Home › Blog › GDPR Training Records: What UK Employers Must Keep

GDPR Training Records: What UK Employers Must Keep

The ICO expects every UK organisation to demonstrate that staff have received data protection training. Here is exactly what records you need and how long to keep them.

Since the UK GDPR came into force, the Information Commissioner's Office has made clear that data protection training is not optional. Article 39 of the UK GDPR requires Data Protection Officers to oversee staff training, and Recital 39 emphasises that employees handling personal data must be made aware of the risks involved. In practice, this means all UK employers — not just those with a DPO — should be running and recording GDPR training.

What training records must you keep?

There is no single prescribed format, but the ICO expects organisations to demonstrate accountability under Article 5(2) of the UK GDPR. Practically speaking, your training records should capture:

• The name of the employee who completed the training.
• The date the training was completed.
• The type or title of the training (e.g. 'GDPR Awareness', 'Data Handling Procedures', 'Phishing & Cyber Security').
• The delivery method — in-person, e-learning, webinar.
• The provider or trainer name.
• Whether the employee passed any associated assessment, and the score where applicable.
• The certificate or completion evidence (PDF, screenshot, or signed attendance sheet).

How long must you keep GDPR training records?

The UK GDPR does not specify a mandatory retention period for training records, but most UK data protection advisors recommend retaining them for the duration of the employee's employment plus at least two years after they leave. This ensures you can demonstrate compliance during an ICO investigation even if the complaint is raised after someone has moved on.

Some organisations retain records for up to six years to align with general limitation periods under the Limitation Act 1980, particularly where personal data processing touches on financial or contractual matters.

When should staff re-complete GDPR training?

The ICO does not set a mandatory refresh interval, but best practice guidance from the DCMS and ICO suggests:

• All new starters should complete basic GDPR awareness training within their first month.
• All staff should complete a refresher at least every two years, or sooner if there is a significant change to how you process data.
• Staff in high-risk roles (HR, finance, marketing, IT) should complete more detailed role-specific training annually.
• After any data breach incident, affected teams should receive targeted remedial training.

What an ICO audit looks like

If the ICO investigates a data breach or responds to a complaint about your organisation, one of the first things they will ask for is evidence that your staff received data protection training. A common and expensive mistake is discovering that your training records exist in a dozen different places — an email here, a spreadsheet there, a PDF on someone's hard drive — and cannot be produced quickly.

Organisations that have a single, auditable record of all training completed — with timestamps, certificate attachments, and expiry dates for roles requiring annual renewal — are far better placed to demonstrate compliance and avoid enforcement action.

Practical steps to get compliant

1. Audit your current GDPR training records: who has completed training, when, and do you hold the evidence?
2. Identify gaps — new starters who haven't been trained, and staff who completed training more than two years ago.
3. Book or deliver refresher sessions and record completion with dates and evidence.
4. Centralise all records in one system — not a spreadsheet. You need to be able to produce records at short notice.
5. Set calendar reminders (or use software that does it automatically) for upcoming renewals.
6. Review your records policy so departing employees' training histories are retained for the required period.