GDPR training: answering real employee situations

GDPR training for employees must prepare them for real situations. That covers the access request received by phone, the caller who asks for information about a third party and the identity to verify without causing offense. Short answer: the employee recognizes the request, verifies identity in a proportionate way, gives nothing about a third party and passes it to the right contact.

The GDPR is the EU's data protection regulation, and it also reaches US companies that handle the personal data of people in the EU. It is not played out only in the legal department. It is played out at the front desk, at reception, in customer service, in conversation. This article presents the useful rules, then a method to train them aloud.

What should an employee know about the GDPR day to day?

An employee does not need to recite Regulation (EU) 2016/679. They need to retain a few landmarks that trigger the right reflex.

• A data subject access request can arrive anywhere. By email, mail, form, but also orally. The text of article 12 provides for no particular formality.
• The deadline is short. Under article 12(3), the controller replies at the latest within one month of receipt. This period can be extended by two months where the complexity or number of requests requires it. The person must then be informed within the first month.
• Identity is verified when in doubt. Article 12(6) allows additional information to be requested where there are reasonable doubts about the identity of the requester.
• Third parties are protected. The right to obtain a copy must not adversely affect the rights and freedoms of others (article 15(4)).

The regulation also entrusts the data protection officer with raising awareness and training staff (article 39(1)(b)). Employee training therefore belongs to governance.

How to react to an access request received by phone?

The French data protection authority (CNIL) details the response to an access request on its website, without specifically addressing the telephone case. It mentions the request made on site, the written request and the electronic request. Orally, the challenge is not to let the request get lost.

Here is an outline in five steps.

1. Recognize the request. “If I understand correctly, you would like a copy of the data we hold about you.”
2. Take it on board. “I’m recording it right now. You will receive a reply within one month.”
3. Verify identity in a proportionate way. See the next section.
4. Direct to the internal procedure. “I’m passing your request to the team in charge of these requests, who will get back to you.”
5. Keep a record. Date of the call, nature of the request, person who passed it on. The deadline runs from receipt.

The employee does not disclose the data themselves by phone. Nor do they say “we have nothing on you” without checking. The response circuit belongs to the designated team, which knows the systems and the exceptions.

Verifying the caller's identity without overdoing it

The CNIL points out that it is not necessary to ask for an ID document as a matter of principle. Identity can be established by any means, for example an account number. In case of reasonable doubt, it is possible to ask for supporting evidence. The level of verification depends on the nature of the request and the sensitivity of the data.

On the phone, the employee cannot see the person and does not always have an authenticated space. This context can justify a more thorough check for sensitive data. It must remain proportionate, without collecting more data than necessary.

Sentences you can use:

“To protect your data, I need to make sure I’m speaking to the person concerned. Could you give me your account number?”

“I can’t share this information by phone. I’ll call you back on the number in your file.”

The callback follows the logic explained in the article on the callback procedure through an independent channel. Identity verification questions have their limits: some information is public. The article on verifying a caller's identity details them.

What to answer a caller who wants information about someone else?

This is the situation where the risk is highest. A spouse, a relative, a “colleague of the person”, a self-described government agency asks for an address, a number or a status. The CNIL cites the example of the spouse or the colleague in its check on third-party rights.

A malicious person can use this channel to prepare a scam: the more details they get about a person, the more credible the next call will be. Imagine a caller who introduces himself as a customer's advisor. He asks “just” for a date of birth to “finalize a file”.

The answer takes three sentences.

“I can’t share information about another person.”

“If that person wishes, they can contact us directly.”

“I’ll point you to the procedure for official requests.”

The employee does not have to debate, or explain why they refuse. The more they justify themselves, the more hold they give to insistence. See our article on saying no on the phone under pressure.

Common mistakes by employees

• Answering on the spot to be nice. Giving information “just to help out” is precisely the case to avoid.
• Ignoring the request for lack of a form. An oral request exists. The clock runs even if nobody noted it.
• Demanding an ID document systematically. The CNIL indicates that this is not necessary without reasonable doubt.
• Confirming or denying that a person is a customer. Even that information reveals a piece of data about a third party.
• Not reporting a disclosure made by mistake. Information given to the wrong person must be escalated immediately to the department concerned. A data breach may require notification to the supervisory authority within 72 hours, from the moment the organization becomes aware of it.

Training employees through role-play

Knowing that identity must be verified does not say how to do it aloud, facing someone irritated. E-learning conveys the framework. It leaves aside the awkwardness of refusing, the temptation to be helpful and the caller's insistence. Yet these three forces are what make people give in. Our page on mandatory compliance training explains why this gap is general. The article on completion versus competence confirms it.

A GDPR role-play scenario takes a few minutes. The persona, played by an AI, is a caller in a hurry who asks for information about his former business partner. The trainer sets the level of insistence. The learner must refuse, redirect and confirm nothing.

With Face Up, trainers write their scenarios from their own cases, helped by a design assistant. The learner speaks, by voice or on video. Their debrief shows the objectives met, the strengths and the points to improve. It also contains an action plan and quotes. They can play again.

Organizing the internal circuit so the employee is not alone

Successful training is not enough if the employee does not know whom to pass the request to. Before training the conversations, check that the circuit exists and is known.

• An identified entry point. An address, a form or a named contact for rights requests.
• A clear rule for oral requests. Who notes the call, in which tool, with what information.
• A standard message. A hand-over sentence any employee can say without improvising.
• An incident escalation channel. To report information given by mistake, without fear of being punished.

The front-line employee then feels supported. They can refuse with confidence, because they know the follow-up is taken care of. Checking third-party rights, drafting the reply and any reasoned refusal remain the responsibility of the designated team.

Debrief grid

• Did they recognize the access request and announce the deadline?
• Did they verify identity in a proportionate way?
• Did they refuse all information about a third party, without confirming or denying?
• Did they direct to the internal procedure?
• Did they avoid justifying themselves at length?
• Did they think to record the call?

Frequently asked questions

Is an access request by phone valid?

Article 12 of the GDPR provides for no particular formality for the request. The safest course is to treat it as received from the moment of the call and to record it. Your data protection officer can set an internal rule, for example a written confirmation.

Must you always ask for an ID document?

No. According to the CNIL, identity can be established by any means, and a document is only requested in case of reasonable doubt. The level of checking depends on the sensitivity of the data requested.

What is the response deadline?

One month from receipt, under article 12(3), extendable by two months if the request is complex or numerous. The person must be informed of the extension within the first month.

To train your teams in these conversations on your real cases, book a demo. You can also read our article on AML/CFT training, which deals with another conversation under regulatory constraint.