Data protection can sometimes feel like one of those areas of business that is important, but it’s difficult to know where to start.
For smaller organisations in particular, there may not be a dedicated data protection team or specialist in-house resource. Instead, responsibility for protecting personal information can sit across different people and departments, alongside everything else involved in running a business.
The Information Commissioner’s Office (ICO) has recognised this challenge and has launched a new free online programme designed to help.
Data Protection Essentials is a training and self-assessment programme aimed at small and medium-sized organisations, their employees and sole traders. The ICO announced the programme on 11 August 2026, describing it as a way to provide smaller organisations with straightforward, practical advice that can be applied to everyday work.
For businesses that handle information about customers, employees, clients, tenants, service users or other individuals, it could be a useful place to start reviewing how that information is managed.
What is Data Protection Essentials?
The programme has been created by ICO experts and is designed to be flexible and accessible.
The training consists of 13 bite-sized modules, each taking around 10–15 minutes, allowing participants to work through the material at their own pace. It also uses sector-specific and real-world examples to make the guidance relevant to everyday situations.
The ICO says the programme is designed for organisations with fewer than 250 employees, which don’t have a Data Protection Officer and aren’t undertaking high-risk data processing.
The training covers practical issues including how businesses share information, manage records securely, use personal information for marketing and customer engagement, and reduce the risk of data breaches.
There is also a short self-assessment which provides organisations with a clearer picture of how they currently handle personal information and where improvements could be made.
And importantly, it’s free.
The ICO says Data Protection Essentials is free and is funded through the data protection fee. It is also available to organisations that are exempt from paying the fee.
Individuals completing the training can receive a digital certificate. Organisations can also receive a certificate after completing the self-assessment, with the option of appearing on the ICO’s Data Protection Essentials public register.
There is an important distinction here, however.
Completing Data Protection Essentials isn’t the same as becoming a certified GDPR-compliant organisation.
The ICO is clear that the programme is a practical training and self-assessment programme, not an accredited certification scheme. Being listed on its public register also does not mean the ICO has certified or endorsed an organisation’s compliance.
Why should SMEs take notice?
For smaller organisations, the value may be less about achieving another certificate and more about building confidence and identifying areas for improvement.
Data protection affects far more than what appears in a privacy policy.
Think about the information your business handles every day:
- Customer contact details
- Employee records
- Supplier information
- Financial information
- Sales and marketing databases
- HR information
- Emails and attachments
- Information stored in cloud applications
- Documents held on laptops and other devices
All of this needs to be managed appropriately.
And increasingly, the way that information is protected depends on the technology businesses use.
Data protection and IT go hand in hand.
Completing data protection training is a valuable starting point. But understanding your responsibilities is only part of the picture.
Businesses also need to consider whether their IT systems and security controls support good data protection practices.
For example:
Who has access to your information?
Are employees able to access everything, or only the information they need?
How is information protected?
Are important accounts protected by multi-factor authentication? Are devices secure?
What happens if something goes wrong?
If an account is compromised or a laptop is lost, do you know what happens next?
Is your data backed up?
And, importantly, are those backups protected against the same threats as your live systems?
How are employees sharing information?
Are sensitive documents being sent and stored securely?
These aren’t purely data protection questions or purely IT questions. There is considerable overlap.
The ICO itself provides practical guidance around backups, passwords and multi-factor authentication, access controls, phishing awareness, device security and secure disposal of equipment.
Our advice to SMEs:
If your organisation falls within the intended audience, we’d recommend taking advantage of the ICO’s new training.
It’s free, it’s designed specifically for smaller organisations and it provides a useful opportunity to step back and consider how your business handles personal information.
Start with the ICO’s guidance. Then look at what happens in practice.
Does your technology support the processes you’ve put in place? Are your employees equipped to handle information securely? Are there areas where you know you could do better?
That’s where an experienced IT and cyber security partner can help.
At Immervox, we work with businesses to provide practical advice around IT, cyber security and the technology that underpins their day-to-day operations. We don’t believe compliance should be about unnecessary complexity or ticking boxes for the sake of it. It’s about understanding the risks and putting sensible measures in place.
If you’ve completed the ICO training and aren’t sure what you should tackle next, our experts are happy to help you work out where to start.
Useful resource: ICO – Data Protection Essentials
Source: ICO – Boost your business fitness: ICO offers new, free data protection training for SMEs
