Information & Data Security
Data protection under the GDPR for all employees and individual departments, information security in day-to-day work, and the new EU requirements DORA, NIS-2, and the Cyber Resilience Act. From basic awareness raising to setting up an ISMS.

Data Protection (GDPR)
Data protection breaches are usually caused not by technology but by human error. You learn which requirements arise from the GDPR and how you avoid violations.

Information Security
Anyone who protects information and recognizes risks early can avoid typical attacks in the age of AI. You learn what matters when handling data, passwords, and access credentials securely.

DORA: IT Risk Management in Banks and Insurance Companies
The Digital Operational Resilience Act has applied directly to banks, insurance companies, and other financial entities since January 2025. You learn about ICT risk management, incident reporting, resilience testing, and third-party risk management.

NIS2/KRITIS: Applicability, Registration, Documentation
With NIS-2, the number of regulated companies in Germany grows to around 30,000 entities. You learn to check whether you are affected and to implement registration and reporting obligations.

Cyber Resilience Act: Requirements for Hardware and Software
The Cyber Resilience Act imposes security requirements on hardware and software with digital elements throughout their entire life cycle. You learn how conformity assessment, reporting obligations, and CE marking work.

ISMS Based on ISO 27001: Setup and Evidence
An information security management system based on ISO 27001 has to work in everyday operations and be verifiable in an audit. You learn to structure the scope, risk assessment, controls, and certification according to ISO.

Data Protection in Healthcare
Under Art. 9 GDPR, the health data of patients and employees belongs to the categories of data that require special protection. You learn the rules for confidentiality, providing information, access to records, and digital communication.

Data Protection in Marketing and Sales
Marketing and sales work with personal data every day, and the GDPR, UWG, and TDDDG set tight limits in this regard. You learn the rules for advertising, consent, tracking, CRM, and lead generation.

Data Protection in the HR Department
Across the entire employee lifecycle, the HR department processes the most sensitive data in the company. You learn which employee data you may collect, store, and share.

Data Protection for Managers
Managers bear data protection responsibility for their team and for ensuring that their area works in compliance with the GDPR. You learn to organize access rights, instructions, controls, and the handling of incidents.
Training Concept
Anytime and anywhere thanks to
adaptive e-learning
Multimodal, with learning objectives, video sequences, and knowledge quizzes
Audit-proof issuance after a knowledge check
Depending on the course, between 20 and 150 minutes
More than 30 languages
Content regularly reviewed by subject matter experts for maximum regulatory compliance
Our Expert Team
Every training topic is designed and reviewed by renowned subject matter experts who have both sound theoretical knowledge and extensive practical experience.



.webp)









Frequently Asked Questions
Here you will find the key answers on GDPR training obligations, NIS-2 requirements, and protection against the most common cyber threats in the workplace.
Yes – data protection training for employees is effectively mandatory under the GDPR, even though the Regulation does not set out an explicit training obligation for all employees. Art. 39 (1) lit. b GDPR expressly obliges the data protection officer to raise awareness among and train the staff involved in processing operations. In addition, there is Art. 32 GDPR, which requires appropriate technical and organisational measures – training is regarded as a key organisational measure. The accountability obligation under Art. 5 (2) GDPR also requires the controller to be able to demonstrate compliance with the data protection principles – without documented training, this proof can hardly be provided in practice.
The most common cyber threats that employees need to be trained on today almost always target the human factor. According to the BSI situation report and the Verizon Data Breach Report, the biggest risks are: phishing and spear phishing (targeted emails to obtain login credentials), CEO fraud or business email compromise (fake instructions from supposed superiors), ransomware (often introduced via infected attachments or links), social engineering (manipulation of employees by phone or chat), identity theft and insecure passwords, as well as risks from mobile devices, USB sticks, and public Wi-Fi networks. Effective training raises employees' awareness of the typical warning signs, teaches safe behavior when handling emails, passwords, and data, and shows clear reporting channels for security incidents.
In the event of a data breach, missed data protection training can significantly aggravate the legal and financial consequences for the company. Added to this are civil claims for damages by data subjects under Art. 82 GDPR, possible criminal proceedings for intentional violations, and significant reputational damage. In practice, the central question after an incident is almost always: "Can you prove that you trained your employees?" – anyone who cannot prove this is in a difficult position.
The NIS-2 Directive (Network and Information Security Directive 2) expressly requires the companies concerned to train their employees regularly in cybersecurity. Art. 21 (2) lit. g NIS-2 lists "cyber hygiene practices and cybersecurity training" as one of the central risk management elements. Particularly strict requirements apply to management: under Art. 20 NIS-2, managers must participate in training themselves and are personally responsible for implementation. In Germany, around 30,000 companies from 18 sectors are affected, including energy, health, finance, digital infrastructure, and manufacturing, above certain size thresholds. Transposition into German law takes place through the NIS-2 implementation act (NIS2UmsuCG); violations can be punished with fines of up to 10 million euros or 2% of worldwide annual turnover.
As a rule, data protection and IT security training should be repeated at least once a year – even though neither the GDPR nor NIS-2 sets a specific interval. The background: threat situations, attack methods, and legal requirements change continuously, so one-off training quickly becomes outdated. In addition, training prompted by specific occasions is mandatory – for example when new IT systems are introduced, after security incidents, in the event of significant changes in the law, or when onboarding new employees. For employees in particularly sensitive areas such as IT administration, HR, or accounting, shorter intervals and in-depth modules are advisable.
GDPR training for general employees and training for data protection officers (DPOs) pursue different objectives and differ accordingly in depth, scope, and target group. Employee training is awareness raising: in 20 to 45 minutes, it teaches the most important principles of the GDPR, data subject rights, handling personal data in day-to-day work, how to act in the event of data breaches, and the internal contact persons. DPO training, on the other hand, is a professional qualification: according to common standards (e.g., those of the BvD or TÜV), it spans several days and provides in-depth knowledge of legal bases, technical and organisational measures (TOMs), data protection impact assessments, processing on behalf of controllers, international data transfers, and communication with supervisory authorities. The DPO qualification is a professional requirement under Art. 37 (5) GDPR – combined with an ongoing obligation to undertake continuing professional development.
Give your employees tailored training in protecting data and IT now
Mandatory training and professional development courses from the GDPR to NIS-2 – audit-proof and application-oriented.
Get in touch now

