Data Protection Training

Training, that helps in everyday work.

Employees and management confident in handling personal data, AI and NIS-2.

To the packages ↓

What we deliver

From obligation to advantage.

We train employees and management with hands-on sessions on GDPR fundamentals, AI law (EU AI Act) and NIS-2 obligations, common everyday mistakes and current threat patterns, on site or online.

  • GDPR fundamentals training for all employees
  • In-depth training for management and team leads
  • Training on the AI Act and NIS-2
  • Awareness training on phishing and social engineering
  • Role-specific training for HR, marketing and IT
  • Attendance certificate to document your obligation to train staff

How we work

From the need to the refresher.

  1. Step 01

    Needs assessment

    We clarify audience, prior knowledge, topic focus (GDPR, AI law, NIS-2) and sector-specific risks to tailor the content precisely.

  2. Step 02

    Delivery

    On-site or online training with real examples from your daily business instead of generic slides.

  3. Step 03

    Certificate

    An attendance certificate for your records, issued right after the session.

  4. Step 04

    Refresher

    On request an annual refresher session, plus an induction for new hires.

Your Invest

Three focus areas, freely combinable.

All training: €200 per hour plus €30 per participant, each plus VAT, regardless of topic. The boxes show what each one covers.

Data Protection Training

Fundamentals and in-depth GDPR training for employees and management.

Scope of services

  • GDPR fundamentals training for all employees
  • In-depth training for management and team leads
  • Role-specific content for HR, marketing and IT
  • Awareness training on phishing and social engineering
  • Attendance certificate to document your training obligation
  • Delivered on site or online
Request GDPR training →

AI Training

Legally sound day-to-day use of AI systems under the EU AI Act.

Scope of services

  • Risk classification of AI systems under the EU AI Act
  • Transparency and labelling obligations
  • Safe everyday use of AI tools, e.g. chatbots
  • Handling sensitive data in AI prompts
  • Foundation for an internal AI usage policy
  • Attendance certificate to document your training obligation
  • Delivered on site or online
Request AI training →

NIS-2 Training

Obligations, reporting channels and personal liability under the NIS-2 Directive and the German IT Security Act.

Scope of services

  • Overview of scope, obligations and deadlines
  • State-of-the-art risk management measures
  • Reporting process for significant incidents (24-hour deadline)
  • Personal liability of management
  • Tailored to management and IT decision-makers
  • Attendance certificate to document your training obligation
  • Delivered on site or online
Request NIS-2 training →

Combined

Topics can be combined, e.g. GDPR and AI law in one session, as well as training across multiple locations or languages at once.

Request combined training →

All prices plus statutory VAT. Travel costs for on-site training outside Frankfurt am Main and the Rhine-Main region on request.

Awareness & duty

Awareness as your most effective measure.

Even with technical safeguards in place, data breaches can happen, for example through a mis-addressed email, the wrong attachment or a phishing click. Regular training is therefore both a legal duty and the single most effective organisational safeguard. On-site training we hold in Frankfurt am Main and the Rhine-Main region, across Germany, and beyond that online.

Why training is mandatory

Raising staff awareness is an explicit task of the Data Protection Officer (Art. 39(1)(b) GDPR) and part of the technical and organisational measures under Art. 32 GDPR. The attendance certificate documents that you have met your accountability obligation.

Topics we cover

  • GDPR fundamentals for all employees
  • Phishing, social engineering and safe data handling
  • AI Act and NIS-2
  • Role-specific for HR, marketing, sales and IT
  • In-depth sessions for management and team leads

Practice, not slide decks

We train on typical mistakes from your everyday work rather than generic examples, on site or online, with an attendance certificate for your records.

More services

What else we cover.

From the blog

Further reading on the topic.

Do you need a training session?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What clients ask before a training session.

Is training legally required?
Art. 39(1)(b) GDPR requires the Data Protection Officer to raise awareness and train staff involved in processing.
How often does training have to be repeated?
The law does not prescribe a fixed cadence. In practice an annual refresher is advisable, plus an induction for new hires when they join.
Do you also train on AI law and NIS-2?
Yes. Alongside GDPR fundamentals training we offer in-depth sessions on the EU AI Act (risk classification, transparency obligations, see AI in the Workplace) and on NIS-2 (reporting duties, risk management, see NIS-2 Consulting), tailored to participants' roles.
How long does a training session take?
Fundamentals training typically takes 60 to 90 minutes; in-depth sessions for management or specific departments take 2 to 3 hours.
What fines and penalties are possible?
Several frameworks apply side by side. GDPR (Art. 83 GDPR). Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine. EU AI Act (Art. 99 of Regulation (EU) 2024/1689). Prohibited AI practices under Art. 5 EU AI Act, such as social scoring or emotion recognition in the workplace (Art. 99(3) EU AI Act): up to €35 million or 7 % of worldwide annual turnover. Breaches of the remaining obligations, such as the transparency and labelling duties in Art. 50 EU AI Act (Art. 99(4) EU AI Act): up to €15 million or 3 % of worldwide annual turnover. Incorrect, incomplete or misleading information given to authorities (Art. 99(5) EU AI Act): up to €7.5 million or 1 % of worldwide annual turnover. Whichever amount is higher applies. For small and medium-sized enterprises the lower of the two amounts applies instead (Art. 99(6) EU AI Act). NIS-2 (Directive (EU) 2022/2555, transposed in Germany in the BSI Act). Essential entities: up to €10 million or 2 % of worldwide annual turnover. Important entities: up to €7 million or 1.4 % of worldwide annual turnover. Whichever amount is higher applies. On top of that, management bears personal responsibility for implementing the risk management measures.