Nano-lesson · usually takes 2–3 minutes

Manage data safely (GDPR)

The essentials of personal data in everyday work — without the legal jargon.

Personal data is everywhere

The patient list on the trolley. The photo of the kids on your phone. The customer's address on the parcel. All of it is personal data — information about people, from names and National Insurance numbers to health details — and all of it is something we need to look after.

Everyday rules

Only share data with people who actually need it for the task.
Send sensitive information securely — not in an ordinary email to a personal address.
Store data in the right places (your workplace's systems) — not on a USB stick, personal phone or personal drives. Never take photos of patients, children or customer lists with your own phone.
Need to delete or dispose of something? Paper with personal data goes in the shredder — and on a computer, the recycle bin isn't real deletion. Ask IT for the correct way.

Does someone ask for personal data by email?

From HR — onboarding <hr.support@company-hr-portal.net>

Subject Please send the employee list with National Insurance numbers

Stop and check. Check the sender (here an unfamiliar company-hr-portal.net), and confirm through a known channel before you send National Insurance numbers or customer data — even when it looks like an internal request.

Does this look familiar?

If a breach happens (data sent to the wrong person, a lost laptop), tell your manager or IT the same day — a fast response limits the damage.

Remember

As little data as possible, to as few people as possible — and report breaches quickly.

What the research says

A large review of 69 studies shows that knowledge alone rarely changes habits on a busy day — fixed, secure routines do. So use your workplace's secure sending methods and systems rather than relying on memory when things are urgent.

Prümmer et al., Computers & Security 2024 (meta-analysis).

Question 1 of 3

A colleague from another department asks for the customer list with National Insurance numbers — "just by email, it's quickest". What do you do?

Send it by ordinary email — it's internal, after all Send it by email, but delete the email afterwards Send it via your workplace's secure route — and only what the colleague actually needs

Question 2 of 3

You discover that an email with personal data has been sent to the wrong recipient. What do you do?

Report it to your manager or IT the same day — even if it's embarrassing Recall the email in Outlook and consider the matter closed Ask the recipient to delete it — problem solved

Question 3 of 3

You need to share an employee list for a project. The recipient only needs names and departments — but your export also includes National Insurance numbers and salary. What do you do?

Send the whole thing, but note that they should ignore the extra columns Send the whole thing — then you avoid making a new export Remove the National Insurance numbers and salary, and send only names and departments

Well done!

You've completed one of the foundation courses — the ones everyone gets for free.

With a free login:

Your points, progress and course certificate are saved.
You get courses tailored to your role — not just the foundation courses.
We send training exactly when you need it — for example, as a follow-up to a phishing test.

Create a free login → ← See the other courses