Data Protection Training
Go beyond the basics. Learn to handle subject access requests, breaches, complaints and data sharing the way UK law expects.
14-day money back · Pay once, no subscription
Data Protection Training
When a subject access request lands, a breach happens or another organisation asks for records, someone has to decide what to do. Deadlines are short and the rules changed in 2026. Getting it wrong can harm people and damage trust in your organisation.
This course is for the people who make those decisions. It covers lawful bases, special category data, subject access requests, breach reporting, complaints and data sharing. It explains what the Data (Use and Access) Act 2025 changed. You finish knowing the steps, the time limits and when to escalate.
- Choose the right lawful basis, including recognised legitimate interests
- Identify special category data and the extra condition it needs
- Handle a subject access request within the legal time limit
- Assess a personal data breach and decide whether to report it
- Run a data protection complaints process that meets the 2026 rules
- Share personal data safely with other organisations
- Explain the main changes made by the Data (Use and Access) Act 2025
6 short modules, 2 hours in total.
Lawful bases and special data
The seven lawful bases, including the new recognised legitimate interests basis. Why special category data needs a lawful basis and a separate condition.
Knowledge checkHandling subject access requests
Spotting a request in any form, the one-month time limit and when it can be extended. Pausing the clock for clarification or ID, and making a reasonable and proportionate search.
Knowledge checkManaging a personal data breach
Containing a breach, assessing the risk and reporting to the ICO within 72 hours when required. Telling the people affected and recording every breach.
Knowledge checkHandling data protection complaints
The duty that began on 19 June 2026. Helping people complain, acknowledging within 30 days and responding without undue delay.
Knowledge checkSharing data safely
Sharing with partners, suppliers and public bodies. Using the ICO data sharing code, checking your lawful basis and keeping clear records.
Knowledge checkWhat changed in 2026
The Data (Use and Access) Act 2025 changes that began on 5 February 2026, including automated decisions, cookies and international transfers.
Knowledge checkFinal test and your certificate
Multiple choice, 80% to pass, unlimited attempts. Your CPD certificate is issued by Lift College the day you pass.
This course is for you if
- You manage a team that handles customer, patient, pupil or staff records
- You are the person who receives subject access requests or complaints
- You work in HR, practice management, school business management or operations
- You have been named as the data protection lead in a small organisation
- You decide whether to share records with partners, councils or suppliers
- You have done GDPR basics and need the deeper management view
Your CPD certificate, issued the day you pass.
Your certificate names Data Protection Training and shows 2 hours of learning. It also shows your completion date and a recommended refresh date 12 months later.
- One price, £19.99. One payment, one learner, no subscription.
- Short modules with a knowledge check after each one and a final test. Instant results.
- 80% to pass, with unlimited free retakes.
- A CPD certificate issued by Lift College as a PDF the same day you pass, with a unique number and a verification link.
- Access for as long as Lift College offers the course, and never less than 3 years from the day you buy.
- A free refresher when your recommended refresh date arrives. Changed your mind? Ask within 14 days of paying and we refund you in full.
CPD certificate
liftcollege.co.uk/verify/LC-CPD-000000The law this course supports
UK General Data Protection Regulation (UK GDPR)
Sets the lawful bases, people's rights, breach reporting rules and the accountability principle. Controllers must report notifiable breaches to the ICO within 72 hours of becoming aware of them.
Read the legislation →Data Protection Act 2018
Sits alongside the UK GDPR, adds conditions for special category and criminal offence data, and sets out the Information Commissioner's powers. Since 19 June 2026 it also requires controllers to handle data protection complaints.
Read the legislation →Data (Use and Access) Act 2025
Amended UK data protection law. Most changes began on 5 February 2026, including recognised legitimate interests and reasonable and proportionate searches for subject access requests.
Read the legislation →£19.99. Pay once, nothing added.
One payment for one learner. You keep access for as long as Lift College offers the course, and never less than 3 years. Changed your mind? Ask within 14 days and we refund you in full.
- PaySecure card payment, one time only.
- Sign inYour learner account is ready straight away.
- StartBegin module 1 the same minute.
Free refresher when it is due
We recommend a refresh every 12 months. We email you 30 days before, and from the refresh date you can retake the latest version free and download a new certificate.
Questions about Data Protection Training
How long do we have to respond to a subject access request?
One month from receipt. You can extend by up to two further months if the request is complex or you have several from the same person. Asking for clarification or ID pauses the clock.
When must a data breach be reported to the ICO?
Without undue delay and within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. If there is a high risk, you must also tell the people affected.
What is the new data protection complaints rule?
Since 19 June 2026, organisations must help people make data protection complaints. You must acknowledge a complaint within 30 days and respond without undue delay. The course shows you how to set this up.
What is a recognised legitimate interest?
It is a lawful basis added by the Data (Use and Access) Act 2025. It covers set purposes, such as safeguarding vulnerable people or responding to emergencies, without the usual balancing test.
How is this different from GDPR Training?
GDPR Training is everyday data handling for all staff. Data Protection Training is the deeper course for managers and people who deal with requests, breaches, complaints and data sharing.
How long do I keep access?
You keep your access for as long as Lift College offers the course, and never less than 3 years from the day you buy. Your certificate PDF is yours to keep.
What is the free refresher?
Lift College recommends refreshing this course every 12 months. When your date comes round, you can retake the latest version free and get a new certificate. We email you 30 days before.
Does it count towards my CPD?
Yes. The course is 2 hours of learning, shown on your CPD certificate issued by Lift College, so you can log the hours in your CPD record.
Can I get my money back?
Yes. Ask within 14 days of paying and we refund you in full.
Can my employer pay?
Yes. Your receipt shows the course, the date and the amount paid, and you can pass it to your employer. Lift College is not VAT registered, so no VAT is charged. Buying for a team? Ask about team enrolment and the team will help.
GDPR Training
Everyday GDPR for all staff. Handle personal data safely, spot a breach and know what to do next.
Equality and Diversity Training
The Equality Act 2010 in plain words. Protected characteristics, types of discrimination and reasonable adjustments.
Bullying and Harassment Training
Recognise bullying and harassment at work, know where the legal lines are and how to raise or handle a complaint.
Buying for a team?
Enrol several learners at once, one invoice, and a certificate for each person the day they pass. Tell us the courses and how many people and we will set it up.