GDPR awareness training: one video per everyday gesture

This guide is for DPOs, legal, HR and L&D teams who want data protection rules applied at the desk, not just known. It recalls where the obligation comes from, then outlines a video series.

Where the obligation comes from

In one sentence: GDPR gives the data protection officer the task of awareness-raising and training of staff, and requires that anyone with access to personal data processes it only on instructions.

• Article 39(1)(b). Among the DPO’s tasks: monitoring compliance, including “awareness-raising and training of staff involved in processing operations”.
• Article 32(4). The controller takes steps to ensure that any person acting under its authority with access to personal data does not process it except on instructions.
• Article 24. The controller must be able to demonstrate compliance: a record of awareness actions is part of that.

What a good GDPR series covers

Principles (lawfulness, minimisation, retention) speak to lawyers. For everyone else, start from gestures. Six one-minute videos:

1. Sending a file. A customer spreadsheet goes to the wrong address. What to do before: check the recipient, share a protected link rather than an attachment. What to do now: tell the DPO at once, since a breach is notified to the authority within 72 hours when it poses a risk (Article 33).
2. Collecting only what you need. A form asks for a date of birth “just in case”. The rule: no data without a planned use.
3. Handling an access request. A customer asks what data you hold on them. The reflex: pass it to the DPO, the deadline is short (one month, Article 12).
4. Filing and deleting. The “Old” folder on the shared drive. Retention periods exist, and so do local copies.
5. Unapproved tools. Pasting customer data into an unapproved online tool, AI assistants included, takes it out of the company.
6. Who to contact. The DPO’s name and address, and the line to remember: “when in doubt, ask first”.

Each video follows the same structure: the situation, the mistake, the right gesture, the person to contact.

How to make it with EducPilot, in three steps

1. Upload your documents: the data protection policy, the breach procedure, extracts of the record of processing activities for concrete examples (remove personal data first). A page from your data protection authority can be added by its web address.
2. Approve the plan. Check deadlines and names: each sentence links to the passage of your documents that supports it.
3. Correct by annotating, then share. The DPO reviews from a link, without an account, and pins notes on the frame (“say: within 72 hours of becoming aware of it”). MP4 in 1080p, 16:9 or 9:16.

Sources

• Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex, Articles 12, 24, 32, 33 and 39.
• CNIL, Personal data security guide, 2024 edition (in French), sheet 3 on involving and training users.