Raising Data Protection Awareness at Work: A Training Approach for SMEs

Data Protection constitutes an increasingly important consideration for companies dealing with the personal data of customers and staff. Raising data protection awareness among staff requires training in the basics of data protection. In this paper, we propose a research framework to aid in the design and development of training programs for SMEs which take into account the typical resource constraints faced by SMEs in terms of constraints on providing formal training, i.e. the demands on employees’ time and the financial pressure of providing such training for staff. The research framework is partly derived from Bandura’s Social Cognitive theory and partly from IS security training literature. The framework was validated during an action research project that took place in an SME. The framework was designed in such a way as to be replicable in any resource constrained SME environment. During the action research project, a training intervention based on the framework was conducted to measure the increased awareness of data protection issues among employees once the training was complete. The results indicate that the training program was in fact low cost and sufficiently dynamic to facilitate learning in such a challenging environment as an SME.