← NDPA 2023 · Governance
GAID Art.30 — Privacy training and internal sensitisation (GAID 2025)
Requirement
The Act does not itself mandate staff training, but the GAID 2025 requires controllers and processors to train personnel on data protection law and practice (within six months of starting business and at least annually; Art. 7) and to maintain a schedule of internal sensitisation and privacy training (Art. 30).
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| ISO 27001 | A.6.3 | Information security awareness, education and training | training awareness |
| PCI DSS 4.0.1 | 12.6 | Security awareness programme | training awareness |
| GLBA | 314.4(e) | Security awareness training and qualified security personnel | training awareness |
| NIST CSF 2.0 | PR.AT-01 | Personnel are provided awareness and training | training awareness |
| CCPA/CPRA | 1798.130(a)(6) & Regs 7100 | Training for staff who handle privacy inquiries | training |
| SOC 2 | CC1.1 | Commitment to integrity and ethical values | training |
| SOC 2 | CC1.4 | Competence of personnel | training |
| SOC 2 | CC2.2 | Internal communication of responsibilities | training |