When Gladsaxe Municipality needed to train around 7,000 employees in GDPR, one of the requirements was that the course had to make sense to everyone, from administrative staff to childcare workers and social and healthcare assistants. They all handle personal data every day, just in very different situations.
That is true for most organisations. The rules are the same for everyone, while the risks show up in different places in the working day, for example when Outlook suggests the wrong recipient, or when a SharePoint link is set to “Anyone with the link”. Employees don’t need to know the GDPR by heart, but they do need to recognise those situations and know what to do.
What do the GDPR rules cover?
The GDPR is the EU’s General Data Protection Regulation. In Denmark, it is supplemented by the Danish Data Protection Act. When people talk about the GDPR rules, they usually mean the full set of rules for processing personal data.
Processing covers almost anything you can do with the data. An employee processes personal data when they receive a job application, create a customer in the CRM system, share a list of event attendees or send an email about a colleague’s sick leave. That is why the rules apply in every department, including sales, marketing, customer service and finance.
What counts as personal data?
Anything that can be linked to a specific person. That includes name, work email and phone number, but also photos, IP addresses and comments in a CRM system.
Sometimes the information hides in something that looks harmless. A calendar invite titled “Meeting about long-term sick leave” reveals something about a colleague’s health, even if the rest of the invite is empty. An attendee list with job titles and areas of interest says more about the people on it than a plain list of names does.
Health, religion, political opinions, trade union membership, sex life, genetics and biometrics are specially protected data, and national ID numbers and information about criminal offences have their own rules. If an employee comes across this kind of data in a task, they should talk to your DPO or compliance manager before going any further.
Only share and keep what is needed
Data minimisation is one of the core principles of the GDPR. You may only collect and use the data that is necessary for a specific purpose. That sounds simple until marketing wants a date of birth field in a form because it might be useful later, or sales exports the entire CRM database to use 40 contacts.
The purpose also limits what the data can be used for afterwards. Event attendees gave you their details for the event. If you also want to add them to your newsletter, you need a separate legal basis.
Before personal data is sent or shared, it is worth checking three things:
- Is this the right recipient, and do they actually need the data?
- Can more people than necessary open the link or document?
- Does the file contain more than the recipient needs?
The last one is easy to miss. HR can send salary details to the right manager and still share too much if the spreadsheet covers the whole department.
The GDPR has no single deletion deadline, so it is up to the company to decide how long different types of data can be kept. Employees need to know those deadlines and remember that a file in SharePoint may also sit in a downloads folder and as an attachment in several inboxes.
When something goes wrong
A personal data breach is far more ordinary than the name suggests. An email sent to the wrong person is a breach, and so is a spreadsheet deleted by mistake or a document that unauthorised people can open.
As a starting point, the company must report a breach to the Danish Data Protection Agency (Datatilsynet) within 72 hours of becoming aware of it (GDPR Article 33). According to Datatilsynet’s guidance on personal data breaches (in Danish), a company is generally considered aware of a breach as soon as one of its employees is. In other words, the clock can start the moment someone notices the email went to the wrong person.
The most important thing an employee can do is tell whoever handles data breaches in your organisation straight away, even when it feels embarrassing. It is up to that person to decide whether the breach needs to be reported. A culture where people dare to report their own mistakes matters just as much as the rules themselves.
Consent
Consent is one of six legal bases for processing under the GDPR. Valid consent must be freely given, specific and informed, and it must be possible to withdraw it. Between employer and employee, that is hard to achieve, because employees are rarely completely free to say no. Employees should therefore use the consent wording and processes the company has already approved, rather than writing their own.
Requests from customers and applicants
“What do you actually know about me?” can sound like an ordinary customer service question. It can also be a subject access request, which according to Datatilsynet’s guide to the right of access (in Danish) the company must generally answer within one month. The same applies when someone asks to have their data deleted or corrected, or asks where you got their email address. Customers rarely use legal terms, so employees need to recognise these requests in everyday language and pass them on the same day.
GDPR and AI tools
Generative AI has made an old GDPR question more pressing: where does the data end up when you share it with an external tool?
Imagine an HR employee who pastes a CV and their interview notes into a free chatbot to get help writing a rejection. It saves ten minutes, but the candidate’s data has now been processed by a service the company may never have assessed or signed a data processing agreement with. Depending on the service’s terms, the text may be stored or used to train the model.
Employees need a clear line. Using an approved tool to reword a generic text is usually fine. Customer data, CVs, health information and HR cases should only go into an AI tool if that use has been specifically approved. Exactly where the line goes depends on your tools and agreements, so it belongs in your internal guidelines.
Training that looks like your employees’ working day
GDPR training works best when the examples look like what employees actually deal with.
At Gladsaxe Municipality, we replaced the generic examples in our GDPR course with dilemmas from the municipality’s own day-to-day work, and the course was given the municipality’s visual identity. All content was also delivered as micro-chapters the municipality can use in intranet campaigns when a topic becomes relevant.
AP Pension chose a course of seven modules and around 60 minutes in Danish and English, with versions for different audiences and roles. At Finansiel Stabilitet, the previous compliance training was time-consuming and inflexible. Their GDPR training now consists of short courses and microlearning with regular refreshers.
Get started
Grape’s GDPR course is built on your own policies and examples and is available in Danish, English and more languages on request. Get in touch if you would like to see what it could look like for your organisation.
