No general UK law names a mandatory cyber security course that every employee must complete. But if your business handles personal data — and almost every employer does — the law still expects your staff to be trained. UK GDPR Article 5(1)(f) and Article 32 require “appropriate technical and organisational measures” to keep personal data secure, and the Information Commissioner’s Office (ICO) says you should provide staff with “appropriate initial and refresher training”. Some sectors, such as essential services, the NHS and financial services, add their own rules on top.
At a glance: Nexis CPD’s £9 Cyber Security Awareness course covers what staff most need to know: phishing, passwords, safe devices and how to report incidents. It is CPD accredited and 100% online, with a verifiable e-certificate, and any three courses cost £18. It is an awareness course. It is not a regulated qualification, and it is not Cyber Essentials certification, which covers your organisation’s technical controls rather than your people.
Is cyber security training mandatory in the UK?
No single law says “every employee must complete cyber security training every year”. What the law says is less direct, but for most organisations it ends up in much the same place.
The key rule is the security principle in the UK GDPR, which the Data Protection Act 2018 sits alongside. Article 5(1)(f) requires personal data to be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”. Article 32(1) builds on this. Taking into account “the state of the art, the costs of implementation” and the risks involved, controllers and processors “shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk”.
Training is an organisational measure. Article 32(4) makes the link with people directly: controllers and processors must “take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller”. You cannot expect staff to follow security instructions nobody has explained.
So training is not mandatory as a named course, but if staff handle personal data, giving them none would be very hard to defend as “appropriate” security. We explain the wider data protection framework in our guide What is GDPR?
What does the ICO say about staff security training?
The ICO’s guide to data security summarises the security principle as processing personal data securely “by means of ‘appropriate technical and organisational measures'”. On people, it is specific. It says it is “vital that your staff understand the importance of protecting personal data, are familiar with your security policy and put its procedures into practice”, and that “you should provide appropriate initial and refresher training”.
The ICO lists what that training should include:
- your responsibilities as a data controller under the UK GDPR;
- staff responsibilities for protecting personal data, including the possibility that they may commit criminal offences if they deliberately access or disclose data without authority;
- the proper procedures to identify callers;
- the dangers of people trying to obtain personal data by deception, including recognising “phishing” attacks;
- any restrictions you place on staff using your systems for personal purposes.
The same guidance says you “should aim to build a culture of security awareness within your organisation” and should name a person with day-to-day responsibility for information security. Its checklist also mentions putting in place “basic technical controls such as those specified by established frameworks like Cyber Essentials”. The ICO’s wording is “should”, not “must”, but its guidance is the obvious benchmark for judging whether your measures were appropriate.
Enforcement shows how gaps in basic controls are treated. In March 2025 the ICO fined Advanced Computer Software Group £3,076,320 after a 2022 ransomware attack. Hackers got in through a customer account without multi-factor authentication, and personal information belonging to 79,404 people was taken. It was a technical gap rather than a training failure, but it shows how one overlooked account can become a regulatory problem.
Which sectors have specific cyber security training rules?
On top of UK GDPR, some organisations face sector-specific requirements.
Essential services and digital service providers (NIS Regulations 2018)
The Network and Information Systems Regulations 2018 apply to operators of essential services in sectors such as energy, transport, health, drinking water and digital infrastructure, and to certain relevant digital service providers. Regulation 10(1) requires an operator of essential services to “take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies”. No course is named, but staff awareness is a natural part of “organisational measures”.
The Cyber Security and Resilience Bill
The government’s Cyber Security and Resilience (Network and Information Systems) Bill would reform and expand the NIS Regulations. Its summary factsheet says data centres, medium and large managed service providers, large load controllers and designated critical suppliers would come into scope, largely through later secondary legislation. It was introduced to Parliament on 12 November 2025, passed the House of Commons in June 2026, and at the time of writing, in September 2026, is going through the House of Lords. It is still a Bill: it is not yet law and does not appear on legislation.gov.uk as an Act, with Royal Assent widely expected later in 2026 or in 2027. If you may fall within its scope, check its progress on the Parliament website.
NHS and social care (Data Security and Protection Toolkit)
The Data Security and Protection Toolkit (DSPT) must be used by “all organisations that have access to NHS patient data and systems”. Staff training is a named standard. According to the DSPT’s own update, the old requirement to train at least 95% of staff with the national Level 1 e-learning ended with the 2023/24 toolkit. It was replaced with a requirement that all staff have an “appropriate understanding of information governance and cyber security”. Organisations now use a training needs analysis to set how often each role is trained, such as on joining and then annually.
Financial services (FCA)
The FCA’s SYSC sourcebook contains a competent employees rule, SYSC 5.1.1R: “A firm must employ personnel with the skills, knowledge and expertise necessary for the discharge of the responsibilities allocated to them.” For staff handling client data and systems, cyber awareness is a reasonable part of that competence. Firms with money laundering duties should also read our guide to AML training requirements.
Is Cyber Essentials a legal requirement?
No. Cyber Essentials is a voluntary, government-backed certification scheme. The National Cyber Security Centre (NCSC) describes it as “the minimum standard of cyber security recommended by the Government for organisations of all sizes”. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent technical testing.
It can become a commercial requirement, though. Under Procurement Policy Note 014, “since 2014 the government has required suppliers bidding for certain types of public contracts to hold Cyber Essentials or Cyber Essentials Plus certification”. This applies to contracts with central government departments, their agencies and NHS bodies that involve things like citizens’ personal information or ICT systems handling OFFICIAL data. The NCSC also notes that “a growing number of organisations require suppliers to be certified to bid for work”.
Cyber Essentials certifies technical controls; awareness training covers the human side, such as the employee who clicks the link. A CPD awareness course cannot give you Cyber Essentials certification, and Cyber Essentials does not train your staff.
What should cyber security training for employees cover?
The NCSC’s free Top Tips for Staff e-learning is a sensible baseline. It focuses on four areas: using strong passwords, securing your devices, defending yourself against phishing, and reporting incidents. The NCSC says it is “completely free, easy to use, and takes less than 30 minutes to complete”, with no login needed.
A good programme covers:
- Phishing. The government’s Cyber Security Breaches Survey 2025/2026 (published 30 April 2026) found that 43% of businesses and 28% of charities had experienced a breach or attack in the previous 12 months. Phishing was “the most prevalent type of breach or attack by far”, experienced by 38% of businesses and 25% of charities. Staff need to recognise urgent payment requests, fake login pages and impersonation.
- Passwords. The NCSC recommends combining three random words to make passwords that are “long enough and strong enough” but easy to remember. It warns that swapping letters for numbers does not help, because “cyber criminals know these tricks as well”. Use a different password for each important account.
- Multi-factor authentication (MFA). Turn it on for email and every other important account.
- Devices and updates. Lock screens, install updates promptly and follow your rules on personal devices and remote working.
- Handling data. Know what counts as personal data, check who you are sending it to, and follow your retention and sharing rules.
- Reporting. Staff should know exactly who to tell internally, and that reporting quickly matters more than feeling embarrassed.
How should staff report phishing and cyber incidents?
Your internal procedure comes first: staff should tell your IT contact or data protection lead straight away, because a quick report can stop a small incident growing. For suspicious emails, GOV.UK advises: “Forward suspicious emails to report@phishing.gov.uk.” Suspicious texts can be forwarded free to 7726. Anyone who thinks they have lost money to online fraud in England or Wales can report it to Report Fraud.
How you respond matters as much as the procedure. The NCSC’s 10 Steps guidance on engagement and training says “people should be at the heart of any cyber security strategy”. It warns against stigmatising mistakes or singling people out for blame, because blame makes staff less willing to report incidents.
How often should staff have cyber security training?
No general UK law sets a fixed interval. The ICO refers to “initial and refresher training”. A practical approach is to:
- train every new starter as part of induction, before they get full system access;
- refresh at least once a year (good practice, not a legal rule);
- add short updates after incidents or when threats or systems change.
The NCSC warns that “the same training video used year after year will lead the staff to think little importance is being placed on the training”. Keep records of who completed what and when. Records show the ICO or a client that your measures exist in practice.
Few organisations do this yet. The 2025/2026 survey found that only 19% of businesses ran staff training or awareness activities in the previous year, although among large businesses the figure was 84%. Training your staff at all puts you ahead of most businesses.
Which courses suit cyber security training requirements?
Our Cyber Security Awareness course gives staff a clear grounding in phishing, passwords, device security and incident reporting, with a verifiable e-certificate for your training records. It pairs naturally with our Data Protection and GDPR Awareness course, so staff understand why personal data needs protecting as well as how to protect it. For the equivalent picture on workplace safety duties, see our guide to health and safety training requirements.
Frequently asked questions
Is cyber security training a legal requirement in the UK?
Not as a named course. No general UK law requires every employee to complete a specific cyber security course. However, UK GDPR Articles 5(1)(f) and 32 require appropriate technical and organisational measures to protect personal data, and the ICO says organisations should provide staff with appropriate initial and refresher training. For most employers, some staff training is needed to meet that standard.
Do small businesses need to train staff in cyber security?
If they handle personal data, in practice yes. UK GDPR has no small-business exemption from the security principle, although what counts as appropriate depends on your size and risks. A short cyber security awareness course at induction, the free NCSC Top Tips for Staff e-learning and regular refreshers are a proportionate starting point for most small firms.
Is Cyber Essentials mandatory?
No, it is a voluntary government-backed certification of five technical controls. However, under Procurement Policy Note 014, suppliers bidding for certain central government and NHS contracts must hold Cyber Essentials or Cyber Essentials Plus, or show equivalent controls. A growing number of other organisations ask for it too. It certifies technical controls, not staff training.
How often should cyber security training be done?
UK law sets no fixed interval. The ICO refers to initial and refresher training, so train new starters at induction and refresh regularly. Annual refresher training is common practice, with extra updates after incidents, when threats change or when new systems are introduced. NHS organisations using the DSPT decide frequency through a training needs analysis.
Is the Cyber Security and Resilience Bill law yet?
Not at the time of writing (September 2026). The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025, passed the House of Commons in June 2026, and is now going through the House of Lords. It is not yet law and would reform and extend the NIS Regulations 2018. Check the Parliament website for its current stage.
Train your team today
£9 per course. CPD accredited, 100% online, verifiable e-certificate. Pay for 2, get 3 — any 3 courses for £18.
This article is general information, not legal advice. For your specific duties, take advice from a qualified data protection, cyber security or legal professional. A CPD awareness course is not a regulated qualification and is not Cyber Essentials, Cyber Essentials Plus or any other security certification. It supports the staff awareness part of your organisational measures, alongside the technical controls, policies and sector-specific requirements that apply to you. Legislation and Bill status are described as at September 2026 and may change.