Data protection training online in the UK: a guide for managers and data leads

What employers look for in an online data protection certificate

Your employer decides the training your role needs, based on its own assessment of the work you do and the personal data you handle. When a manager or data lead completes data protection training, a good certificate shows four things.

1. The course and the hours. The certificate should name the course and the hours of learning, so it can sit in a training record or CPD log.
2. A date and a way to check it. A completion date, a unique certificate number and a verification link let an employer confirm the certificate is real.
3. Content that follows current UK law. Data protection law changed in 2026. The course should cover the UK GDPR, the Data Protection Act 2018 and the changes made by the Data (Use and Access) Act 2025.
4. A refresh date. Data protection is a topic that moves, so a recommended refresh-by date on the certificate helps you and your employer keep training current.

The Lift College certificate does each of these. It names Data Protection Training, shows 2 hours of learning, and records your completion date and a recommended refresh date 12 months later. It carries a unique certificate number and a verification link. The course covers the 2026 changes in its own module, and you can retake the latest version free when your refresh date arrives.

What the Lift College course covers

The course has 6 short modules, each with a knowledge check, then a multiple-choice final test. You need 80% to pass, with unlimited free retakes.

1. Lawful bases and special data. The seven lawful bases, including the new recognised legitimate interests basis. Why special category data needs a lawful basis and a separate condition.
2. Handling subject access requests. Spotting a request in any form, the one-month time limit and when it can be extended. Pausing the clock for clarification or ID, and making a reasonable and proportionate search.
3. Managing a personal data breach. Containing a breach, assessing the risk and reporting to the ICO within 72 hours when required. Telling the people affected and recording every breach.
4. Handling data protection complaints. The duty that began on 19 June 2026. Helping people complain, acknowledging within 30 days and responding without undue delay.
5. Sharing data safely. Sharing with partners, suppliers and public bodies. Using the ICO data sharing code, checking your lawful basis and keeping clear records.
6. What changed in 2026. The Data (Use and Access) Act 2025 changes that began on 5 February 2026, including automated decisions, cookies and international transfers.

By the end you can choose the right lawful basis, handle a subject access request within the legal time limit, assess a breach and decide whether to report it, run a complaints process that meets the 2026 rules and share personal data safely with other organisations.

The law and guidance it is written around

• UK General Data Protection Regulation. Sets the lawful bases, people's rights, breach reporting rules and the accountability principle. Controllers must report notifiable breaches within 72 hours of becoming aware of them.
• Data Protection Act 2018. Sits alongside the UK GDPR, adds conditions for special category and criminal offence data, and sets out the Information Commissioner's powers. Since 19 June 2026 it also requires controllers to handle data protection complaints.
• Data (Use and Access) Act 2025. Amended UK data protection law. Most changes began on 5 February 2026, including recognised legitimate interests and reasonable and proportionate searches for subject access requests.
• ICO data sharing code of practice. Used in module 5. The ICO describes it as guiding practitioners "through the practical steps they need to take to share data".

How Lift College compares with other online data protection courses

Prices and details below are taken from each provider's own course page, checked 11 October 2026. Lift College is not VAT registered, so no VAT is added to £19.99.

Who it suits

Data Protection Training suits you if you:

• manage a team that handles customer, patient, pupil or staff records
• are the person who receives subject access requests or complaints
• work in HR, practice management, school business management or operations
• have been named as the data protection lead in a small organisation
• decide whether to share records with partners, councils or suppliers
• have done GDPR basics and need the deeper management view

If your role is everyday data handling, such as reception, customer service or care, GDPR Training is the right Lift course. Both sit in the workplace compliance courses, and every course in the Lift College CPD catalogue is £19.99.

What you get for £19.99

• One payment for one learner, no subscription and nothing added at checkout.
• Access for as long as Lift College offers the course, and never less than 3 years from purchase.
• A free refresher when your recommended refresh date arrives. Lift emails you 30 days before.
• 14-day money back: ask within 14 days of paying for a full refund.
• Open to learners aged 16 or over. Buying for a team? Ask about team enrolment.

Start Data Protection Training for £19.99.