Data Protection and GDPR Awareness Training for Staff
A misplaced note, an email sent to the wrong person, or a conversation overheard in a public place can expose private information in seconds. In companionship services, that information may include a client’s health, family circumstances, wellbeing, routines, support needs, and personal preferences.
Data protection is not only a legal requirement. It is part of safe, respectful care. Clients, families, volunteers, companions, coordinators, team leaders, and managers all play a role in keeping information confidential and secure.
Mandatory Training 18, also known as MT18, gives staff and volunteers a practical understanding of the UK General Data Protection Regulation, the Data Protection Act 2018, confidentiality, information security, and safe record handling. The aim is simple: collect only what is needed, use it properly, protect it carefully, share it lawfully, and dispose of it safely.
Course information at a glance
Course detail | Information |
Course title | Data Protection and GDPR Awareness |
Course reference | MT18 |
Target audience | All companions, volunteers, team leaders, coordinators, and management staff |
Duration | 2 hours |
Delivery method | E-learning, virtual classroom, or face-to-face training |
Refresher period | Every 3 years |
Assessment | 10 randomly selected questions from a bank of 15 questions |
Pass mark | 80% |
This course is suitable for anyone who handles, records, views, shares, stores, or discusses information about clients, relatives, colleagues, partner organisations, or service users. That includes people who work directly in the community, those who coordinate services, and those who manage records or support systems.
The training is informational and does not replace legal advice. Organisations should follow their own policies, contracts, regulator expectations, and advice from their data protection lead or Data Protection Officer where one is appointed.
Why data protection matters in companionship services
Companionship services often rely on trust. A client may share details that feel ordinary in the moment, such as a change in medication, a family concern, a financial worry, or a preference about visitors. To the person receiving support, that information may be deeply personal.
Data protection helps to:
protect clients from harm, distress, discrimination, or embarrassment
maintain trust between clients, families, staff, and volunteers
support safe and consistent care
meet legal duties under UK GDPR and the Data Protection Act 2018
reduce the risk of data breaches, complaints, and enforcement action
make sure information is accurate, relevant, and available when needed
Confidentiality is closely linked to data protection, but they are not identical. Confidentiality means respecting private information and not disclosing it without a valid reason. Data protection covers the wider rules for handling personal information lawfully, fairly, securely, and transparently.
A companion may know that a client lives alone, struggles with memory, has a particular medical condition, or does not want certain relatives contacted. That information must be treated with care from the moment it is collected to the moment it is securely deleted or destroyed.
What learners should be able to do after the training
By the end of MT18, learners should be able to:
Understand the purpose of data protection legislation.
Explain the main principles of UK GDPR and the Data Protection Act 2018.
Recognise personal data and special category data.
Handle information confidentially and securely.
Know when information can be shared lawfully.
Recognise a data breach and report it promptly.
Use electronic and paper records safely.
Maintain professional boundaries around confidential information.
Understand individual rights over personal information.
10. Follow organisational policies and procedures.
The course focuses on practical behaviour. It is not enough to know the terminology. Staff and volunteers need to apply it during visits, phone calls, emails, record updates, handovers, and conversations with families or professionals.
Module 1 helps learners understand data protection
Data protection means the lawful and secure handling of personal information. It covers the full life of information, including collection, use, storage, sharing, retention, and disposal.
In practice, this means asking clear questions:
Do we need this information?
Have we explained why we are collecting it?
Are we using it for the right purpose?
Is it accurate and up to date?
Who can access it?
How long should we keep it?
How will we dispose of it safely?
The UK GDPR sets out key principles that every organisation must follow. These principles are often the foundation of good information handling.
Lawfulness, fairness, and transparency
People should know what information is collected about them, why it is needed, how it will be used, and who it may be shared with.
Purpose limitation
Information collected for one purpose should not be used for an unrelated purpose without a lawful reason.
Data minimisation
Only collect what is needed. A record should not include unnecessary personal opinions, gossip, or details that do not support the service.
Accuracy
Records should be clear, factual, and kept up to date where needed. If information is uncertain, the record should make that clear.
Storage limitation
Information should not be kept for longer than necessary. Retention periods should follow organisational policy.
Integrity and confidentiality
Information must be protected from unauthorised access, loss, damage, or disclosure.
Accountability
Organisations must show that they follow the rules. Staff and volunteers support accountability by completing training, following procedures, and reporting concerns.
Module 2 explains personal data and special category data
Personal data is any information that can identify a living person, either directly or indirectly. A name is personal data, but so is a combination of details that points to one person.
Examples include:
full name
address
date of birth
telephone number
email address
emergency contact details
client reference number
photograph
visit records
notes about routines or support needs
Special category data needs extra protection because it is more sensitive. In companionship services, this may include:
health information
disability information
racial or ethnic origin
religious or philosophical beliefs
sexual orientation
biometric data used for identification
Criminal offence data also has special rules, even though it is treated separately from special category data under UK GDPR.
The safest approach is to treat all client information with care. A simple note saying “client prefers morning visits because they feel anxious later in the day” may reveal sensitive information about wellbeing. A diary entry, rota, care note, or phone message may include more personal information than it first appears.
Module 3 covers confidentiality and secure handling
Confidentiality should guide everyday decisions. It applies during home visits, calls, messages, travel, supervision, training, and informal conversations.
Good practice includes:
discussing client information only with people who need to know
checking identity before sharing information by phone
avoiding client conversations in public places
keeping paper notes out of sight during travel
using approved systems rather than personal accounts
locking devices when not in use
using strong passwords and multi-factor authentication where available
reporting lost paperwork, devices, or access concerns straight away
Confidentiality also means maintaining professional standards. Staff and volunteers should not look up information out of curiosity, discuss clients with friends or relatives, or share stories in a way that could identify someone.
A useful test is to ask: would the client reasonably expect this information to be used or shared in this way? If not, stop and seek advice.
Module 4 explains lawful information sharing
Information sharing can be both lawful and necessary. Data protection law should not stop staff from sharing information where there is a valid reason, especially when safety is at risk.
Information may need to be shared with:
emergency services
health or social care professionals
safeguarding teams
authorised family contacts
managers or coordinators
partner organisations involved in support
The key is to share the right information with the right person, for the right reason, through a safe route.
Before sharing, consider:
Is there a lawful basis?
Is the person requesting the information authorised to receive it?
Is the information relevant and limited to what is needed?
Is there a safe method for sharing it?
Should the sharing be recorded?
Consent may be appropriate in some cases, but it is not the only lawful basis. Organisations may also rely on other lawful bases, such as contract, legal obligation, vital interests, public task, or legitimate interests, depending on the context. Special category data also needs an extra condition for processing.
If there is a safeguarding concern or immediate risk of harm, staff should follow safeguarding and reporting procedures without delay. Data protection law allows proportionate information sharing where it is necessary to protect someone.
Module 5 helps learners recognise and report breaches
A data breach is a security incident that affects personal data. It may involve loss, unauthorised access, accidental disclosure, alteration, or destruction.
Examples include:
sending an email to the wrong recipient
losing a visit note or rota
leaving client paperwork on public transport
accessing a record without a work-related reason
sharing information with an unauthorised relative
using a personal messaging app against policy
clicking a suspicious link that compromises an account
disposing of papers in general waste instead of confidential waste
Not every breach has the same level of risk, but every suspected breach should be reported promptly through the organisation’s procedure. Quick reporting allows the organisation to assess the risk, contain the issue, support anyone affected, and meet any legal reporting duties.
Staff and volunteers should not try to hide mistakes. Delayed reporting can make harm more likely. A prompt, honest report is part of professional responsibility.
Module 6 covers electronic and paper records
Both digital and paper records carry risk. Secure handling depends on consistent habits.
For electronic records, learners should understand how to:
use approved systems only
create strong passwords
avoid sharing logins
lock screens when stepping away
send emails carefully and check recipients
use encryption or secure portals where required
avoid downloading files to personal devices unless authorised
report suspicious emails or system behaviour
For paper records, learners should know how to:
keep records secure during visits and travel
avoid leaving papers visible in vehicles or homes
store documents in locked spaces where required
return records according to procedure
use confidential waste or approved shredding
avoid taking unnecessary copies
Records should be factual, respectful, and relevant. Phrases based on judgement or frustration can be harmful and may be disclosed if someone exercises their rights. A good record states what happened, what was observed, what action was taken, and who was informed.
Module 7 explains individual rights
UK GDPR gives people rights over their personal information. Staff and volunteers do not need to manage every request themselves, but they must recognise when someone may be exercising a right and pass it to the correct person.
Individual rights include:
the right to be informed
the right of access
the right to rectification
the right to erasure in certain circumstances
the right to restrict processing
the right to data portability in certain circumstances
the right to object
rights linked to automated decision-making and profiling
A client might ask, “What information do you hold about me?” or “Can you correct my address?” They might ask why a note was made or who has seen their information. These requests should be handled respectfully and in line with organisational procedures.
Do not ignore informal requests. A casual question can still relate to a legal right.
Assessment and refresher training
MT18 takes around 2 hours to complete. It can be delivered through e-learning, a virtual classroom, or face-to-face training. This flexibility helps organisations train staff and volunteers in a way that fits the service while keeping the same core learning outcomes.
The assessment uses 10 questions selected at random from a bank of 15. Learners must achieve a pass mark of 80%. This checks that they understand the main principles and can apply them to everyday situations.
Refresher training takes place every 3 years. Data protection knowledge can fade if it is not used carefully, and working practices can change. Refresher training helps reinforce safe habits, remind staff of reporting routes, and reduce avoidable errors.
The key message for staff and volunteers
Good data protection is built through small, consistent actions. Check who you are speaking to. Write only what is needed. Keep records secure. Use approved systems. Share information only when there is a lawful and professional reason. Report concerns quickly.
Clients trust companionship services with personal details that may affect their dignity, safety, and wellbeing. Protecting that information is part of treating people with respect.
The strongest approach is to pause before handling information and ask one simple question: am I protecting this person’s privacy in the way they have a right to expect?
Comments