What are the best ways to educate your team about data privacy?

One of the biggest mistakes you can make, it's to think that it is always possible to proceed with a standard training. Instead, it is necessary to understand which are the gaps (f.i. checking any audit report on it) and which are the needs (f.i. checking it on Data Protection/Compliance Plan) are, otherwise the risk is to put in place training that is ineffective and not considered useful by Personnel (f.i. GDPR is a Regulation in place since 2016, you cannot think in 2024 of still working on regulatory contents, you have to present concrete/current cases that can help employees work better in compliance with laws and internal policies). Otherwise you will have to chase like a "police dog", creating an unnecessary waste of resources/time.

When we are looking for data we need to see how we collect, store and proceed data. Going this way means to identify systems, users and data types (and where we store it) When we talk about data privacy -did not forget the paper one. The you can proceed with risk assessments. It is all about the risk and attack surface. Minimize and manage both.

I am supporter on hybrid training - online for warming up , than on site trainings . If we need to master the skills - then we need to put the persons or teams in incident like environment so they can train mentally and see the real outcome. Training for prevention is good start. Training for incident response for every one is the crucial difference.

One of the most useful/interesting things I have seen over the years are awareness programmes/platforms (e.g. Hoxhunt, KnowBe4, Proofpoint) that can be integrated in corporate tools and used on a daily base, with tests on concrete cases, pointing out the correct behaviours, any mistakes done and of course the progress made in a game mode (f.i. granting badge, giving indications of how your results rank against other colleagues). In order to keep attention and interest at high level, it's essential to give continuos feedback and at the same time also support. Otherwise, people will lose interest and, if unsupported, they will not have the necessary tools to settle any doubts about the privacy aspects they encounter in their daily work.

Interactive training sessions followed by quizzes, sharing data privacy policies and processes related snippets over emails, keeping interesting desktop wallpapers, giving badges, ongoing awareness sessions, all this has helped us creating awareness about data protection. Important stakeholders can be nominated for data protection related certifications.

Latly I was looking how I can improve my University degree courses with personalised experience for small group of people. And I looked to the mighty AI (trained by human ;)) Now I have my AI assistant that is used from the students . We work together - they have techies and tactics the AI cyber architect creates hallucinated story and exploit path. We are more personalised and I will work more in this ditection

Consider participating in open or community driven projects. Go back to university ! This is where innovations and fresh ideas are born!