HR · 1:20 pm
Résumés in the group chat.
A manager asks you to post all candidates’ résumés, with phone numbers and addresses, in the team’s messaging group. Do you send them or share only what is needed through the recruiting system?
Mission 01Privacy and data
Privacy training for people who handle data.
Personal data passes through customer care, HR, marketing and the spreadsheet of whoever closes the month. The program trains each team on the decisions it makes with that data, together with your DPO.
Quick answer
What should data privacy training for employees include?
Good data privacy training teaches people to recognize personal and sensitive data, use only what is needed, verify data subject requests and report incidents fast. qlture’s program starts from a data map of each team, trains the shortcuts that show up there and gives your privacy lead reports for the governance program.
Where data gets out
- 01
Leaks start with a shortcut.
Emailing a spreadsheet home, sharing an open link, pasting data into any tool. Nobody wants to leak anything. They just want to finish the job.
- 02
The request looks legitimate.
Someone claiming to be the customer’s relative urgently asks for their record. Urgency and familiarity are social engineering tricks, and customer care is the front door.
- 03
Hidden incidents grow.
Whoever made the mistake is afraid to speak up. Without a reporting culture, the privacy team finds out late.
- 04
The DPO can’t be everywhere.
Brazil’s LGPD gives the data protection officer the task of guiding employees and contractors. Alone, one person can’t reach every team’s routine.
Mission examples
Situations we might write for this topic. In your program, they come from your own policies.
Sales · 5:55 pm
The event list.
A partner asks for your event’s attendee list for “a joint campaign”. It has names, emails and job titles. Do you send the spreadsheet or check with the privacy team first?
Mission 02Finance · 10:05 pm
Wrong recipient.
You sent a report with customer data to the wrong email address, outside the company. Nobody has noticed yet. Do you try to fix it yourself or report it now through the incident channel?
Mission 03The program, built with your DPO
01
A data map by department
Together with your DPO, we identify which teams handle which data and where the risky shortcuts are.
02
Missions from your operation
Missions start from what your operation does with data. In customer care, it is a data subject asking for a copy of their record; in marketing, a contact list bought from a vendor; in HR, a medical certificate forwarded by email.
03
Short, recurring campaigns
The same care comes back in different formats throughout the year: a mission, a quiz, a campaign, a team conversation.
04
Incident reporting without fear
The program teaches people to spot a possible incident and report it quickly through the right channel.
05
Evidence for governance
Reports on participation and choices by department, useful to demonstrate your good practices program.
What we track
- Participation by department
- Choices per scenario
- Possible incidents reported
- Time to report
- Topics with most errors
- Progress per cycle
Legal basis (Brazil’s LGPD)
- LGPD, art. 41, § 2, III ↗
- Among the data protection officer’s duties: guiding employees and contractors on personal data protection practices.
- LGPD, art. 46 ↗
- Requires technical and administrative security measures. Training people is an administrative measure.
- LGPD, art. 50 ↗
- Provides for good practice rules that include educational actions, and a governance program updated through continuous monitoring and periodic assessments.
Frequently asked questions
01Is data privacy training mandatory?
It depends on the law that applies to you. Brazil’s LGPD does not use the word “training” as a direct obligation, but it requires administrative security measures, tasks the DPO with guiding employees and mentions educational actions in good practices. Training people is the most direct way to meet that set.
02Who needs privacy training?
Everyone who handles personal data, which means almost every team. Content changes by audience: customer care deals with data subject requests, HR with sensitive data, marketing with contact lists.
03How do you build a data protection culture?
Nobody rereads the handbook. What builds culture is frequent practice: pick a few critical behaviors per team, write each one as a real situation, repeat them throughout the year and measure choices and reports.
04What does the data protection officer do?
Under Brazil’s LGPD, the DPO is the contact point for data subjects and the regulator, and one of their duties is guiding employees and contractors on data protection. qlture runs the awareness program together with the DPO.
05Does the program work outside Brazil?
Yes. The legal references on this page are Brazilian, and the missions adapt to the privacy rules your company follows, such as GDPR in Europe. Your team validates the content before it goes live.
Other topics
Sources (1)
Shall we put this
into practice?
Tell us which policy people sign and then ignore. We design the program with you.
Let’s talk