In short: Security awareness training is not mandatory by name for every UK organisation, but it is expected almost everywhere. UK GDPR requires appropriate organisational measures, and the ICO expects initial and refresher training. Sector rules such as the DSPT, the RPA for academies and FCA resilience rules, plus ISO 27001, insurers and contracts, add specific expectations.
The short answer
For most UK organisations, the honest answer is "not in those words, but in practice yes". The law rarely names a course. Instead it requires you to take appropriate measures for the risks you face, and regulators, auditors and insurers treat staff awareness as one of the most basic of those measures.
Two things follow from that:
- The requirement is risk-based, so what counts as enough depends on your size, sector and the data you hold
- Evidence matters as much as the training: if you cannot show who was trained, on what and when, it is hard to argue the measure was in place
This page is general information, not legal advice. Use it to work out which expectations apply to you, then follow the links to the detailed pages.
UK GDPR and the ICO
UK GDPR requires controllers and processors to implement appropriate technical and organisational measures to keep personal data secure (Article 32), and to be able to demonstrate compliance (the accountability principle). The law does not list the measures, so what is appropriate depends on your processing and its risks.
The ICO's security guidance is more direct. It says organisations should provide appropriate initial and refresher training, aim to build a culture of security awareness, and help staff recognise attempts to obtain personal data by deception, including phishing. Where an organisation has a data protection officer, UK GDPR includes awareness-raising and staff training among the DPO's tasks.
After a breach, one of the first questions is usually whether the people involved had been trained. Read more in GDPR training for staff. The Data (Use and Access) Act 2025 has amended parts of UK data protection law and the ICO is reviewing its guidance in response, but the security principle and the need for appropriate measures remain.
Sector rules that go further
Some sectors have specific expectations on top of UK GDPR:
| Sector | What applies | Our guide |
|---|---|---|
| Health and care | The Data Security and Protection Toolkit (DSPT) expects all staff to have an appropriate understanding of information governance and cyber security, planned through a training needs analysis; the old fixed 95% target was removed from 2023/24 | SAT for healthcare |
| Schools and academy trusts | The DfE cyber security standards expect annual training, and the Risk Protection Arrangement's cyber cover conditions include NCSC training for staff and governors with IT access | SAT for schools |
| Financial services | FCA operational resilience rules and senior management accountability make people-driven cyber risk a governance matter; DORA applies to in-scope EU entities | SAT for financial services |
| Law firms | The SRA Code of Conduct for Firms expects firms to manage material risks and keep staff competent | SAT for law firms |
| Essential and digital services | The NIS Regulations 2018, assessed for many operators with the NCSC's Cyber Assessment Framework, which covers staff awareness and training; the Cyber Security and Resilience Bill, introduced in November 2025, would reform and extend them, so check its current status | SAT for the public sector |
| Card payments | PCI DSS requirement 12.6 calls for a formal security awareness programme, with training on hire and at least once every 12 months for staff in scope | SAT for retail and hospitality |
Rules in these areas change often, so always check the current version with the regulator or your adviser.
Standards, insurers and contracts
Even where no regulator is involved, three groups commonly ask for evidence of training:
- Certification standards: ISO/IEC 27001 requires staff awareness and has a specific Annex A control for awareness, education and training. See information security awareness training
- Cyber insurers: proposal forms often ask whether staff are trained and phishing-tested, and inaccurate answers can affect a claim. See security awareness training for cyber insurance
- Customers and supply chains: security questionnaires and tenders regularly ask how you train staff and how often
Cyber Essentials is the notable exception: it has no staff training control at all, although training helps you keep its controls in place. See Cyber Essentials and security awareness training.
How to work out what applies to you
A short review usually shows which expectations matter most:
- List the personal and confidential data you hold and who can access it; UK GDPR applies to almost everyone
- Check whether a sector regulator or scheme applies, such as the DSPT, the DfE standards and RPA, the FCA, the SRA or PCI DSS
- Read your cyber insurance proposal form and policy wording for questions or conditions about staff training
- Collect the security questionnaires and contract clauses your customers have sent you
- Note any certification you hold or are working towards, such as ISO/IEC 27001
- Set one programme that meets the strictest expectation, so a single set of records answers them all
What good evidence looks like
Whatever drives your requirement, the same records answer most questions:
| Record | Why it helps |
|---|---|
| Training assigned and completed, per person, with dates | Shows coverage and that training is refreshed, not one-off |
| Induction completion for new starters | Shows people are trained before or soon after they get access |
| Phishing simulation results and trends | Shows training is tested and behaviour is improving |
| Policy acknowledgements | Shows staff have read and accepted acceptable use and data handling rules |
| A short training needs analysis or plan | Shows the programme is based on your risks, as the DSPT and ISO 27001 expect |
| Board or management reports | Shows leaders oversee the risk, as the Cyber Governance Code expects |
A platform produces most of these automatically. The NCSC's guidance is a good basis for the content itself.
How we help
We map the expectations that apply to you, then build a programme that meets them and keeps the evidence: role-based training, regular simulations, policy sign-off and reports you can hand to an auditor, insurer or customer. We are vendor-independent and recommend the platform from the vendors we supply that fits your size and sector, then run it through our managed security awareness training service.
Contact us to review what your organisation needs to show.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is security awareness training a legal requirement in the UK?
Not by name for every organisation. UK GDPR requires appropriate organisational measures to protect personal data, and the ICO's guidance expects initial and refresher training, so in practice most organisations that handle personal data need it. Some sectors, such as health, education and financial services, have more specific expectations. This is not legal advice.
Does UK GDPR require staff training?
UK GDPR does not prescribe a course, but it requires appropriate technical and organisational measures and the ability to demonstrate compliance. The ICO's security guidance says organisations should provide appropriate initial and refresher training, including on recognising phishing.
How often should staff complete security awareness training?
At induction and at least annually, which is what several UK frameworks expect, with short refreshers and phishing simulations through the year. The NCSC recommends small, frequent sessions rather than one long annual event.
Does Cyber Essentials require security awareness training?
No. Cyber Essentials covers five technical controls and has no staff training control. Training still helps, because people who understand the controls are less likely to undo them.
What records should we keep to prove training?
Keep per-person completion records with dates, induction records, phishing simulation results, policy acknowledgements, a short training plan and the reports you give to management. Most training platforms export these.