> Acme Inc — GDPR Art. 39(1)(b) Training Record

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Purpose

This document records staff training on data protection matters as required by GDPR Article 39(1)(b). Acme Inc is committed to ensuring all personnel who process personal data understand their obligations under applicable data protection laws.

Legal Basis: Under GDPR Art. 39(1)(b), the Data Protection Officer is tasked with monitoring compliance, including "the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits."

## 2. Training Schedule

Training Type | Frequency | Target Audience | Duration
--- | --- | --- | ---
Onboarding Training | Within first week of employment | All new staff | 2 hours
Annual Refresher | Annually (Q1) | All staff | 1.5 hours
Breach Response Drill | Bi-annually (Q2, Q4) | Incident response team | 1 hour
DSAR Handling | Annually (Q1) | Customer support, legal, engineering | 1 hour
AI & Data Ethics | Annually (Q2) | Engineering, product, AI/ML teams | 1.5 hours
Payment Data Handling (PCI DSS) | Annually (Q1) | Finance, engineering, support | 1 hour
Role-Specific Deep Dive | As needed | Specialist teams | 1-2 hours

## 3. Core Training Topics

### 3.1 Data Protection Basics

- What constitutes personal data and special category data
- The six GDPR principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity & confidentiality, accountability)
- Lawful bases for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests)
- Data subject rights overview (access, rectification, erasure, restriction, portability, objection)
- Privacy by design and by default (Art. 25)
- International data transfers and safeguards
- Acme Inc's role as data controller/processor

### 3.2 Breach Procedures

- Definition of a personal data breach
- How to recognise a potential breach
- Internal escalation procedure (report within 4 hours to DPO)
- 72-hour supervisory authority notification requirement (Art. 33)
- Data subject notification requirements (Art. 34)
- Breach documentation and record-keeping
- Post-breach review and lessons learned

### 3.3 DSAR Handling

- Recognising a Data Subject Access Request (verbal and written)
- Identity verification procedures
- Response timeline (1 month, extendable to 3 months for complex requests)
- Information to include in responses
- Handling requests for erasure, rectification, and restriction
- When and how to refuse a request (manifestly unfounded or excessive)
- Escalation to the DPO

### 3.4 AI & Automated Decision-Making

- Transparency obligations for AI systems (Art. 22)
- Right to human intervention in automated decisions
- AI training data privacy considerations
- Bias detection and fairness requirements
- EU AI Act risk classification awareness

### 3.5 Payment Data Protection

- PCI DSS fundamentals and cardholder data handling
- Tokenisation and encryption requirements
- Secure payment processing procedures
- Incident handling for payment data breaches

### 3.6 Analytics & Tracking

- Cookie consent requirements (ePrivacy Directive)
- Anonymisation vs pseudonymisation of analytics data
- Data minimisation in analytics collection
- Third-party analytics provider obligations

### 3.7 Authentication & Access Data

- Secure credential storage and handling
- Session data and privacy implications
- Multi-factor authentication best practices
- Logging and audit trail privacy requirements

## 4. Training Sign-Off Sheet

Each staff member must sign off after completing each training module.

# | Employee Name | Role/Department | Training Module | Date Completed | Trainer | Signature
--- | --- | --- | --- | --- | --- | ---
1 |  |  | Data Protection Basics |  |  |
2 |  |  | Breach Procedures |  |  |
3 |  |  | DSAR Handling |  |  |
4 |  |  | Annual Refresher |  |  |
5 |  |  |  |  |  |
6 |  |  |  |  |  |
7 |  |  |  |  |  |
8 |  |  |  |  |  |

## 5. Annual Training Completion Tracker

### 2026 Training Year

Department | Total Staff | Completed | Completion Rate | Deadline
--- | --- | --- | --- | ---
Engineering |  |  |  | 2026-03-31
Product |  |  |  | 2026-03-31
Customer Support |  |  |  | 2026-03-31
Legal/Compliance |  |  |  | 2026-03-31
Marketing |  |  |  | 2026-03-31
HR/People Ops |  |  |  | 2026-03-31
Executive Team |  |  |  | 2026-03-31
Overall |  |  |  | 2026-03-31

## 6. Training Materials & Resources

Resource | Location | Last Updated
--- | --- | ---
Data Protection Handbook | [Internal link] |
Breach Response Playbook | `INCIDENTRESPONSEPLAN.md` |
DSAR Process Guide | `DSARHANDLINGGUIDE.md` |
Privacy Policy | `PRIVACY_POLICY.md` |
Data Protection Policy | `DATAPROTECTIONPOLICY.md` |
DPO Handbook | `DPO_HANDBOOK.md` |

## 7. Assessment & Certification

### Post-Training Assessment

Each training module concludes with a short assessment:

- Passing score: 80% or higher
- Retake policy: Staff who do not pass may retake after 7 days
- Records retention: Assessment results retained for 3 years

### Certification

Field | Details
--- | ---
Training Coordinator | Jane Mueller
Contact | dpo@acme-saas.com
Organisation | Acme Inc
Record Created | 2026-03-19
Next Review Date | [12 months from creation]

## 8. Non-Compliance

Failure to complete mandatory data protection training may result in:

1. Temporary suspension of access to systems containing personal data
2. Formal written warning
3. Disciplinary action in accordance with company policy

Managers are responsible for ensuring their team members complete training on schedule. The DPO (dpo@acme-saas.com) will provide monthly compliance reports to department heads.

This Training Record was auto-generated by Codepliant based on code analysis. Customise the training topics and schedule to match your organisation's specific data processing activities. Review with your DPO and legal counsel before use.