Data Privacy Day: turn awareness into one lasting improvement

A privacy awareness event is more useful when it leaves a changed process behind. The next Data Privacy Day is 28 January 2027. Use the preparation period to choose one improvement the team can complete, demonstrate and maintain.

For leadership, the question is not simply how many employees attend. It is which uncertainty about personal data the organization will remove, who has authority to change the process, and how management will know the change still works a month later.

A useful event can combine a short briefing with a practical exercise. Employees learn something relevant, customers encounter less friction, and the business gains evidence that a process works—not just that training took place.

Make one accountable decision before planning the event

Start with a known problem rather than a calendar of activities. Perhaps support staff cannot find the privacy escalation route. Perhaps customer data is copied into a shared folder without a clear deletion owner. Perhaps a new AI feature has been introduced without updating the explanation customers receive.

Choose a problem using three questions:

• Does it affect people? Prioritize unclear uses of data, unnecessary exposure or barriers to exercising rights.
• Can the team finish a meaningful change? A bounded correction is more useful than an ambitious initiative that stops after the workshop.
• Can someone maintain it? Name a process owner, a reviewer and a review date before work begins.

Leadership should authorize the required time and decisions. If the improvement needs engineering work, give it an agreed place in the delivery schedule. If it changes retention, involve the records owner and legal adviser rather than asking employees to delete material independently.

Where a data protection officer is appointed, involve them for independent advice and monitoring. Accountability for business decisions remains with management and the relevant process owners; the DPO should not be made responsible for determining processing purposes and means.

Choose an activity linked to real work

The following options are practical recommendations, not a prescribed Data Privacy Day program. Select one main outcome; use the others only where they support it.

Keep activities small enough to finish. Use synthetic or sanitized records, remove identifiers from screenshots, and limit participation to people who need the information. An awareness exercise should not create unnecessary exposure of personal data.

Make transparency a task, not a policy-writing contest

Transparency is a useful focus because it connects legal obligations with everyday customer experience. Under GDPR Articles 12–14, relevant information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The required information and timing depend on the processing and how data is obtained.

Choose one journey: opening an account, contacting support, applying for a job or signing up for marketing. Ask a person unfamiliar with the process to find the privacy information and answer:

• What information does the organization collect, and why?
• Who receives it, including relevant providers?
• How long is it kept, or how is retention determined?
• What choices and rights are available, and where can the person ask for help?

Compare their answers with the actual process. A readable notice is still misleading if it omits a supplier or describes a retention period that systems do not follow.

A layered explanation can help: a short contextual notice at collection, a fuller explanation, and accessible detail for people who need it. The short layer must not hide material information. Avoid vague assurances such as “we value your privacy” where a concrete explanation is needed.

Agree how future changes trigger review. A new recipient, purpose, AI feature or retention rule should prompt an assessment of notices, lawful basis and other relevant safeguards. Where GDPR requires information before further processing for another purpose, a retrospective policy update is not enough. Communications should explain the actual change rather than merely announcing that a policy has changed.

Rehearse rights requests from the customer's perspective

An access-request exercise tests several teams at once: support, identity verification, system owners, privacy reviewers and secure delivery. Start with a controlled request arriving through an ordinary customer channel. Do not assume people will use your preferred form or legal terminology.

Check whether staff recognize the request, record receipt, route it correctly and locate relevant information across systems and suppliers. Include a decision about third-party information and a test of the delivery method.

GDPR Article 12 normally requires a response within one month. An extension of two further months may be available where necessary, considering complexity and number of requests, but the individual must be informed within the first month, with reasons. Requests are generally free, subject to limited conditions for fees or refusal. Additional identity information should be proportionate to reasonable doubts, not a routine demand for passport copies.

A privacy dashboard may make suitable actions easier, but it is not a universal legal requirement or a replacement for handling exceptions. Test whether people can find the controls, distinguish marketing preferences from other processing, and obtain help when self-service fails. Deletion requests also require assessment: not every record can lawfully be erased immediately.

For a fuller exercise outline, use our access-request workflow.

Include AI where it changes how personal data is used

AI awareness should begin with a specific use case, not a general presentation about technology. Ask teams whether customer messages, applicant details, employee information or other personal data enter AI tools—including features embedded in existing software.

For the selected use case, document the inputs, provider, purpose, outputs, retention arrangements and people affected. Establish whether outputs merely assist staff or influence consequential decisions. Verify provider terms and configuration rather than assuming that a familiar software supplier uses data only as expected.

The European Commission's AI Act overview identifies general application, including transparency provisions, from 2 August 2026. The precise duties depend on the system, use case and organizational role. Article 50 contains specific transparency obligations; it does not mean every AI-assisted internal task requires the same customer disclosure.

For a customer-facing assistant, assess the applicable disclosure requirement and explain accurately when the user is interacting with AI. Offering a clear route to human support is a practical service recommendation, not a universal rule for every AI system.

Separately, assess GDPR duties. Article 22 concerns certain decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions and safeguards. It is not a blanket rule covering every AI recommendation. Management should require review before deployment or material changes, rather than leaving staff to infer the boundary during an awareness session.

Teach employees the next action they can actually take

Training is most useful when it rehearses a decision. Give support staff a realistic privacy question, managers a proposed product change, and operations staff a misdirected-email scenario. Ask each group what they would do next and where they would record it.

For the email exercise, employees should know how to report promptly, preserve relevant facts and follow approved containment instructions. They should not decide alone whether an incident is reportable or conceal it after recalling a message.

Under GDPR Articles 33–34, controllers must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals' rights and freedoms. Processors notify controllers without undue delay. High risk can also require communication to affected individuals, subject to exceptions. Record the reasoning when notification is not required.

The training deliverable is therefore a usable reporting route and an informed assessment process—not a quiz score alone.

Worked example: remove an unmanaged customer-data copy

Illustrative assumptions: a small software business exports customer support records into a shared folder for weekly analysis. The export includes contact details and free-text messages. The folder has inherited access, and nobody owns deletion. Leadership selects this flow for Data Privacy Day; this is a hypothetical example, not a Secani customer result.

Before the event, the support manager and system owner create a sanitized sample and record the current export route. The privacy adviser identifies questions about purpose, minimization, retention and supplier access. The workshop asks: where is each copy created, who uses it, and how is it removed?

Participants discover that an old analysis process no longer needs free-text messages. They propose a narrower export, a role-based access group and a defined retention rule. Management authorizes the process change, subject to confirming any legal preservation requirements.

The team tests the revised export, checks that excluded fields are absent, removes unnecessary folder access and tests deletion on eligible sample records. If automated deletion cannot be completed immediately, the owner documents an interim controlled process and a delivery date rather than declaring the issue closed.

The completion package contains the updated flow map, approved field list, access-change record, retention decision, test result and named owner. One month later, the reviewer checks a fresh export and confirms that old eligible files are no longer accumulating. The lasting improvement is a changed data-handling process, not the workshop itself.

Measure what remains after the event

Define completion before the activity starts. “Privacy notice updated” is weaker than “the notice matches the selected data flow, has been approved, and participants can find and explain it.” “Access reviewed” is weaker than evidence that approved removals were implemented.

Retain a compact improvement record:

• The problem, scope and people potentially affected.
• The accountable owner and approving reviewer.
• The agreed change and unresolved exceptions.
• Evidence of implementation and testing.
• The next review date and what will trigger an earlier review.

Attendance is useful for understanding reach, but it does not show that a process improved. Choose measures tied to the outcome: unresolved ownership questions, failed request handoffs, unnecessary access memberships or records exceeding an approved retention period. Restrict access to evidence containing personal data and avoid preserving unnecessary copies merely to demonstrate diligence.

Prepare now, then revisit the change

Use the preparation period to select the process, confirm ownership and gather sanitized material. Before 28 January, agree the completion criteria and reserve implementation time. On the day, run the exercise and record decisions. Assign uncertain answers as follow-up work rather than allowing them to disappear into meeting notes.

Secani can support that follow-up within the wider compliance program: model the relevant systems and providers, connect evidence to requirements or controls, assign owners and turn gaps into tasks. Keep human review explicit for AI-assisted suggestions and evidence conclusions, preserving sources, approvals and decision context.

Set a review for one month after the event. Ask whether the change works with fresh records and whether someone still owns it. Start with one activity that removes a known uncertainty, then use the result to decide what deserves attention next.