Data security stopped being purely an IT department problem a long time ago. You can have the best firewalls, encryption and impeccably written policies — yet if an employee clicks the wrong link or sends a file to the wrong person, all those measures can be bypassed in a second.
The numbers confirm it: according to industry studies, roughly 82% of security breaches involve a human element. So the real question is not "are people a risk?" but "have I done anything to turn them into a defence?".
Why people are the preferred target
A serious attacker knows it is far easier to fool a person than to break a well-configured system. That is why most attacks are not "technical" but manipulative: an email that looks like it's from the boss urgently asking for a payment, a message imitating the bank, a call from someone pretending to be IT support.
They all use the same levers: haste, fear of getting it wrong, the wish to be helpful, and the assumption that "if it looks official, it is official". None of this is about intelligence — it's about context and habit. Which is exactly why it can be trained.
Where the link breaks, in practice
In day-to-day work, incidents rarely look dramatic. Most often they are mundane gestures:
- Clicking a phishing link or opening an infected attachment, from an email that looked legitimate.
- Weak or reused passwords across several accounts — one leak and every door opens.
- An email sent to the wrong recipient: a "Reply all" or a mis-autocompleted address, and personal data reaches the wrong people.
- Data in unsecured files: lists of people in Excel sheets shared over chat, stored on the desktop or uploaded to personal cloud.
- Shadow IT and uncontrolled AI: tools and apps used without approval, into which employees paste confidential data without realising.
- Sessions and screens left open in spaces accessible to others.
None of these require bad intent. They are shortcuts taken by busy people who were never helped to see where the red line is.
From weak link to first line of defence
An informed employee does the opposite: they notice when something "doesn't feel right", don't click, ask and report. They effectively become a security sensor. And an organisation with hundreds of such sensors is far harder to attack than one relying on technology alone.
Training that actually works shares a few traits:
- Role-based. The marketing person, the HR person and the IT person face different risks. Generic training for everyone is forgotten quickly.
- Short and repeated. Small, frequent sessions with real examples, instead of a marathon course once every three years.
- Practical. Phishing simulations and scenarios from the company's real life, not just quotes from the regulation.
- No punishment for reporting. If whoever reports a mistake gets told off, next time they'll hide it. A healthy culture treats reporting as a good thing.
We've written more on this in our articles on cybersecurity culture and human resource security in ISO 27001, if you want to go deeper.
What the GDPR actually requires
Training is not a "nice to have" extra — it follows directly from the law. Article 32 requires appropriate technical and organisational measures, and prepared people are a basic organisational measure. Article 39 gives the data protection officer (DPO) the express task of raising awareness and training staff. And the accountability principle (Article 5(2)) requires you not only to be compliant, but to be able to demonstrate it.
During checks, evidence of real training sessions is an important mitigating factor. A completely untrained team, by contrast, is hard to defend. For what employee data protection means in concrete terms, see our article on employee data protection in HR.
Tools that lighten the load
Good intentions are not enough; you also need a system that makes training simple and demonstrable. Two things help the most:
- Online courses, in plain language. On cursuri.infoshare.ro you get GDPR and security e-learning tailored to roles, with a certificate at the end and automatic records of who completed what and when — exactly the evidence you need at an audit.
- A platform that keeps everything in one place. On askGDPR.ro you have the self-assessment, the AI assistant and training management in the same place as the rest of your compliance, so you don't get lost among Word files.
If you want all of this coordinated by someone who knows your organisation, we also provide an outsourced DPO, and our GDPR services package includes building a training programme tailored to your risks.
In conclusion
The human factor is, by nature, neither a weak link nor a line of defence. It becomes one or the other depending on how much you invest in people. Prevention — a short training, a self-assessment done in time, a question asked of an assistant before a click — is always cheaper than a breach handled under the pressure of sanctions. And the company that understands this doesn't just avoid fines: it signals, in every interaction, that it treats people's data seriously.
Frequently asked questions
Do most data breaches really involve people?
Yes. Industry studies consistently show that around 74-82% of breaches have a human element at their root: a phishing click, a weak password, an email sent to the wrong recipient or a careless configuration. Technology matters, but attackers most often target people, not the firewall.
How often should employees be trained on GDPR?
The practical recommendation is: at onboarding, then at least once a year, plus whenever there are significant changes (new procedures, new tools, a relevant incident). Short, frequent sessions work better than one marathon course every few years.
Is GDPR training for employees mandatory?
The GDPR does not require a course with a specific name, but training follows directly from the law: Article 32 requires appropriate organisational measures, Article 39 gives the DPO the task of raising awareness and training staff, and the accountability principle (Article 5(2)) requires you to be able to demonstrate what you have done. In practice, having no training at all is hard to justify before the supervisory authority.
How do I prove training in the event of a supervisory check?
Keep evidence: attendance lists, session dates, the materials used and, ideally, the results of short knowledge checks. An e-learning platform keeps these records automatically, and a training register shows clearly who completed what, and when.
Turn your team into the first line of defence
Start with a free self-assessment on askGDPR.ro, train your people with our online courses and, if you wish, leave the coordination to an outsourced DPO.