VBJ: GDPR training in practice: does one size fit all?

I have a friend who is a General Data Protection Regulation (GDPR) consultant – yes, really. And no, she doesn’t spend her whole time lecturing me on the thrills and spills of data breaches and subject access requests. But she does have her own pets, so she visits veterinary practices – and she has noticed data handling issues on a number of occasions.

When she tells me about some of the data breaches she’s spotted, and examples of poor compliance she’s seen, I’m not really surprised. Most of it sounds like fairly standard veterinary practice processes to me.

Like many professions, we all had a bit of a panic in 2018 when GDPR came in — and then, for the most part, quietly put it out of our minds. I have honestly heard “It’s just basic confidentiality really” and “Oh, we let the website guys do that”. No veterinary practice has been reprimanded lately by the Information Commissioner’s Office (ICO), but plenty of other organisations have¹. And, with a more data-savvy public and additional scrutiny of our profession in the wake of the Competition and Markets Authority and Veterinary Surgeons Act reviews, this is something worth paying closer attention to.

Robust processes

Many practices are vulnerable, simply by drifting along, doing things the way they always have done. When I say “at risk”, I don’t just mean the very real possibility of financial penalties from the ICO. Reputational damage, when things go wrong, is arguably the bigger concern.

As vets, we occupy a privileged position of trust with our clients. Not only are we entrusted with the health and well-being of their pets, but also with their personal data – and the data of our own employees.

Most practices do have GDPR policies in place. But policies alone are not enough. Those policies need to translate into robust, day-to-day data handling processes. And that’s where things often get blurry.

Data protection isn’t just an issue when patient records are transferred. Personal data flows into, around and out of veterinary practices constantly – often in ways we don’t consciously think of as “data processing”. Handing out medication, printing consent forms, completing insurance forms, pinning records to kennels, CCTV in the car park, messaging apps, referral letters – all of these involve personal data.

This is where training becomes important (and yes, I appreciate that might sound even less exciting than GDPR itself).

Training that’s fit for purpose

The ICO is clear that all team members must receive GDPR training – not just those who regularly use the practice management system (PMS). Even a kennel assistant who never touches a PC still interacts with personal data. Without training, they may not recognise risk. Leaving a consent form unattended on the front desk while nipping out the back may feel harmless – but it’s a data breach.

To ensure consistent awareness, training needs to reach the whole team.

What concerns me, though, is whether much of the GDPR training currently used in veterinary practices is genuinely fit for purpose. Having a confidentiality or data protection policy buried in an employee handbook – one that new starters are “supposed to read” – would be very unlikely to stand up as “training” in the event of an ICO probe.

The ICO expects organisations to assess the training needs of their workforce and provide training that is relevant to their roles. That includes long-standing staff, new starters, and locums. If a locum doesn’t understand their responsibilities under GDPR, that’s still your risk.

Crucially, the ICO also expects training to reflect sector-specific requirements. This matters. Most off-the-shelf GDPR training is designed for office-based environments. It often feels irrelevant to veterinary teams – and irrelevant training doesn’t change behaviour.

This is the important bit. GDPR training is not intended to be a tick-box exercise. The ICO is interested in whether training actually reduces risk and supports compliance in real working environments.

For training to be worth while, it has to change behaviour. Team members need to understand GDPR concepts and recognise how they apply to the work they do and then apply that knowledge. That’s what makes training “sticky”: real-life examples, familiar scenarios and realistic consequences.

It’s worth noting that according to the ICO, only around 24% of data breaches are due to malicious cyber attacks. The remaining 76% are the result of non-cyber events, the majority of these being accidental breaches². That means most breaches are preventable – through awareness, good processes, and practical understanding (Figure 1).

Changing behaviour

If we look at data breaches as an example, very few employees would actively hand over your client data to a stranger. The issue is usually that individuals don’t recognise when they are handling personal data, or which everyday behaviours create risk. A generic presentation about not leaving spreadsheets open on a train won’t change the behaviour of a vet who steps out of a consult room and leaves the PMS visible on the computer screen, to be perused by an inquisitive, waiting client.

This is where relevant, sector-specific training makes a real difference.

The ICO also highlights the importance of being able to demonstrate understanding. Quizzes, acknowledgements, and evidence that processes have been agreed and embedded all help here. In some cases, changes to standard operating procedures (SOPs), followed by observation or audit, can demonstrate that training has translated into safer behaviour.

Training also needs to be ongoing. GDPR isn’t something you cover once and then forget about. Subsequent new starters need the same quality of training, and existing team members benefit from regular refreshers.

Simple reminders shared through newsletters, emails, or team communications can be very effective as refresher training – particularly when they reference real scenarios. The ICO would expect this ongoing communication to be documented, but that doesn’t need to be onerous if systems are in place to track acknowledgement.

It’s also important to recognise that senior team members and leaders need additional, advanced training. They are responsible for designing processes and SOPs. GDPR principles should be built into those processes from the start – often referred to as “GDPR by design” – rather than bolted on afterwards. So, leadership training in GDPR would also benefit from being focused on the processes we use in a vet practice.

Conclusion

When GDPR training is done well, it shouldn’t leave teams feeling anxious or paralysed. Quite the opposite.

Confident teams who understand their processes feel more in control, work more consistently and are better able to reassure clients. In a data-aware world, confidence helps build trust and strengthens client relationships.

At its core, appropriate GDPR training is about respecting people’s data and doing things properly. But it also supports team confidence, client trust, and protects the business. And, while it isn’t a tick-box exercise, it is vital to be able to evidence that suitable training has taken place.

A useful exercise for any practice is to ask a few simple questions: would your team recognise a data protection risk in a busy consult, at reception, or in the kennels? Could you demonstrate not just that your team had completed training, but that it was understood and relevant to veterinary roles?

If those answers feel uncertain, it may be worth re-examining whether your GDPR training is fit for purpose.

• This article appeared in VBJ (September 2026), Issue 282, Pages 20-22

Laura Shaw is a 2000 Bristol graduate vet and development consultant with Training-Progress, where she supports practices creating training programmes, and supporting standardisation and compliance. Recently, she has collaborated with subject experts to develop training content tailored specifically to the needs of veterinary teams.  She is also a volunteer team lead with StreetVet.