GDPR turned eight in May 2026. Long enough that “we’re still bedding it in” has stopped being a credible excuse, and long enough that most businesses assume the basics, like staff training, are sorted. A survey published by VinciWorks at the end of May 2026, covering 198 compliance professionals, suggests otherwise.
What the survey found
Roughly 9% of organisations reported having no data protection training at all. Among the rest, only 22% rated their training as very effective. Over half, 52%, described it as just “OK”, and a further 11% said their existing training is not very effective. Put together, a small minority have nothing, and a clear majority have something that nobody involved is actually confident is working.
Why “OK” is the more dangerous number
No training at all is an obvious gap, the kind a basic audit catches in minutes. “OK” training is quieter. It exists, it gets completed, a certificate gets filed somewhere, and everyone moves on assuming the box is ticked. The problem surfaces later: content nobody has refreshed since it was bought, no record of who actually did it, no date for when a refresher falls due. That is less a training problem than a record-keeping problem wearing a training problem’s clothes.
It matters because the ICO does not treat training as a nice-to-have. Its own accountability framework lists “training and awareness” as one of ten categories it audits against, and its guidance is specific: organisations should keep copies of training material, records of who received it, and evidence that people understood it, not just a note that a session once happened. In an investigation, the absence of that evidence is itself the finding.
Why the stakes just went up
Two trends make this a worse year than usual to be vague about training.
First, ICO fines got much bigger. A round-up by law firm Trowers & Hamlins put the average fine issued by the ICO in 2024 at around £380,000. In 2025 that average jumped to just under £3 million. Every GDPR fine issued in 2025 followed a cyber-attack, including a £14 million penalty against Capita and a £3.07 million penalty against Advanced Computer Software Group after an attack that affected NHS and social care systems. Fines that size used to be reserved for the largest organisations in the country. They no longer are.
Second, there are simply more incidents for a fine to attach to. The National Cyber Security Centre’s 2025 annual review recorded 204 nationally significant cyber attacks against the UK in the year to August 2025, up from 89 the year before. Within that, incidents at the more serious “highly significant” level rose almost 50% on the year, the third year running that figure has climbed. More incidents means more chances for a phishing email or a social-engineering call to land on someone who was never properly trained to spot it, and more organisations ending up explaining their training records to a regulator after the fact.
What to actually do about it
- Stop treating “we did training once” as done. If there is no date for when it happened and no date for when it is due again, it is not a programme, it is a memory.
- Keep a record, not just a memory. Who was trained, on what, when, and when their refresher falls due. That is the specific document an auditor or investigator asks for, not a general assurance that “staff are aware”.
- Match the training to the role. Someone who handles subject access requests or breach response needs more than the general induction session everyone else gets.
- Revisit content, not just attendance. A course bought three years ago will not mention the Data (Use and Access) Act or anything else that has changed since. Completion of an outdated course is not the same as current awareness.
- Treat phishing awareness as part of data protection training, not a separate IT concern. Given where the 2025 fines came from, the two are the same training in practice.
None of this requires picking a specific course provider, that choice depends on your sector and budget. What it does require is a register: who, on what, when, and when next. If you want to see where your own records currently stand, our free GDPR check takes about two minutes.