GDPR Training for Practice Staff - How to Train Your Team and Document It

You have a data protection policy, staff authorizations and a privacy notice in the waiting room. Does that mean GDPR is done? Not quite. Documents only work when the team knows what is in them and applies them daily. A receptionist who reads out a patient's appointment and diagnosis over the phone in front of a full waiting room can undo the best-written data protection policy in seconds. That is why staff training is not a nice-to-have but part of the data protection system - and something UODO asks about during inspections.

This article explains where the training obligation comes from, who to train and on what, how often to repeat it and - most importantly - how to document training so it serves as evidence of GDPR compliance.

Where the training obligation comes from

The GDPR contains no provision that literally says "train your employees once a year". The obligation follows from several general principles:

• Accountability - the controller must be able to demonstrate compliance. Trained staff plus a document confirming the training is one of the simplest proofs.
• The duty to implement appropriate organizational measures - the GDPR requires technical and organizational measures adequate to the risk. Staff training is a classic organizational measure, listed in practically every regulator guideline.
• Processing on the controller's instructions - authorized persons may process data only in line with the controller's instructions. To follow instructions, staff must first learn them - that is what training is for.

At a physiotherapy practice there is one more argument: you process health data, a special category of personal data. The more sensitive the data, the higher the standard of care - and the harder it is to defend having no training at all.

Who needs to be trained

Short answer: everyone who has any contact with patient data. In practice that circle is wider than it seems:

• Physiotherapists - they work with medical records daily, obviously.
• Reception and front desk - this is where most everyday risky situations happen: phone calls, handing out documents, a visible computer screen.
• People on civil-law contracts and B2B - the form of cooperation does not matter; access to data does.
• Interns and trainees - before they start, they go through at least an induction.
• Cleaning staff - someone cleaning alone after hours has physical access to rooms with records. They usually do not need full training, but should sign a confidentiality commitment and know the basic rules (e.g. no opening of records cabinets).

If you run the practice alone, you primarily train yourself - and evidence of diligence can be a certificate from a completed course or webinar and a dated note of reviewing your own GDPR documentation.

Training scope - what staff must know

GDPR training at a physiotherapy practice should not be a legal theory lecture. It should answer the question: "what exactly do I do differently in my daily work". A sensible program for a small practice looks like this:

Module 1: the basics - short and concrete

What personal data and health data are, who the controller is, what may be done with patient data and on what basis. Twenty to thirty minutes is enough - no citing articles, plenty of practice-floor examples.

Module 2: everyday risky situations

The most important part. Discuss with examples:

• Phone calls within earshot of patients - how to confirm a visit without announcing to the waiting room who is coming and why.
• Computer screens and documents on the counter - the rules from the clean desk policy.
• Giving information over the phone - who may be told that someone is a patient at all (spoiler: almost no one without verification).
• Releasing records - only to the patient or an authorized person, after identity verification.
• Private phones and messaging apps - no photographing of records, rules for contacting patients.

Module 3: what to do when something goes wrong

Everyone on the team must be able to recognize a personal data breach and know who to report it to internally, immediately. The controller's reaction time is short - you have 72 hours from becoming aware of a breach to notify UODO, so an employee cannot sit on a misdirected email for a week.

Module 4: role-specific rules

Reception needs different emphasis (identity verification, phone calls) than a physiotherapist (record entries, conversations in the treatment room). Ten minutes tailored to the role beats an hour of generalities.

How often to train

The law imposes no frequency, so common sense and risk decide. A proven scheme for a practice:

Training type	When	For whom
Initial training	Before access to data, first day of work	Every new employee, intern, contractor
Periodic (refresher) training	Once a year	The whole team
Ad hoc training	After a breach, after changes to law or procedures, after a new system rollout	People affected by the change
Short briefing	On a change of role or duties	The person changing scope

Initial training is best combined with signing the data-processing authorization and the confidentiality statement - the full document set is described in the article on staff authorizations.

How to document training - this is the core

From the accountability perspective, undocumented training practically does not exist. The documentation minimum is:

1. A training program - a dated list of topics covered. One page is enough.
2. A signed attendance sheet - who, when and in what form (on site, online) completed the training.
3. A participant statement - a sentence like: "I have familiarized myself with the personal data protection rules in force at the practice and commit to applying them", with a date and signature.
4. Training materials - the presentation or outline archived together with the attendance sheet.

Keep these documents in the GDPR binder next to the data protection policy and the register of authorizations. During a UODO inspection, the staff training question comes up almost every time - instead of explaining that "we talked about it at a meeting", you show a signed sheet and a program.

Example: At Tomasz's practice, a new receptionist took a call from a woman claiming to be a patient's wife and confirmed both his appointment and that he "comes in for spinal rehab after an injury". The caller turned out to be a stranger, and the patient filed a complaint. Tomasz had to assess the event as a potential breach. The analysis showed the receptionist had never received initial training - she had a signed authorization, but no one had told her how to verify callers. Since then the practice rule is: first the briefing and a signature on the sheet, then access to the scheduler.

External or in-house training?

You do not need to order expensive external training. For a small practice, in-house training run by the owner based on the practice's own GDPR documentation is entirely sufficient - provided it is prepared and documented. External training (an online course, an industry webinar) makes sense as a supplement for the owner: they are responsible for the system and should understand the topic more deeply than the team.

A good compromise is a mixed model: the owner refreshes their knowledge once a year on an external course, then personally runs a short refresher for the team, tailored to the realities of the practice.

How to check the training actually works

A signed attendance sheet proves the training happened - not that it worked. Simple verification methods for a small practice: a five-question quiz on everyday situations after the training (file the answers with the training documentation), observing the team for a week to see whether the rules became habits, role-playing two or three difficult situations from the past year during the refresher, and turning every incident - even a harmless one - into a five-minute reminder at the next team meeting.

This closes the full loop: you train, document, verify in practice and feed the conclusions into the next training. That is exactly what the accountability principle expects of a controller.

Frequently asked questions

Is GDPR staff training mandatory?

The law does not spell out a training duty directly, but it follows from the accountability principle and the duty to apply appropriate organizational measures. Staff training is routinely listed as a basic organizational measure, and its absence is hard to defend when processing health data. In practice: yes, train your team and document it.

How often should GDPR training be repeated at a practice?

A reasonable standard is initial training before a new person gets access to data, plus a yearly refresher for the whole team. Add ad hoc training after any breach, a significant procedure change or a new system rollout, such as an EMR or online booking.

Can the practice owner train the employees personally?

Yes. No provision requires an external trainer or a certificate. In-house training run by the owner based on the practice's GDPR documentation is fully sufficient, as long as there is a prepared program and the training is documented with a signed attendance sheet.

How do I document GDPR training for a UODO inspection?

The minimum is a dated training program, a signed attendance sheet, participant statements confirming familiarization with the data protection rules, and archived training materials. Keep the set together with the rest of the practice's GDPR documentation - inspectors ask about training at almost every inspection.

CTA: Don't want to build the training program and templates from scratch? The FizjoReady PREMIUM package contains complete GDPR documentation for a physiotherapy practice - the data protection policy, authorizations, registers and materials you can base your in-house team training on. See FizjoReady packages →

Related articles:
- Internal data protection policy - the document UODO will ask about
- Staff data-processing authorizations - who, when, how
- Clean desk policy - GDPR at reception and in the waiting room
- A data breach at your practice - you have 72 hours