5,0/5 Google · 167 reviewsPeriod: October 2016 to date · As of: 28 October 2026

Data protection training for your employees

Data protection happens where teams make decisions.

We train HR, sales, marketing, customer service, IT, product teams and leadership online, on site or in workshops. The focus is on concrete processes, evidence and the question of what employees may do, must report or must escalate.

Enquire without details

Initial contact is free of charge. We will inform you expressly in advance about any costs.

Response within 24 hours on working days

As of: 23 October 2026

Training · customer serviceEvidence securedIn planning

Customer service training2 of 5

Occasion recordedNew ticket system
Present
Target group defined
Present
Case questions collectedAccess request from customers
Check
Escalation path
Missing
Participation documented
Missing

Point of review: When must the team stop?

1Describe the occasionTarget group and goal
2Agree the formatBy risk profile
3Train and documentSecure evidence

Schematic illustration of training planning. Simplified example.

We train teams in

Companies
Start-ups
Agencies
SaaS and platforms

Key points at a glance

When employees process personal data, in our experience behaviour at the interfaces counts more than the data protection folder.
ITMR translates GDPR obligations into decisions that teams have to make in their daily work.
We align format, depth and documentation with the risk of the target group, not with the calendar.
You receive evidence of the occasion, content and participation that you can use internally, with customers and in audits.
Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.

SaaS: Software as a Service. Software used over the internet rather than installed.
DSGVO: The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
AVV: Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
VVT: Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.

Typical occasion

When do your teams need data protection training?

In our experience, companies rarely ask for training because someone wants to hear about a provision in the abstract. The need arises when teams process data and the company later wants to prove that data protection is lived.

A privacy policy does not protect a company if the team makes the wrong decisions day to day.

Customer service discloses too much, HR forwards documents incorrectly, marketing uses lists without a clear basis, a SaaS tool is approved without review or an incident is reported too late. That is why data protection knowledge must become actionable.

Training led by lawyers combines legal precision with business reality. It translates obligations into situations: What may the team do? When must it ask? When must it stop? When is escalation necessary?

Teams learn to understand which data and channels are relevant in their own area. They apply this to case scenarios from HR, marketing, sales, IT, customer service, product and platform operations. Participation, target group, content and occasion are documented in a traceable way.

For whom: Employees, business units, leadership
Format: Online, on site, workshop
Provision: Art. 5(2), 24, 32, 39 GDPR
Result: Documented evidence

Quick classification

Describe the occasion in the form. We will get back to you on working days within 24 hours.

How it works

How is your data protection training created?

Three steps from the occasion to the evidence.

01
Describe the occasion
You tell us whether it is about onboarding, business units, leadership, audit pressure, the introduction of a tool, AI use or data breach prevention.
02
Agree the format
We clarify whether basic training, a business unit workshop, management training or a training series makes sense.
03
Train and document
We train with a practical focus and document so that the training remains usable internally and with customers, data protection officers and auditors.

How we set up the training in detail

1Record the occasion
Onboarding, risk in a business unit, introduction of a tool, evidence for management, audit pressure or incident prevention.
2Define the target group
Core team, HR, marketing, sales, customer service, IT, product, management or data protection coordination each get their own focus.
3Tailor the training
Content is based on processes, data types, tools, roles, typical mistakes and internal escalation paths.
4Plan the delivery
Online, on site, as a workshop, short format, series or a combination of basic and advanced modules.
5Secure evidence
We record participation, content, target group and timing so that the training remains traceable.
6Organise follow-up questions
We take open topics further in a targeted way: audit, DPA, RoPA, DPIA, set-up, data protection officer or data breach process.

How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.

Service package

What does good data protection training achieve?

Service package: data protection training

Data in everyday work
Handling customer, employee, applicant, user and contact data, confidentiality, access rights and secure communication.
Data subject requests
Access, erasure, rectification and forwarding of requests.
Recognise incidents
Recognise data breaches, report them internally and do not communicate externally prematurely.
Tools and escalation
Cloud, SaaS, AI applications, CRM, newsletters and ticket systems, and cooperation with data protection officers.

For whom: Companies, start-ups, agencies, platforms
First response: within 24 hours on working days
Costs: We tell you the costs transparently before you instruct us.
Not included: Ongoing support as external data protection officer. That is a separate service, on request.

Request training

Who delivers what and who decides

What you provide

Occasion and target group
Tools in use
Typical case questions
Preferred date

What we take on

Tailoring the content
Delivery
Evidence template
Classification of open questions

Who decides

Your company decides on format and frequency
Management decides on resources

How does the engagement work?

1
First assessment
You describe your needs using the form. We classify them. The first contact is free of charge.
2
Offer
Before we start, we tell you the scope, format and costs transparently.
3
Court steps separately
If you wish, we agree court proceedings, representation before authorities and further services such as an audit or RoPA separately.

Client situations

What occasions do companies contact us about?

Six situations we see in our mandates.

Onboarding and growth

New employees, sites or teams need to know the same line on handling customer, employee, applicant and user data.

Business units with risk

HR, marketing, sales, customer service, IT and product need concrete answers on disclosure, erasure, access, tools and incidents.

Evidence and audit pressure

Management, data protection officers, major customers, investors or auditors demand robust awareness training and documented participation.

New tool or AI

New applications change data flows, roles, access and approvals. In our experience, a general briefing is then not enough.

Data breach prevention

Employees must recognise when an incident needs to be escalated internally and which communication would be risky.

Leadership and responsibility

Management, team leads and project leads must know when data protection becomes a question of organisation, liability and decision-making.

Training formats

Which format fits your risk?

Sometimes precise basic training is enough. Other companies need workshops, leadership formats or a concept for several sites. Content, depth and documentation must fit the processing.

Basic training

For onboarding and broad teams. The focus is on personal data, confidentiality, disclosure, access, erasure, incidents and secure communication.

Business unit workshop

For HR, marketing, sales, customer service, IT, product, agencies or platform teams. We cover processes, typical wrong decisions and internal escalation.

Leadership and management

For management and team leads. We cover organisational duties, resources, evidence, proximity to liability, approvals and contact with the DPO, customers and the authority.

Introducing tools and AI

For new systems. We cover data flows, roles, inputs, outputs, access, permissions, erasure and usage rules.

Results

What changes in the company after the training?

Good training reduces uncertainty where employees act. It prepares typical decisions and makes clear which risks must be passed on internally.

Clear behaviour

Teams act more confidently in standard situations and recognise incidents and borderline cases earlier.

Fewer shadow processes

Business units use fewer unreviewed tools and lists because they know whom to ask.

Robust evidence

Occasion, content and participation are documented and can be shown to customers, management and auditors.

Shared understanding

Legal, data protection, IT and the business unit speak the same language. Follow-up questions on audit, DPA, RoPA, DPIA or set-up become clearer.

Risks

Where does training lose its value?

In our experience, training is rarely missing altogether. The problem is training that stays abstract, does not fit the target group or cannot be traced later.

Content

Too general Slides on basic terms help little when HR, sales, IT and marketing decide differently.
No escalation path Teams must know when they may act and when data protection, the legal department, IT security or management must be involved.
No process reference Training must not stand apart from the actual landscape of tools, data and contracts.

Organisation

No evidence Without a documented target group, content, timing and participation, the training loses value in an audit.
No leadership If management only delegates data protection downwards, resources, priority and decisions are missing.
No follow-up Training uncovers gaps. A next step must follow: audit, RoPA, DPA, DPIA, data breach process or set-up.

Next routes

When is another data protection service a better fit?

Training fits when knowledge, behaviour and evidence are the focus. If documents, contracts or incidents are central, the case belongs on the more relevant route.

Audit or set-up

Data protection audit, if the actual status is to be reviewed. Data protection set-up, if a product, website or app needs approval before launch.

DPA or RoPA

Data processing agreement for service providers and cloud. Record of processing activities when there is pressure on documentation under Art. 30 GDPR.

External data protection officer

When data protection is to be organised as an ongoing function.

Data breach assistance

When an incident has already occurred. Training is then a later component of prevention.

data protection impact assessment

When the risks of a processing operation need to be assessed systematically.

Implement the AI Act

When AI literacy, roles, governance and obligations under the AI Act are the topic. For the broad framework: data protection law and IT law and digitalisation.

Legal framework

Is data protection training mandatory?

The GDPR contains no provision requiring annual training. The need follows from accountability and the duty to provide evidence under Art. 5(2) and Art. 24 GDPR and from the organisational measures under Art. 32 GDPR.

For data protection officers, Art. 39(1)(b) GDPR expressly mentions raising awareness and training the staff involved in processing. So ask whether your organisation demonstrably works without training.

Sources

General Data Protection Regulation (EUR-Lex) Art. 5, 24, 32 and 39 GDPR.
BfDI on Art. 32 GDPR Guidance on technical and organisational measures.
BayLfD on awareness-raising Notes on raising employee awareness.

Limits

What does training not replace?

Training strengthens behaviour. It does not replace a review of documents and incidents.

1
No incident review
After a data breach, incident review, notification decision and documentation belong first with data breach help. Training then consolidates reporting channels.
2
No substitute for documentation
RoPA, DPA and DPIA must be right on their own. Training shows where they are missing.
3
E-learning as a component
E-learning may be enough for the basics. In our experience, a standard module is not enough for business units, new tools or leadership. Complex digital business models need case work with the teams that design data flows.

What you should document as a minimum

Target group, date, format and occasion of the training.
Key content, trainer and participation.
For workshops, the processes covered, case questions and agreed escalation paths.

Your contact

Dominik Skornia, LL.B.

Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer

View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124

At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.

Reviews

What clients say

5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 28 October 2026

5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026

“I would like to thank Mr Skornia for solving my problem quickly. Top work. Thank you” (translated from German)

Gamadriada YT · Google

“Competent advice, fast response, thank you.” (translated from German)

Wolfgang Schmälzlein · Google

“I had already engaged Mr Bohne some time ago on a data protection matter and was very satisfied. Now my company became involved in a copyright dispute. Mr Bohne handled this matter quickly, reliably and professionally as well …” (translated from German)

DP RECHT · Google

FAQ

What do companies ask about data protection training?

Who in the company should be trained?

Everyone who processes personal data or helps shape data flows, in line with their role. In our experience, this affects HR, marketing, sales, customer service, IT, product, management and team leads. Not every target group needs the same depth.

Is a short e-learning course enough?

For basic awareness, e-learning can be one component. For business units, new tools, data breach prevention and leadership, a workshop led by lawyers is more robust.

How often should training take place?

That depends on risk, team changes, new tools, incidents and evidence requirements. Recurring awareness training is useful, along with training when things change, such as a CRM roll-out, AI approval, relaunch or new service providers.

Do you train online and on site?

Yes. Online, in person, as a workshop, leadership format, short session or modular series. What matters is which format reaches the target group and which evidence you need.

Is training useful after a data breach?

Yes, but not as a substitute for the incident review and notification decision. After the incident, it helps consolidate causes, reporting channels and future behaviour.

What does training by lawyers add?

We classify borderline cases, proximity to liability, regulatory risks, contractual aspects and documentation legally. We combine data protection with IT law, SaaS, platforms, AI, e-commerce and contracts. This matters when teams design data flows, select tools or prepare approvals.