Free Data Protection Training

Geschrieben von Henning Wehming am 26.08.2026.

Online Data Protection Training for Employees or Interested Individuals + Certificate of Participation

Welcome to the Online Data Protection Training

Data protection is something we encounter every day—and in our professional lives, often more frequently than we might initially realize. The way we handle emails, customer data, documents, passwords, or mobile devices can already have implications for data protection. This makes it all the more important to assess common situations correctly and to handle personal data responsibly and securely.

This is exactly where this online training comes in. Using practical questions and scenarios from everyday working life, you can test and refresh your knowledge of data protection and the secure handling of personal data.

For each question, you will be given four possible answers, only one of which is correct. Read each question and the corresponding answer options carefully, then select the answer you believe to be correct.

Important: Once you have selected and confirmed an answer, it is final for the current attempt and cannot be changed afterwards. Please take your time before making your selection. You will then proceed to the next question. An answer that has already been submitted can only be answered again when starting a new attempt at the online training.

The aim of this training is not to memorize data protection regulations. Rather, it is designed to help you develop a solid understanding of how data protection can be implemented in everyday working life, how to identify risks at an early stage, and how to respond appropriately in common situations.

To successfully complete the online training and receive a certificate of participation, you must answer at least 75% of the questions correctly. If you do not achieve this result on your first attempt, you can retake the training at any time and put your knowledge to the test again.

Note on the Illustrations

Some illustrations and graphical elements used in this online training were created with the assistance of artificial intelligence (AI). They are used solely to illustrate and support the training content. Any people, situations, and scenarios depicted are generally fictional.

Additional AI Online Training

In addition to data protection, the responsible and secure use of artificial intelligence is becoming increasingly important in everyday working life.

If you would also like to test and expand your knowledge in this area, you can take our free AI online training course for employees and other interested individuals.

Further information and the AI online training course are available here:

Free AI Online Training

Take sufficient time for each question, read the answer options carefully, and consider your choice before submitting it.

After successfully completing the online training, you will receive an email containing a personal link that you can use to download your certificate of participation. If the email does not appear in your inbox shortly after completion, please also check your spam or junk email folder.

We wish you every success with the Online Data Protection Training!

I consent to the processing of my personal data in accordance with the Privacy Policy for the purpose of participating in the training, and I confirm that I have read the Privacy Policy.

First and last name

Company name

Email address

What does the Clean Desk Policy mean in everyday office work?

Documents may remain openly on the desk during working hours if only employees from the same department have access

It is sufficient to put confidential documents away at the end of the working day; no security measure is necessary for short absences

Confidential documents are stored so that unauthorized persons cannot access them, especially when the workplace is left unattended

Paper documents may remain openly visible if the screen is locked and the office is not accessible to the public

How should printouts containing personal data be handled at the workplace?

Keep them in a lockable cabinet or mobile pedestal

Place them underneath other work documents so the data is not immediately visible

Leave them at the printer if the documents will still be needed on the same day

Keep them in an open tray at your own workplace as long as only colleagues have access to the office

What is NOT part of the Clean Desk Principle?

Disposing of sensitive documents that are no longer needed via the designated disposal method

Putting work documents away neatly and securely after processing

Keeping confidential documents in locked cabinets when absent

Leaving access credentials visible at the workplace so that substitutes can use them

How must sensitive data be sent by email?

Via normal company email, provided that only internal recipients are addressed

Via an appropriate protected transmission method, for example encryption or an approved secure portal

As a PDF file with the word “Confidential” in the subject line

Via BCC, because this also protects the content of the message

What should you check particularly carefully when sending emails?

Whether all recipients have received similar messages in the past

Whether a colleague has been added in CC as a precaution for confidential messages

Whether the message contains a complete signature and a clear subject line

Whether the recipient address and recipient are correct and whether the recipients are authorized to receive the information

When may personal data be sent by email?

When the message is sent exclusively between two company email addresses

When the recipient is personally known to the sender and uses a business email address

When the transmission is permissible and the required protective measures are observed

When the data is urgently needed for a business process

How should I understand the terms “To”, “CC” and “BCC” – and how do I send a circular email in compliance with the GDPR?

All recipients should be entered in “To” if they receive the same message and the addresses are business addresses

“To” and “CC” make recipients visible; for a circular email to unrelated recipients, BCC may be appropriate to protect their addresses

CC is generally GDPR-compliant for circular emails because recipients only receive a copy

BCC should only be used if the recipients expressly wish to remain anonymous

How should printouts containing personal data be disposed of?

Via the designated secure destruction method, for example an appropriate document shredder or confidential-waste container

With the company’s normal waste paper, provided that no health or banking data is included

Collected in a closed box that is later disposed of with the remaining paper waste

In normal paper waste if the documents have first been torn up by hand

What is important when printing sensitive data?

For internal printers, it is sufficient if only employees have access to the printer room

Collect the printout promptly and prevent unauthorized persons from viewing it

Only start the print job on a printer within your own department

Remove the printout from the printer no later than the end of the working day

10.

How should fax machines be used for personal data?

Only after notifying the recipient by telephone; no further number check is then required

Only outside business hours so that third parties do not accidentally see the fax

For stored fax numbers, there is no need to verify the recipient again

Carefully check the recipient and destination number and comply with internal security requirements

11.

What is a secure password?

A sufficiently long, hard-to-guess password that is preferably used only for that account; where provided, supplemented by multi-factor authentication

A personal passphrase containing names or dates of birth, provided that numbers are also used

A password that is regularly adapted by changing individual characters

A complex password with special characters that can be used for several company systems

12.

How often should passwords be changed?

Only when the IT department orders a general password change

At fixed intervals of three months, regardless of whether there are any indications of misuse

Not according to a rigid schedule; in particular, it must be changed if disclosure or compromise is suspected

Once a year, provided that the password is sufficiently long and complex

13.

What is permitted when sharing passwords?

Sharing with a direct substitute if that person needs the same access rights

Sharing with a manager’s approval if the password is changed afterwards

Personal passwords must not be shared; designated substitution or authorization procedures must be used instead

Sharing within the same department if it is only temporary

14.

What is a personal data breach under the GDPR?

Any technical fault that temporarily makes it more difficult to process personal data

A breach of security leading to the destruction, loss, alteration, unauthorized disclosure of, or access to personal data

Any incorrect entry in an IT system, even if it is corrected immediately and no personal data is affected

A security incident in which an internal system is temporarily unavailable without personal data being affected

15.

How quickly must a personal data breach be reported?

Within seven days if the incident is documented and initially investigated internally

Within 72 hours by the employee directly to the data protection supervisory authority as soon as personal data may be affected

Only after it has been conclusively established internally that data subjects have actually suffered damage

Employees should report a possible incident internally without undue delay; where notification to the supervisory authority is required, the controller should do so where feasible within 72 hours of becoming aware of it

16.

What should be done after discovering a data breach?

Report the incident without undue delay through the designated internal reporting channel, for example to Data Protection or IT

First clarify all details yourself and report only after your own investigation has been completed

Contact the incorrect recipient first and report the incident only if it cannot be resolved

Document the incident and raise it with your manager at the next regular meeting

17.

What should be observed during confidential telephone conversations?

Ensure that unauthorized persons cannot overhear and, where necessary, verify the other party’s authorization

For internal callers, no special precautions are necessary if the telephone number is known

As a safeguard, always have a second employee listen in as a witness

Conduct confidential conversations only on a business telephone whenever possible

18.

May information about employee data be provided by telephone?

Yes, to managers and the HR department generally without further verification

Yes, if the caller uses an internal telephone number and states the relevant department

Only after the caller has been sufficiently identified and their authorization has been verified

Yes, if the caller credibly explains that the information is needed for a business process

19.

How can potentially unauthorized requests be recognized?

Primarily because the caller does not provide a company email address

By missing or unverifiable identification, unusual questions, time pressure, or attempts to bypass normal checks

Primarily by an unknown telephone number or a very brief request

By an uncertain manner or because the requester does not use precise technical terminology

20.

Who may access personal data?

Managers generally have access to all personal data within their area of responsibility

Any employee with a personal company account, provided that the data is not disclosed outside the company

All employees in the same department if the data is generally relevant to the department’s work

Only persons who are appropriately authorized for their specific task and need the access

21.

How should personal data be stored?

On an encrypted private USB stick if it is used exclusively for business purposes

On the local desktop if the computer is protected by a password and screen lock

In a private cloud storage service if two-factor authentication is enabled

In company-approved, appropriately protected systems and storage locations with suitable access rights

22.

What does the “Need-to-Know” principle mean?

Employees are given access to all data within their team so that substitutions are always possible

Only those who need specific data to perform their particular task are given corresponding access

Managers generally receive broader access than their employees

Information may be shared within the company if there is a general business benefit

23.

How should USB sticks containing sensitive data be handled?

A password for the files stored on them is sufficient regardless of company requirements

After copying the data, it is sufficient to move the files on the USB stick to the recycle bin

They must be protected in accordance with company requirements, in particular by suitable encryption and secure storage

They may be stored openly within the company if the company computer is additionally password-protected

24.

What applies to private devices at the workplace (e.g. mobile phones)?

They may be used for business data only where this is approved under company rules and appropriately secured

They may be used for business emails as long as no attachments are stored

They may be used if at least a PIN or biometric lock has been set up

They are unproblematic if business data is deleted from the private device after use

25.

What applies to private USB sticks in company computers?

They may be used if a virus scan has been carried out beforehand

They may be used only in accordance with company or IT security requirements and, where applicable, after approval

They are permitted as long as no personal data is copied onto them

They may be used if the computer is disconnected from the internet while they are connected

26.

Was ist „Phishing“?

An attempt to deceive people in order to obtain access credentials or other sensitive information

A method for encrypted transmission of confidential messages

A technical check used to inspect links and attachments before opening them

A method for automatically detecting and filtering unwanted emails

27.

How can phishing emails be recognized?

By attachments or links; legitimate business emails generally do not contain such elements

Exclusively by spelling mistakes or unusual formatting

Primarily because the message is particularly short and does not contain a complete signature

By possible warning signs such as unexpected requests, time pressure, unusual senders, links, or login prompts

28.

How should you respond to suspicious emails?

Open the message but do not download attachments until its authenticity has been confirmed

Forward the message to a colleague and ask whether they know the sender

Do not act through suspicious links or attachments and have the message checked or report it through the designated IT/security channel

Reply to the sender and request written confirmation before taking any further action

29.

What is the objective of the GDPR?

To protect particularly sensitive data such as health and banking data throughout Europe; other data is covered only to a limited extent

To create uniform rules for trade secrets and personal data

To protect natural persons with regard to the processing of personal data while ensuring the free movement of personal data within the European legal framework

To restrict the processing of personal data within the EU to strictly necessary exceptional cases

30.

What is meant by “personal data”?

Information about private individuals; data about employees in a professional context is generally not included

Only information that directly identifies a person by name and address

Only confidential information that a person has not made publicly availabl

Information relating to an identified or identifiable natural person

31.

Where may personnel files be stored?

In an appropriately protected area, for example a lockable cabinet with controlled access

Openly within an HR department because only company employees have access

At the responsible manager’s workplace if the office is locked outside working hours

In a central departmental filing area as long as the documents do not leave the building

32.

Who may inspect a personnel file?

Any manager if the personnel file concerns an employee in their own area

Only persons authorized for their respective task, such as responsible HR staff or authorized managers

External service providers as soon as they perform HR-related work on behalf of the company

All HR employees because they are organizationally responsible for personnel matters

33.

How long may personnel files be retained?

Only for as long as a permissible purpose or a statutory retention obligation justifies continued storage

Indefinitely if access is restricted after the employee leaves the company

Generally for the entire duration of employment and then uniformly for ten years

Until all possible claims arising from the employment relationship have become time-barred; other retention obligations are irrelevant

34.

What applies under the GDPR to rooms containing personal data?

A closed office door is always sufficient if the room is located inside a company building

The room needs to be locked only outside business hours; during the day, the presence of colleagues is sufficient

It is sufficient to lock computers; paper documents do not require special protection within a company building

Rooms and documents must be secured against unauthorized access in accordance with the required level of protection and company access rules

35.

Who may be granted access to sensitive areas?

All managers as well as external service providers with a current assignment

Visitors after registering at reception, provided that an employee has announced their visit

Only persons with the required access authorization; visitors or service providers, where applicable, only in accordance with the designated rules

All company employees provided that they carry an employee ID card

36.

What should be considered with regard to access control?

Access logs must permanently record every room and every movement of all employees

Access must be managed and, where provided, documented in a traceable manner so that unauthorized persons cannot enter protected areas

An employee ID card is generally sufficient as access control for all company areas

Registration at reception is required only for visitors; no further restrictions are necessary for employees

1 out of 3

37.

What is the purpose of a Record of Processing Activities (RoPA)?

To document which employees are allowed to access which IT systems

To provide structured documentation of personal-data processing activities and key information about them

To centrally store all consent records and data protection notices of the company

To document all IT and service-provider contracts involving personal data

38.

Who is responsible for the Record of Processing Activities?

The IT department, because it manages the technical processing systems

The respective business department alone, because it knows the specific business process best

The controller responsible for the company’s data processing; the Data Protection Officer may advise and monitor

The Data Protection Officer, because they independently monitor compliance with the GDPR

39.

What must be included in a Record of Processing Activities?

Among other things, the purposes of processing, categories of data subjects and data, categories of recipients and, where possible, retention periods and a general description of security measures

Only the legal basis, responsible employee and name of the Data Protection Officer; technical information does not belong in the RoPA

For each process, the full names of all data subjects and the individual information relating to them

Primarily the IT systems used, user accounts and individual access rights of all employees

40.

When is a Data Processing Agreement (DPA) required?

Bei jedem Vertrag mit einem IT-Dienstleister, For every contract with an IT service provider, regardless of whether that provider processes personal datadavon, ob dieser personenbezogene Daten verarbeitet

Only when the external service provider processes special categories of personal data

Primarily for service providers outside the EU; within the EU, a DPA is generally not required

When an external service provider processes personal data on behalf of and under the instructions of the company

41.

What does a Data Processing Agreement (DPA) regulate?

The conditions under which the service provider may further use personal data for its own business purposes

Only liability and notification duties in the event of personal data breaches; technical and organizational measures are regulated separately

Primarily the legal basis on which the company processes the personal data of its customers or employees

The data protection rights and obligations of the parties when processing on behalf of the controller, including instructions and protective measures

42.

Must a Data Processing Agreement be concluded in writing?

Yes. The contract or other legal act must be in writing; electronic form is also permitted

Only if special categories of personal data or data in third countries are processed

No. An oral agreement is sufficient if both parties document it internally

Yes, but only with handwritten signatures or qualified electronic signatures from both parties

43.

What is the purpose of a data protection concept?

To combine all data protection contracts, consent records and information obligations into a single document

To systematically plan and implement data protection measures, responsibilities and organizational processes within the company

Primarily to keep evidence available for supervisory authority inspections; the concept is not relevant to employees’ daily work

To fully document the IT department’s technical security measures; organizational matters are regulated separately

44.

What belongs in a data protection concept?

Only technical security measures, retention periods and the Data Protection Officer’s contact details

The privacy notice, legal notice and all company contracts with external service providers

Data protection organization, responsibilities, protective measures, risk considerations, and training and awareness measures

Primarily the complete personal-data holdings relating to employees and customers so that risks can be assessed

45.

Who needs to know the data protection concept?

Only employees who regularly process special categories of personal data

Only management and the Data Protection Officer because they are responsible for it

Employees must know and observe the data protection requirements and procedures relevant to their respective tasks

All employees must know the complete data protection concept and all underlying legal provisions

46.

What do deletion periods under the GDPR regulate?

How long all business documents must be retained regardless of their content

How long personal data may or must be stored for a permissible purpose or because of legal obligations

After what period emails are automatically deleted from an employee’s personal mailbox

The uniform period after which a company must delete personal data at the latest

47.

When does the deletion period for personal data begin?

When consent is received, because the permissible storage period starts at that point

Only when the data subject expressly requests deletion or withdraws consent

Generally at the end of the calendar year in which the data was last used

When the purpose of processing no longer applies, it must be assessed whether the data should be deleted or whether, for example, statutory retention obligations justify continued storage

48.

Which data must be archived instead of deleted?

Data that must continue to be retained for a specified period because of statutory retention obligations

Only tax data; there are no statutory retention obligations for other documents containing personal data

All data older than two years that is no longer needed for day-to-day business

All personal data of former employees until a uniform ten-year period has expired

49.

From how many employees must a Data Protection Officer be designated?

From 20 persons who, as a rule, are permanently engaged in the automated processing of personal data; additional statutory designation requirements may also apply

From 10 persons who regularly work with personal data

From 50 employees, regardless of whether they process personal data

Only from 100 employees; smaller companies may designate a Data Protection Officer only voluntarily

50.

Who can be a Data Protection Officer?

Generally a member of management because management bears the highest responsibility for data processing

An internal or external person with the required professional expertise and reliability, provided in particular that there is no impermissible conflict of interest

Any internal employee provided that they have at least one year of professional experience in the company

Only an external lawyer or another person with formal legal training

2 out of 3

51.

You leave your home-office workstation for about ten minutes during working hours. What should you do with your work computer?

If the computer is in a private study, it is sufficient to close sensitive applications and leave the screen switched on.

The computer should be locked whenever you leave the workstation, regardless of how long you expect to be away.

Locking the computer is mainly necessary if people from outside your household are present in the home while you are away.

For a short absence, it is sufficient to switch off the screen, provided you continue using the computer immediately after returning.

52.

Your desk contains documents with customers' names and contact details. How should you handle these documents after work?

The documents may remain on the desk if the study is normally not used by other people after working hours.

It is sufficient to turn the documents face down or cover them with other documents, provided they do not contain particularly sensitive data.

In accordance with company requirements, the documents should be stored in such a way that unauthorized persons cannot access or view them.

Special storage is only required if the documents contain particularly sensitive information in addition to names and contact details.

53.

Your partner would like to briefly use your work laptop to access a private website. Which statement is most appropriate?

Brief use is acceptable if a separate browser window is used and no work-related programs are open.

Use is possible if you are present and subsequently check that no files have been downloaded.

The company's rules are decisive; without explicit permission, the work laptop should not be used by other people.

Use is unproblematic if a separate user account without administrator rights has been set up for private access.

54.

Confidential information is being discussed during a work-related phone call. Another person is in the same room. What is the appropriate course of action?

The conversation can continue if names and other directly identifying details are avoided as far as possible.

If the person present is a member of your household, it is generally sufficient to inform them that the conversation is confidential.

The conversation should be conducted in such a way that unauthorized persons cannot overhear the confidential content.

A headset is sufficient because it prevents the other person from hearing what the person on the other end of the call is saying.

55.

You have printed several pages containing personal data while working from home and no longer need them. What should you do?

The printouts can be torn up and then disposed of in your private paper waste, provided names and addresses are distributed across different pieces.

The printouts should first be stored securely and then destroyed safely using the method specified by the employer.

The printouts can be collected on the desk until the next working day, provided they are placed face down.

The documents can be disposed of with private waste paper if they do not contain special categories of personal data.

56.

You receive an email that appears to come from the IT department and asks you to log in again via a link because of an alleged security problem. What should you do?

If the sender name and company logo look correct, the link can be opened; however, login credentials should only be entered after checking the website.

The message should first be forwarded to a colleague to find out whether they have received a similar request.

The link should not be used; instead, the message should be checked and/or reported through the designated company channels.

You can reply to the email and ask the sender to confirm that the request really comes from the IT department.

57.

You want to continue working on a work-related file on another device in the evening. Which approach is most appropriate from a data-protection perspective?

The file may be temporarily stored on a private device if it has up-to-date antivirus protection and is used exclusively by you.

The file may be transferred via a private cloud service provided two-factor authentication is enabled there.

Devices, applications, and storage locations approved by the employer should be used for storing and editing the file.

The file may be copied to a private encrypted USB drive if it is deleted again after the work is completed.

58.

You are working with confidential documents during a video conference. Which measure is the most appropriate?

A headset is generally sufficient if it prevents other people from hearing what the other participants are saying.

The camera can be switched off; this fulfills the essential data-protection requirements for the workstation environment.

Care should be taken to ensure that unauthorized persons can neither overhear the conversation nor view confidential information on the screen or in documents.

Other people may remain in the room as long as they stay outside the camera's field of view and do not actively participate in the conversation.

59.

In the evening, you realize that your work laptop has probably been lost while you were out. The device is protected by a password and encryption. What should you do?

Because encryption is in place, you can wait until the next working day before reporting the loss.

You should first search for the device yourself; reporting is only necessary once the loss has been definitively confirmed.

The possible loss should be reported promptly through the designated company reporting channels so that the responsible teams can assess the necessary measures.

Immediate reporting is only necessary if it is known for certain that personal data was stored locally on the device.

60.

Your workstation is located in a room that is occasionally also used by other members of your household. How should you position your screen?

The screen can be positioned so that it is freely visible if all applications are closed whenever you leave the workstation.

It is sufficient to minimize particularly confidential applications whenever another person is in the room.

The screen should, as far as possible, be positioned or protected so that unauthorized persons cannot easily view work-related information.

Special privacy protection is mainly required for visitors; members of your own household can generally be assumed to maintain sufficient confidentiality.

3 out of 3

Datenschutz-Notfallkontakt: 0176-62 99 10 16 oder 030 – 51 63 50 30 / Kontaktformular

Free Data Protection Training

Online Data Protection Training for Employees or Interested Individuals + Certificate of Participation

Welcome to the Online Data Protection Training