GDPR FAQs & Resources

As a leading provider of Business Compliance eLearning, our experts are often asked about the GDPR. We've collected all of those questions and answered them for you below...

Related Videos


When did the GDPR come into effect?

The GDPR was approved and adopted by the EU Parliament in April 2016. After 2 years, the regulation took effect and the GDPR came into force on 25th May 2018.

What is personal data?

Any data which can personally identify an individual - whether by itself or when combined with other pieces of information - is considered personal data. If that information has the potential to cause harm then it is considered a special category of personal data - things like bank details, sexual orientation, or political opinions, for example.

Who does the GDPR apply to?

The GDPR applies to any companies who process the personal data of subjects residing in the EU, regardless of where the company itself is located.

What are the possible penalties/fines of GDPR?

There are two thresholds depending on the kind and severity of the breach. The lower threshold is 2% of annual income or €10 million and the higher threshold is 4% of annual income or €20 million. The fine that a company receives depends on what part of the legislation that they have breached. These rules apply to both controllers and processors.

Does my workplace need a data protection officer (DPO)?

A data protection officer (DPO) needs to be assigned if your company carries out certain types of data processing - if you work as a public body or authority, if you systematically monitor individuals, or if you carry out large scale processing of special categories of personal data.

What happened to the GDPR after Brexit?

The GDPR began as an EU regulation, which means that it’s enforced by the EU and applies only to member countries. So, once the UK left the EU, the GDPR will no longer apply to the data of UK citizens. However:

1. UK organisations still need to comply with the EU Regulation if they ever handle the data of EU citizens.The Government has brought into law the Data Protection Act 2018 which is an almost carbon copy of the GDPR, so being GDPR compliant means you’re also Data Protection Act Compliant.

2. The EU Regulation, via the Data Protection, Privacy and Electronic Communication Regulations has been brought into UK law, amended to remove any mention of the EU and now stands as the UK GDPR.

Organisations which process both EU and UK citizen data will need to handle both sets of data according to the Regulation which applies to them (i.e. EU GDPR for EU citizens and UK GDPR for UK citizens).

Am I exempt from the GDPR if I have fewer than 250 employees at my company?

No matter the size of your company; how many employees you have, customers you serve, or what your annual turnover is, the GDPR applies to you.

That magic 250 employee threshold is only mentioned once in the regulation and that’s in relation to record keeping. The GDPR requires that you keep detailed records of all processing activities - including records of consent, decision making, privacy notices etc. - but with fewer than 250 employees, you don’t need to. However, the rest of the GDPR still applies in full.

FAQs regarding our GDPR courses

How long do these courses take?

Our GDPR courses for organisations handling UK data include: GDPR UK Advanced (Management) Training which takes 65 minutes, GDPR UK Essentials Training which takes 35 minutes and GDPR UK in Education Training which takes 40 minutes.

The GDPR EU Essentials Training takes 35 minutes to complete and the GDPR EU (advanced) Management Training takes 40 minutes to complete.

Why is this training important?

This training is important to give you an understanding of the regulation and the tools you need to remain compliant at all times.

What approvals do these courses have?

These courses are CPD Accredited.

How long are my certificates valid for?

It is up to the training administrator of the employee as to when training needs to be refreshed. However, to stay up-to-date with legislation, we recommend that training should be renewed every year.

What devices can I complete the course on?

Our courses can be completed on a range of devices, they’re compatible with desktops, laptops, mobile phones, iPads and other tablets.

Does this course work towards legislation compliance?

These courses work towards compliance with the GDPR.

Documents and resources

  • Rights over your personal data

    The GDPR covers personal data about an identifiable, living person. It can be anything from a name, a photo, an email address, a person’s bank details, posts on social media, medical information, addresses… and this is not an exhaustive list!

  • Data Protection Principles

    Everyone who uses personal data must follow strict rules and you’ll learn about these as the principles of data protection. They’re important, as they help you and your organisation ensure that personal data is used in a way that protects the rights of the people whose data it is, and following them is key to complying with the GDPR.

  • Day to Day good practice for GDPR

    If your job involves handling personal information then you have a responsibility to ensure that this data is kept private and confidential. For example, can your screen be seen by anyone looking through a window or by passers-by?

  • GDPR Accountability checklist

    Accountability is arguably the most important principle of the GDPR. Accountability is all about demonstrating that you’re complying with the GDPR. This useful checklist entails the things that you have accountability for with the GDPR.

  • The Six Lawful Bases for Processing Data

    Find out more about the Six Lawful Bases for processing personal data.

  • GDPR Checklist

    Review the risks to data your organisation faces and assess whether the measures you have in place are up to the task of preventing them.

  • What is a Data Protection Officer (DPO)?

    What is a DPO and how do you know who needs a DPO? Find out more about data protection officers under the GDPR…

An Overview of the GDPR

The GDPR was enforced on the 25th of May 2018 and was introduced to unify and strengthen data protection for everyone.

  • See a breakdown of the regulations and learn about its key principles
  • Learn how the GDPR impacts different sectors including Education, Care and Hospitality
  • Includes a range of frequently asked questions surrounding the regulation
  • Allow us to demystify a range of GDPR misconceptions
  • See how iHASCO can help your organisation with its GDPR Training needs
  • We conclude with a simple GDPR checklist so you can review your existing data protection measures

GDPR White Paper

Chat with us!