Now is the time to ask for the training budget
Making the most of a moment when attention is focused on privacy
5 minute read
Recent events have been a timely reminder that data protection incidents do not always originate from technical vulnerabilities or complex cyber attacks. Sometimes they begin with an individual making a decision, responding to a request, following a process, or simply trying to do their job.
While every incident has its own circumstances, a familiar pattern has emerged. Personal data is not always exposed because someone was careless. It can be the result of persuasion, time pressure, competing priorities, or a request that appears entirely legitimate.
For those of us working in privacy, that poses an important question. If people continue to be one of the main routes through which personal data is compromised, are we investing enough in helping them spot risks, challenge what does not feel right, and know what to do when something seems unusual?
The annual training problem
Most organisations I have worked with require data protection and cyber security training once a year. It sits in the learning portal alongside anti-bribery, health and safety, modern slavery, equality and diversity, and whatever else the year has added. A deadline is set, reminders go out, and completion rates are reported upwards.
Whilst completion rates are useful, they show that the training was done. They tell us very little about whether anyone took something away from it. I suspect most of us have seen, and perhaps been, the person clicking through a module in the gap between meetings so the reminder emails stop. That is no reflection on staff. When everything is mandatory and everything arrives at once, it all starts to blend together.
The attacks in the headlines are not waiting for the annual refresher. A fraudulent request from a convincing domain, or a message from someone who sounds like a colleague or supplier, relies on a moment of trust under time pressure. That is why awareness needs to be reinforced regularly, not just once a year.
Why now is the time to ask
If there has ever been a time for privacy leaders and their teams to ask for more budget, I think it is now. Boards and executive teams have seen these stories. They have seen a share price move on the back of a single push notification, and if your organisation is not already talking about this, I would be surprised. If they are not aware, tell them. The conversation about what a breach costs is no longer theoretical, and that gives privacy teams an opening that may not stay open for long.
My suggestion, however, is not to lead with the fact that the privacy team is stretched. Most organisations already know their teams are busy, and if that alone has not unlocked additional investment, it is unlikely to do so now.
Instead, make the case for what more could be achieved. Additional resources creates the capacity to spend more time on the preventative work we all know matters, including more meaningful engagement with the business, regular awareness activities, in-person training sessions, open Q&A discussions, and realistic simulations that help people recognise and respond to suspicious requests. In other words, ask for the budget to reduce risk, not simply to manage workload. The extra pair of hands will make that possible.
We all learn from experience
Some people learn best by reading, others by doing. Whilst that is true, most of us learn most effectively through experience. Very few people forget the first time they nearly fell for a scam, or the first time they sat in a room trying to work out whether an incident needed to be reported to the ICO within 72 hours.
That is why awareness should be about more than an annual training module. Regular engagement with the business, in-person discussions, Q&A sessions and realistic exercises all help to bring the risks to life.
Simulation gives people the opportunity to gain that experience without the real-world consequences. In practice, it could include:
phishing and social engineering exercises, including requests that appear to come from regulators, law enforcement or senior colleagues
scenario walk-throughs where teams decide whether what they are looking at is a personal data breach
tabletop exercises that take a breach from discovery through containment, risk assessment, notification and communication with customers
short, regular refreshers that reflect current events and emerging threats, rather than relying on a single annual training session
If people have already experienced what it feels like to spot a scam, recognise that something has gone wrong, or manage the first hours of a breach, they are far more likely to respond well when faced with the real thing.
Working with cyber security
This is also an opportunity to work more closely with cyber security colleagues. Many security teams already run phishing simulations. Privacy teams bring an understanding of what personal data is at stake, the regulatory obligations and the impact on individuals. Combining the two creates exercises that feel more relevant to the business and better reflects how incidents unfold in practice.
There is another benefit that is easy to overlook. Privacy teams are often small and stretched, and some are a team of one. A workforce that knows what to look for and feels confident raising concerns tends to escalate issues earlier and with better information. That can make a significant difference in the first hours of an incident, when the privacy team is trying to understand what has happened, assess the risks and decide what action needs to be taken.
A realistic view
Simulation will not suit every organisation or every environment in the same way. Budgets differ, cultures differ, and some sectors will need to think carefully about how realistic an exercise can be. A simulated phishing exercise can damage trust if it feels like a trap, so it should be approached as a learning opportunity, with support, feedback and no blame.
Even so, I still think now is the time to push for that little extra. The consequences of a breach, from customer complaints and regulatory scrutiny to media attention and the pressure placed on the people managing the response, are something no organisation wants to experience. Investing in awareness, engagement and practical exercises is often a far smaller commitment than dealing with the aftermath. Not every organisation will have the capacity to do more with its existing team. Sometimes an extra pair of hands can make all the difference, creating the time and space needed to focus on the preventative work that is so often pushed down the priority list. Whether that support comes from within the business or from outside it, investment in meaningful engagement, training and testing is rarely wasted.
The organisations that navigate incidents best are not necessarily those with the biggest privacy teams. They are more likely to be the ones that have invested in helping their people recognise risks early, raise concerns confidently and respond in a way that feels familiar when it matters most.
Creating the space for proactive privacy work
Awareness, engagement, training and testing all take time. If you're looking to create more capacity within your privacy function, an independent perspective can help identify priorities, opportunities and areas for investment. Additional support can also provide the extra pair of hands needed to deliver awareness activities, strengthen governance and progress the preventative work that too often slips down the priority list. The challenge is rarely knowing what needs to be done. More often, it is finding the time and capacity to do it well.
Next, I'll be looking at ‘Who's Watching the Workplace Watchers?’
Stay in the loop
If you found this useful, subscribe to the Roseline Data Privacy monthly newsletter and never miss out on our practical data privacy insights, updates, and tips delivered straight to your inbox. No noise, just what matters.