Tips For Developing an Effective Privacy Training Program
What do these scenarios have in common?
- Images of a woman sitting on a toilet with her shorts pulled down were posted to online forums by gig workers.
- Ring Doorbell employees and contractors spied on customers, resulting in a $5.8 million penalty.
- Eight Nova Scotia Health employees were caught snooping on the health records of people associated with an April 2020 mass shooting. Following an internal investigation, it was determined that employees had accessed records of more than 270 people for non-treatment reasons (with 1,200 privacy breaches recorded).
Each of these breaches highlights extremely poor privacy practices within organisations that could have been avoided if team members were more cognisant of privacy.
Organisational Benefits of Implementing a Privacy Training Program
The importance of robust organisational privacy training cannot be understated. Human error accounts for a significant number of data breaches each year, including breaches like those outlined above that could very easily have been avoided.
The ISACA highlights these additional benefits of implementing a privacy training program:
- Increased protection of the data the organisation collects.
- More awareness of the risks associated with the collection of data.
- Legal compliance is supported throughout the organisation.
- It empowers employees to protect their own personal information.
- It builds mutual trust between the organisation and the people who run it.
3 Tips for Developing an Effective Privacy Training Program
Assess Your Privacy Training Needs.
Organisations should first assess what gaps exist and benchmark existing privacy practices against industry best practices before designing training. This practice ensures your privacy training will be more effective because it reflects your organisation’s needs and knowledge gaps.
You can deploy various techniques to assess your needs and knowledge gaps, such as conducting a knowledge audit, analysing data, or consulting a privacy professional.
From there, you should design a program that addresses your specific needs. Some techniques to improve the effectiveness of your privacy training program include:
- Introducing basic privacy concepts and language first and building on this knowledge over time/multiple sessions.
- Gradually increasing the complexity of the scenarios and simulations presented.
- Offering different training to different departments – since it’s unlikely that your customer service team has the same knowledge gaps and needs as your product developers or IT team.
- Reinforcing important messages about privacy through multiple channels over time. For instance, you might send a follow up email after a training session then re-share key points on a relevant Teams channel one month later.
Run Privacy Training Programs That Foster a Culture of Privacy.
Organisations can build a culture of privacy through continuous engagement with relevant stakeholders. Regular privacy training is an opportunity for organisations to build awareness about privacy, the role each team member plays in safeguarding it, and the importance of protecting privacy.
To build a culture of privacy, it’s important that new recruits receive privacy training as part of their onboarding so that it’s top of mind right from the beginning. Then, all team members should regularly receive refresher training that considers new or more complex risks so that the privacy awareness of your team increases over time.
Make Privacy Training Relevant with Real-Life Examples.
Privacy training is more engaging and will translate better to real-life situations if it includes examples that happened or may occur. You might consider:
- Celebrating team members who successfully identified attempts by malicious actors to gain access to your organisation’s systems.
- Showing examples of phishing emails. (Like these examples here, however, it would be better to include real examples of emails your organisation has previously received.)
- Sharing content that shows the manipulation techniques social engineers employ (like this video:
Privacy Training with Privacy 108
With a large number of “off-the-shelf” privacy awareness training options available, why use us?
We firmly believe that the more customised the training is to your business environment the better the results. Most people learn more effectively when they see how it directly applies to their work environment.
We can tailor make a training solution for your organisation that is both affordable and effective.
We can also adapt some of our existing training packages to suit your environment for an even more cost-effective solution.
Some of the subjects we can cover include:
- Australian Privacy Law
- Privacy Impact Assessments
- GDPR Compliance for Australian businesses
- Direct Marketing and legal issues in Australia
- Data breach notifications.
Contact us to discuss tailored privacy training for your organisation.
Jodie Siganto
Privacy, security and training. Jodie is one of Australia’s leading privacy and security experts and the Founder of Privacy 108 Consulting.