place.”

When leaders take training seriously, staff are more likely to do the same. This helps turn data protection from an annual exercise into part of everyday decision-making.

Key Takeaways

Effective data protection training should:

• Relate directly to the employee’s role
• Use clear language rather than legal jargon
• Include practical examples and realistic scenarios
• Encourage questions and open conversations
• Help staff feel confident reporting mistakes
• Use different formats to support different learning styles
• Provide guidance that remains available after the session
• Receive visible support from senior leaders and managers

Good training does not simply tell people what the law says. It helps them understand what good data protection looks like in practice.

Watch or Listen to the Full Episode

Watch the full conversation on YouTube or listen through Spotify.

Explore Data Protection Training

Data Protection Made Easy provides training designed to help organisations understand their responsibilities and apply data protection requirements in practice.

View Training Courses

S3 Ep26: GDPR Radio- Data Protection News of the Week

GDPR Radio: Data Protection News of the Week

In this episode of the Data Protection Made Easy podcast, Caine Glancy and Catarina Santos discussed the latest stories shaping data protection, cyber security, AI regulation and online safety.

From changes at the Information Commission to cyber sentencing, political marketing, AI guidance and addictive app design, the episode explored what these developments mean for organisations and the people whose data they handle.

What Could Changes At The Information Commission Mean?

One of the first topics discussed was the appointment of seven non-executive directors to the Information Commission board and what this could mean for the future direction of the regulator.

“I really do hope whoever comes in and chairs this board is able to keep a rein on individuals’ rights and make sure that there’s not a really obvious imbalance here.”

Caine explained that any shift towards innovation still needs to be balanced with strong protection for individual rights.

Catarina also linked this to the wider direction of the regulator.

“The fact that we are appointing the new board chair probably will provide an opportunity to try to rebuild that trust and confidence in the regulator.”

This matters because the regulator plays a key role in how organisations understand and apply data protection law. If the Information Commission changes direction, organisations will need clear guidance on what that means in practice.

Why The TfL Cyber Attack Still Matters

Catarina then discussed the sentencing of two members of the Scattered Spider cybercrime group following the cyber attack on Transport for London.

“The impact goes way beyond the numbers of the customers involved.”

The attack involved personal data relating to around 10 million customers and affected around 27,000 employees. It was also estimated to have cost Transport for London £39 million.

Caine explained that cyber incidents like this are a reminder to review technical and organisational measures.

“All these stories about cyber attacks are just a little reminder to make sure that all your measures remain audited and remain strong.”

The discussion focused on access controls, which are rules that limit who can view, use or change information, and penetration testing, which is a controlled test used to find security weaknesses before attackers do.

Political Marketing And Purpose Limitation

The episode also covered a reported GDPR issue involving a Portsmouth councillor, a restaurant linked to his partner and messages promoting Reform UK.

Caine explained the concern clearly.

“Not only are they promoting something that is wholly outside of the scope of what they were doing in respect to the partner’s restaurant, but also in respect to a political party.”

Catarina highlighted purpose limitation, which means personal data should only be used for the reason it was collected unless there is a clear lawful reason to use it for something else.

“They are surely not expecting then the details to be used for any other campaign afterwards.”

This becomes especially important when political views may be involved. Political opinion can be special category data, which means it needs extra protection because it is sensitive.

The UK Government’s Call For Evidence On AI

A major story in the episode was the UK Government’s call for evidence on data regulation in the age of AI and other data-driven technologies.

Catarina explained that this does not change the law.

“This is not a consultation on new laws, anything around changing UK GDPR or any legal framework.”

Instead, the Government is asking businesses, regulators, academics and other organisations to share their experiences of using AI and explain where the current framework may be unclear or difficult to apply.

Catarina described it as a positive step.

“I think this is a very, very good step where you are actively asking the organisations and people that are actually working directly with these platforms and with AI in general.”

Caine agreed that clearer guidance is needed.

“Getting more stuff on the law and the guidance allows us to also be more helpful with you guys as well.”

For organisations using AI, this is important because many are already trying to apply existing data protection principles to tools that are developing quickly.

Anti-Doping Decisions And GDPR

The hosts also discussed a Court of Justice of the European Union ruling from 2024 about anti-doping rules and whether publishing athletes’ personal data online can be compatible with GDPR.

Catarina explained that publication can be compatible with GDPR, but only if the right checks are made first.

“The proportionality I think is key, the balance between the potential publication and the athletes’ rights and freedoms and interests on the other side.”

Proportionality means making sure an action does not go further than necessary to achieve its aim.

Caine considered the other side of the issue, including transparency in sport and the risk to clubs.

“Doping could carry a potential risk to the club itself.”

Catarina also raised the long-term impact of putting this information online.

“Once it’s published online, even if you delete it, it will never leave the internet.”

The discussion showed why organisations must think carefully before making personal data public, even where there is a strong reason to do so.

Meta, Addictive Design And Online Safety

The final story focused on Meta and the European Commission’s preliminary view that Meta may have breached the Digital Services Act.

The Digital Services Act is an EU law that places duties on online platforms to manage risks linked to their services.

Caine explained that the concerns related to features such as infinite scrolling, autoplay, push notifications and personalised content.

“The way that the social media app is designed bottom to top, it thinks it is doing too much to keep users engaged.”

He also questioned whether existing controls go far enough.

“What is it that they’re expecting Meta to do? What does Meta need to do now?”

Catarina raised concerns about children, vulnerable users, targeted content and connected technology such as smart glasses.

“There are so many concerns and the main one is definitely whether platforms are actually doing enough to protect children.”

The discussion ended with a wider privacy question about technology in the workplace.

“What’s the difference between wearing Meta glasses at work and everyone else that has a mobile phone that can record covertly anywhere?”

It is a useful reminder that privacy risks often appear before workplace expectations and regulation have fully caught up.

Looking Ahead

This episode showed how broad data protection has become.

It now connects to AI, cyber security, political campaigning, sport, social media design, workplace technology and public trust.

For organisations, the message is simple. Data protection is not just about policies. It is about how decisions are made, how risks are assessed and how people’s rights are protected in real situations.

Frequently Asked Questions

What was this episode of GDPR Radio about?

This episode covered key data protection news, including the Information Commission, the TfL cyber attack, political marketing, AI regulation, anti-doping decisions and Meta’s app design.

What is purpose limitation under GDPR?

Purpose limitation means personal data should only be used for the reason it was collected unless there is a clear lawful reason to use it for another purpose.

Why does the UK Government’s AI call for evidence matter?

It matters because organisations are already using AI and need clearer guidance on how existing data protection rules apply to new technology.

What is proportionality in data protection?

Proportionality means making sure an action is appropriate and does not go further than needed, especially where it affects someone’s rights.

Why are app design features a data protection issue?

App design features can influence how people behave online. If those features affect vulnerable users, children or personal data use, they can raise privacy and safety concerns.

Need Support With Data Protection, AI Or Cyber Security?

Data protection issues are becoming more connected.

AI, cyber security, marketing, employee access, online platforms and emerging technology all create new risks for organisations to manage.

Data Protection Made Easy helps organisations understand their responsibilities and take practical steps to improve compliance.

Whether you need support with UK GDPR, AI governance, cyber security or data protection training, our consultants can help make the process clearer and easier to manage.

The Rise of AI in Payment Fraud and Cybersecurity

The Rise of AI in Payment Fraud and Cybersecurity

Artificial intelligence and machine learning are increasingly influencing how security operates on both sides of the fence. Organisations are using them to spot unusual activity more quickly and with more precision. Attackers are using them to run phishing campaigns, impersonate people convincingly, and scale fraud operations that would have required whole teams just a few years ago.

The uncomfortable truth is that both sides are using the same technology and are getting better at it. Attackers do not follow scripts. They adapt in real time, blend into normal-looking traffic, and automate the trial and error that used to slow them down.

The Attacker’s Advantage

AI has lowered the barrier to sophisticated attacks considerably. Credential harvesting, social engineering, synthetic identity fraud, and card testing are not new threats, but AI makes them faster, more targeted, and harder to distinguish from legitimate activity.

A phishing email that once took hours to craft can now be personalised and sent at scale. In some emerging cases, attackers are experimenting with automation that adjusts payloads or lures based on defensive responses.

In the AI Risk and Resilience Special Report published across 2025–2026, Mandiant observed that threat actors are moving beyond experimental use of generative AI and increasingly operationalising AI across the attack lifecycle.

The report highlights a shift toward more automated and adaptive techniques, where AI is used to support reconnaissance, phishing, and malware development at scale, reducing how much human effort is needed to run and evolve campaigns.

AI as a Defensive Capability

The same shift is happening on the defensive side, often quietly. Many of the fraud platforms, identity tools, and monitoring systems organisations already rely on have machine learning built in, sometimes without it being particularly visible or labelled as such.

These systems work by processing large volumes of transaction data, authentication logs, and behavioural signals to spot patterns that do not fit. Rather than flagging individual events in isolation, they correlate activity across users, devices, and systems.

This is how organisations can catch things like account takeover attempts or card testing activity that might look unremarkable on their own. In complex payment environments with heavy API traffic and distributed infrastructure, that kind of correlation is genuinely difficult to do without automation.

Compliance Pressure and the AI Gap

PCI DSS v4.x represents a meaningful shift in how organisations are expected to approach security compliance. Rather than functioning as a purely prescriptive checklist, the standard now places greater emphasis on achieving defined security outcomes.

This change introduces two methods for meeting requirements: the traditional Defined Approach, which follows the familiar step-by-step control structure, and a more flexible Customized Approach, which allows organisations to design controls that fit their specific environment, provided they can demonstrate, through testing and risk analysis, that the requirement objective is met.

That second option is where the real mindset changes sit. PCI DSS v4.x is less concerned with the technology used to implement a control and more concerned with whether the implemented control is effective in meeting the security objectives.

This creates space for organisations to move away from rigid, one-size-fits-all implementations and adopt more modern, risk-driven security designs. As long as the intent of a requirement is met, organisations have more flexibility to tailor their control architecture to their operational reality.

While the standard does not explicitly require AI or machine learning, it does expect organisations to have proper logging, monitoring, and processes in place to detect and respond to suspicious or unusual activity.

In practice, many teams achieve this using existing security tooling such as SIEM platforms, behavioural monitoring approaches, and automated log analysis. Some organisations also use capabilities like User and Entity Behaviour Analytics to improve visibility and scale detection across large, complex environments.

However, passing a compliance audit and actually being secure remain two different things. Organisations can satisfy every requirement and still carry blind spots in detection and response that only surface when something goes wrong.

Business email compromise illustrates this well. Controls exist for it, including awareness training, email filtering, and access restrictions. Attackers know those controls exist and design around them.

According to the Microsoft Threat Intelligence findings in the Microsoft Digital Defense Report 2024, threat actors involved in business email compromise continuously adapt their techniques, messaging, and supporting infrastructure in response to detection and defensive controls.

The campaigns persist not because controls are missing, but because attackers adapt to them more quickly than many defences do.

This is precisely what PCI DSS v4.x is responding to. The emphasis has shifted from whether controls are present at a point in time to whether they continue to work effectively under real-world conditions.

That distinction pushes organisations toward continuous validation rather than snapshot assessments, and it raises a governance question that cannot be sidestepped.

As behavioural analytics and AI-assisted tools take on more of the detection and response work, organisations must still be able to demonstrate how alerts are generated, how the system is tuned over time, how false positives and negatives are managed, and how the whole thing maps back to a specific requirement intent.

The flexibility that PCI DSS v4.x offers comes with heavier responsibility to document, justify, and evidence that whatever solution is in place, whether traditional or AI-enhanced, is genuinely doing its job. Saying “we use AI” is not an answer an auditor will accept.

The Future: AI Agents in Security Operations

We are at the beginning of the next phase of AI in security operations, and it is agentic. Rather than systems that simply detect and alert, agentic AI is designed to investigate, correlating signals across endpoints, identity, network, and application layers, then assembling a coherent view of activity for analyst review.

Across enterprise security platforms, AI-driven workflows are increasingly being embedded into investigation and incident triage workflows, with some extending into guided remediation. The direction is clear and the pace of adoption is accelerating.

The meaningful change is not detection itself but speed. Investigation cycles that previously took hours are being compressed significantly, reducing the window between when an attack begins and when someone understands what is happening.

In payment environments, where delayed detection can mean mass cardholder data exposure, that matters enormously. Security controls are increasingly built into operational workflows, where automation does not just flag issues but helps investigate them.

This shifts the analyst’s role away from constant alert monitoring and toward validating findings and making decisions.

What It All Comes Down To

AI systems are only as good as the threat models and data behind them. As both attackers and defenders lean harder into AI, security outcomes depend less on what tools an organisation has purchased and more on how quickly it can adapt, validate, and respond.

That is a harder problem than it sounds, and it does not get solved at audit time.

It raises some honest questions for security and compliance leadership. Do you have real-time visibility across your payment environment, or are there gaps that only surface after something has already gone wrong?

Has anyone formally assessed whether your AI-driven tools are performing as expected, or are you trusting the vendor’s word? Can abnormal behaviour be detected and acted on at the speed it occurs?

And are your PCI controls functioning as continuous, validated mechanisms, or as checkboxes that get ticked once a year and largely left alone in between?

Most organisations get this wrong in the same way: they treat AI as a product to buy rather than a control to govern.

A fraud platform with machine learning under the hood is still, fundamentally, a control, and every control needs to be tested, documented, and proven to work. Vendor marketing does not change that.

A model might perform well, but without proper validation and oversight, it is not necessarily any safer than the rules-based system it replaced.

The real challenge is no longer whether organisations have security controls in place, but whether those controls can be trusted to behave consistently as environments and attack patterns evolve.

Frequently Asked Questions

How is AI being used in payment fraud?

Cyber criminals are increasingly using AI to automate phishing campaigns, create convincing impersonations, develop synthetic identities, and scale attacks such as credential harvesting and card testing. AI allows these attacks to become faster, more personalised, and more difficult to detect.

Can AI improve cyber security?

Yes. AI can help organisations detect suspicious behaviour more quickly by analysing large volumes of transaction data, authentication logs, and behavioural patterns. This enables security teams to identify potential threats that may otherwise go unnoticed.

Does PCI DSS v4.x require organisations to use AI?

No. PCI DSS v4.x does not require organisations to implement AI or machine learning. Instead, it requires organisations to demonstrate that their security controls effectively detect, monitor, and respond to threats, regardless of the technology being used.

What are AI driven security controls?

AI driven security controls use artificial intelligence or machine learning to support activities such as fraud detection, behavioural analytics, threat monitoring, and incident investigation. Like any security control, they should be regularly tested, validated, and documented.

Why is governance important for AI security tools?

AI tools should not simply be trusted because they use advanced technology. Organisations need to understand how they make decisions, monitor their effectiveness, manage false positives and negatives, and ensure they continue to meet security and compliance requirements over time.

How can Data Protection People help?

Data Protection People works with organisations at exactly this intersection, validating that adopted controls, whether AI-enabled or traditional, align with PCI DSS requirements and broader security standards such as ISO 27001, and can be evidenced to an auditor without ambiguity.

Compliance postures do not always keep pace with the technology changes happening inside them. If AI and automation have reshaped how your controls operate but your last formal assessment predates those changes, this is a risk.

Finding it through independent assurance is considerably better than finding it through a regulatory review or a breach.

Get in touch now for assistance.

Reddit fined for children’s privacy failures 

Reddit issued with £14.47m fine for children’s privacy failures 

Last week the UK Information Commissioner’s Office (ICO) fined Reddit £14.47 million for unlawfully processing children’s personal data. And the problem here was that children under 13 were able to use the platform for years while Reddit relied mainly on users simply ticking a box to confirm their age. The ICO investigation found two core failures: 

• Reddit did not properly verify users’ ages 
• Reddit failed to carry out a Data Protection Impact Assessment (DPIA) before allowing risks to children to materialise 

 As a result, children under 13 had their personal data processed without a lawful basis and were potentially exposed to content they should never have seen. 

What happened?  

Reddit’s terms of service have long stated that children under 13 cannot use the platform. However, until July 2025, Reddit did not have meaningful measures in place to check users’ ages; people could open an account by declaring their age themselves. The ICO found that large numbers of under-13s were likely using the platform during this period, meaning their personal data was being processed without a lawful basis. 

 Even more concerning was the lack of early risk assessment: Reddit had not carried out a Data Protection Impact Assessment looking properly at risks to children until 2025 – despite allowing teenagers aged 13–17 to use the service.  

 According to the ICO, this meant children’s data was collected and used in ways they could not reasonably understand or control, potentially exposing them to harmful or inappropriate content. 

Reddit has since introduced age assurance measures, including checks for access to mature content but ICO has made it clear that these changes came late and remain under review. 

 This is a great example for us to consider around age verification mechanisms. For ages, much of the intern relied on the self-declaration method: “please confirm you are over 13”. It seems reasonable enough to say that everyone (children, parents and organisations) were aware on how easy this was to bypass… and the big problem was the enforcement and its slow interference – many organisations convinced themselves that putting age limits in terms and conditions was enough and self-declaration is sufficient.  

On this, ICO’s message is clear: relying mainly on users to declare their own age is not acceptable where children are likely to access a service – and this should go beyond social media: gaming platforms, forums apps, online communities 

Age verification 

I had the chance to explore this topic within my research for my thesis dissertation and I can easily say that one of the challenges organisations face is that stronger age checks can appear to conflict with data protection principles – for example, uploading passports to join an online community is excessive and this would come with its own risks. This is why I find the approach discussed by the Irish data protection commission particularly helpful: rather than pushing one technical solution, it focuses on proportionate, risk-based age assurance: the higher the risk to children, the stronger the assurance needed.  

Not every service needs the same level of verification, but every organisation should be able to explain what risks to children exist, how likely access by children is and why the chosen safeguards are appropriate.  

 The ICO made it clear that it is now actively focusing on platforms that primarily rely on self-declaration – which means that Reddit is unlikely to be the last case… 

Conclusion and takeaway 

I actually welcome this decision; not because fines are the main goal (as they rarely solve problems on their own, particularly for these big companies) but because the clarity that they bring helps organisations move forward and to think about their own practices.  

 I think that for too long, there has been uncertainty around how far companies needed to go when it came to age checks and, at the same time, regulators and industry need to work together to avoid turning age assurance into mass identification or unnecessary data collection.  

 Links:  

https://cy.ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/  

https://www.theguardian.com/technology/2026/feb/24/reddit-fined-uk-children-under-13-data 

https://www.dataprotection.ie/en/dpc-guidance/fundamentals-child-oriented-approach-data-processing  

Insider Threats Are Becoming a Reality

Why Insider Threats Are Becoming a UK Healthcare Reality

A recent case reported by ITV has brought renewed attention to one of the most difficult data protection challenges facing healthcare providers today, unauthorised internal access to patient records.

According to reports, a medical practitioner is alleged to have accessed confidential patient data over a period of six years without the knowledge or consent of the data controller. The case is currently progressing through the courts, but it has already raised significant concerns around how healthcare organisations manage access to some of the most sensitive personal data in existence.

For many organisations across the UK, this will feel alarmingly familiar.

At Data Protection People, this is not an isolated incident. It reflects a growing pattern we are seeing within health and social care environments where personal data is not always being accessed maliciously from the outside, but instead by individuals who already have legitimate system permissions.

Healthcare Data Is a High Value Target

Health records fall within special category data under UK GDPR. This includes information relating to an individual’s physical or mental health, treatment history, medications, diagnoses, and other deeply personal details.

When accessed inappropriately, this information can be exploited for financial gain, identity theft, insurance fraud, or even social engineering attacks. In some cases, it can also lead to reputational damage, blackmail, or discrimination.

This is why healthcare breaches often carry some of the highest regulatory penalties and present the greatest risk to individuals.

Not All Breaches Are Caused by Hackers

In ITV’s coverage of the incident, our Data Protection Expert, Caine Glancy, was asked to comment on what may be driving the increase in these types of events.

He explained:

“People are seeing the significance and the impact data being breached out into the world seems to have had. I think it’s also because data protection is not something that’s being considered for all businesses as strictly as it should. At the moment, a lot of compliance with data protection seems to be more of a superficial statement for a lot of organisations.”

This highlights a key issue.

Many organisations focus heavily on external threats such as phishing attacks, ransomware, or system vulnerabilities. While these risks are very real, they often overlook the fact that inappropriate internal access remains one of the most common causes of personal data breaches.

Employees, contractors, students, and temporary staff may all have legitimate access to systems as part of their role. Without the right controls in place, this access can be misused, whether intentionally or otherwise.

Click here to view the full story via the ITV website.

Why Insider Access Is So Difficult to Control

Healthcare environments are built on trust and access to information is often essential for delivering timely patient care. However, this creates a tension between operational efficiency and data protection compliance.

We frequently support organisations who:

• Have shared login credentials across departments
• Provide blanket access to entire patient databases
• Lack audit trails to monitor who accessed what and when
• Do not regularly review user permissions
• Rely on annual training alone to drive compliance

In fast paced clinical environments, access controls are sometimes viewed as a barrier to care delivery rather than a safeguard against harm.

However, without appropriate role based access controls, monitoring, and behavioural training, organisations may be unable to detect misuse until significant damage has already occurred.

What Organisations Should Be Doing Now

Cases such as this serve as a reminder that technical compliance alone is not enough.

Healthcare providers should ensure they have:

• Clear access management processes aligned to job roles
• Multi factor authentication for all systems containing patient data
• Regular reviews of user permissions
• System logging and monitoring to identify unusual access patterns
• Targeted training programmes focused on real world risks
• A documented incident response process for data breaches

Many of these measures are already required under the UK GDPR’s security principle, yet they are often implemented inconsistently in practice.

A Growing Trend Across the UK

With over 200 episodes of the Data Protection Made Easy podcast and a community of more than 1,700 data protection professionals, we regularly hear from organisations facing similar challenges.

The reality is that insider threats are rarely discussed publicly, but they are one of the most frequent issues raised during audits, SAR support work, and outsourced DPO engagements.

As this case demonstrates, organisations must move beyond treating data protection as a policy exercise and begin embedding it into day to day working practices.

Need Support Managing Access to Sensitive Data?

If your organisation handles special category data and you are unsure who currently has access to what, or whether your monitoring controls would detect inappropriate use, it may be time to review your approach.

Our team supports healthcare providers across the UK with access management reviews, breach response planning, and ongoing compliance support designed to reduce the likelihood of incidents such as this occurring in the first place.

Training That Actually Changes Behaviour

Data protection training is often treated as a compliance requirement, something that must be completed, recorded, and repeated each year. But if training does not change how people behave in practice, has it really worked?

Data Protection Made Easy PodcastEpisode: Training That Actually Changes BehaviourHosted by: Caine Glancy & Catarina Pereira dos Santos

Listen now →

Practical training creates lasting change

Throughout the discussion, both hosts emphasised the importance of making training practical. Whilst understanding the legal framework is important, real learning happens when people can apply that knowledge to realistic situations.

This is why interactive exercises, real-world scenarios, workshops, and practical demonstrations are often far more effective than simply presenting information. When individuals actively participate in training, they are more likely to remember it, discuss it with colleagues, and apply it when similar situations arise in the workplace.

Subject access requests provide a good example. Rather than simply explaining the legislation, trainers can ask participants to review a request, identify relevant information, apply exemptions, and consider how they would respond. By working through realistic examples, staff gain confidence and develop practical skills that can be used immediately.

Practical learning also creates opportunities for discussion. Staff can ask questions, challenge assumptions, and relate the topic directly to their own role. This often reveals misunderstandings that may otherwise go unnoticed until an incident occurs.

Why one size fits all training rarely works

Another key theme from the episode was the need to tailor training to the audience. Different teams interact with personal data in different ways, which means their risks, responsibilities, and training needs are often very different.

The information that a HR team requires may be very different from what a marketing team, IT department, customer service team, or senior leadership group needs to understand. Delivering exactly the same training to every employee may be efficient, but it is not always effective.

Staff are far more likely to engage when they can clearly see how the content applies to their day-to-day responsibilities. Relevant examples, department-specific risks, and practical guidance make it easier for individuals to understand why the training matters to them personally.

The role of the trainer

The conversation also explored an often-overlooked factor in successful learning: the trainer themselves.

Even the best training materials can fall flat if they are delivered without enthusiasm, engagement, or practical insight. Effective trainers bring energy to the subject, encourage participation, and help learners understand why the topic matters.

Importantly, this does not mean every trainer needs to have the same personality. Some are naturally more outgoing than others. What matters is demonstrating genuine passion for the topic and creating an environment where people feel comfortable asking questions and sharing experiences.

People are far more likely to engage with training when they can see that the trainer understands the challenges they face and is focused on helping them succeed rather than simply delivering information.

Training alone is not enough

One of the most important points raised during the discussion was that training should never be viewed as a one-off activity. Completing an induction session or annual refresher course is only one part of developing a strong data protection culture.

People forget information over time. New risks emerge. Processes change. Staff move into new roles. Organisations that rely solely on annual training sessions often find that important lessons are forgotten long before the next refresher arrives.

This is where awareness activities become critical. Regular communications, team discussions, newsletters, posters, brief reminders, and ongoing conversations all help reinforce key messages and keep data protection visible throughout the year.

Awareness should also be relevant. Rather than simply distributing generic messages, organisations should use real examples, common mistakes, recent incidents, and practical guidance that staff can immediately relate to. This helps create an environment where data protection becomes part of everyday decision-making rather than something people only think about during training.

Leadership sets the tone

Creating meaningful behavioural change requires more than just good trainers and engaging content. Leadership support plays a significant role in determining whether training succeeds or fails.

When senior leaders actively support data protection initiatives, attend training, discuss compliance openly, and reinforce expectations, employees are more likely to recognise the importance of the topic. Conversely, if leadership treats training as a box-ticking exercise, staff are likely to adopt the same attitude.

Managers also have an important role to play after training has been delivered. They are often best placed to reinforce learning, answer questions, identify areas where additional support may be required, and encourage good practices within their teams.

Measuring success differently

Many organisations measure training success using attendance figures, completion rates, or assessment scores. Whilst these metrics can provide useful information, they only tell part of the story.

The real question is whether behaviour has changed. Are staff reporting incidents more quickly? Are fewer emails being sent to incorrect recipients? Are teams identifying subject access requests sooner? Are managers asking better questions about privacy risks before projects begin?

These behavioural indicators often provide a far more accurate picture of whether training is having a meaningful impact. They demonstrate whether learning has moved beyond theory and become embedded in day-to-day operations.

Organisations that focus solely on completion statistics risk missing the bigger picture. Successful training programmes should ultimately be judged by the decisions people make, not simply the certificates they receive.

Upcoming Data Protection Training Sessions 2026

We’re excited to share our upcoming training programme for 2026, packed with practical, expert-led sessions covering some of the most pressing areas of UK data protection compliance.

Whether you’re a DPO, compliance lead, HR professional, IT manager, board member, or someone looking to build their knowledge, there’s something here for you and your team.

Why this training matters

Data protection responsibilities aren’t getting any simpler. AI tools, increasing volumes of Subject Access Requests, cross-border data transfers, and growing board-level scrutiny mean that practical, up-to-date knowledge is more valuable than ever.

Our sessions are delivered by experienced practitioners who work with organisations across the UK every day. You won’t just learn the theory, you’ll walk away with guidance you can immediately apply within your organisation.

What’s coming up

Group bookings and in-house training

If you have a team that would benefit from any of these sessions, we can also deliver training in-house, tailored to your sector, your systems, and your specific challenges. We work with organisations of all sizes, from small teams to large public bodies.

We also offer bespoke workshops, sector-specific sessions, executive briefings, and ongoing support and consultancy.

S2 Ep13: GDPR Radio: News Of The Week

S2 Ep13: GDPR Radio: News Of The Week

GDPR Radio is our regular news roundup, where we break down the biggest stories from the world of data protection, privacy, and emerging tech. In this episode, Catarina Santos and Caine Glancy walk through the latest developments in data protection, highlighting recent regulatory activity, enforcement trends, and key stories organisations need to be aware of.

These sessions are designed to give a clear, practical overview of what is happening right now, helping organisations stay informed without needing to dig through complex legal updates.

Listen back on Spotify

Episode highlights

This session focuses on recent news and real-world developments in the data protection landscape.

1) Recent data protection news and updates We cover the latest developments across GDPR and wider privacy regulation, including new guidance, legal updates, and shifts in how data protection is being applied in practice.

2) Data breaches and enforcement action The episode looks at recent breaches and fines, helping to highlight common risks and what organisations can learn from real cases.

3) Regulator decisions and trends We explore activity from regulators, including enforcement approaches and what this signals for organisations moving forward.

4) Big tech and privacy developments Discussion includes how large organisations are handling personal data, and what this means for compliance expectations across all sectors.

Key takeaways for organisations

• Stay up to date with data protection news to understand how expectations are evolving in practice.
• Learn from real-world breaches and enforcement action to identify and reduce your own risk areas.
• Pay attention to regulator trends, as these often indicate where future scrutiny will be focused.
• Ensure your organisation is adapting to changes in how personal data is being used, especially as technology continues to evolve.

Useful links

• Privacy notice
• Claim CPE credits
• Register for the podcast / join the community
• Listen on Spotify

About GDPR Radio

GDPR Radio is part of the Data Protection Made Easy podcast. Join live to ask questions, share views in the chat, and keep up with what’s happening across regulation, enforcement, and practice.

Speakers

Catarina Santos, Data Protection Consultant, Data Protection People
Caine Glancy, Data Protection Consultant, Data Protection People