Compliance Essentials: Online Training in Data Protection, Information Security & AI

Martin Holzhofer is managing director of Compliance Essentials GmbH, based in Planegg near Munich and founded in 2019. He has worked in information security since 2000 and in data protection since 2007. Course contents are developed together with experts at Holzhofer Consulting.

Currently, we offer four courses for employees: AI-Literacy for Employees, Data Protection for Employees, Information Security for Employees, Mobile Working for Employees. Each course ends with a final quiz and a personal certificate of completion.

Yes. Raising awareness among employees and training them is one of the tasks of the data protection officer (Art. 39(1) GDPR). The reason is simple: only those who know the data protection principles can comply with them (Art. 5 GDPR). And only with employees who understand the risks can the security of processing be ensured (Art. 32 GDPR). For managing directors and executive boards, the evidence that the accountability obligation requires anyway also matters (Art. 5(2) GDPR): those who can prove that their employees were trained can reduce their liability if something goes wrong.

For many companies it is a legal requirement; for all others it is a question of liability. Managing directors and executive boards must organize their company in a way that prevents damage from cyberattacks as far as possible (Section 43 of the German Limited Liability Companies Act, Section 93 of the German Stock Corporation Act). Trained employees are one of the most effective measures. Anyone processing personal data is also bound by the GDPR: only those who deploy employees who understand the risks can ensure the security of processing (Art. 32 GDPR).

Training and awareness measures are explicitly required, among others, for:

• essential and important entities under the German BSI Act (BSIG), which implements the NIS2 Directive in Germany (Section 30(2) no. 7 BSIG). Management must implement and monitor these measures and is liable for them (Section 38 BSIG).
• providers of digital infrastructure and digital services such as cloud and data center providers, MSPs/MSSPs, DNS service providers, and trust service providers (NIS2 Implementing Regulation (EU) 2024/2690).
• financial entities under DORA, for all employees and the management body (Art. 13(6) Regulation (EU) 2022/2554). Their ICT third-party service providers are included in the training.
• telecommunications companies that are essential or important entities (Section 165(2a) no. 7 and (2d) of the German Telecommunications Act, TKG).
• operators of energy supply networks and energy facilities (Section 5c(4) no. 7 and Section 5e(3) of the German Energy Industry Act, EnWG).
• aviation security companies, including the secure air cargo supply chain (Implementing Regulation (EU) 2015/1998, Annex point 11.2.8).
• medical and psychotherapy practices under the German statutory health insurance system and medical care centers (MVZ) (Section 390 of Book V of the German Social Code in conjunction with the IT security guideline of the National Association of Statutory Health Insurance Physicians, KBV).

Companies that are certified or audited under ISO/IEC 27001, BSI IT-Grundschutz, or TISAX must also prove that their employees have been made aware and trained (ISO/IEC 27001 clause 7.3 and Annex A 6.3, IT-Grundschutz module ORP.3, VDA ISA 2.1.3).

Our course Information Security for Employees helps you raise your employees' awareness and provides the evidence with a certificate for each participant.

Yes, for companies that use AI systems: under Art. 4 of the EU AI Act, providers and deployers of AI systems must ensure, since February 2, 2025, that their staff have a sufficient level of AI literacy.

Yes. In the past, the training was only available to Holzhofer Consulting's clients; at Compliance Essentials, any company can book it online. We sell to businesses, self-employed professionals, and public institutions only, not to consumers.

Yes, on request our experts also train your employees on site, tailored to your company. Just contact us using the contact form. For most companies, however, we recommend online training: it meets the requirements at a fraction of the cost. And it solves the typical problem of in-person sessions: anyone who misses a session because of vacation, illness, or a business trip does not need a make-up date but simply completes the training when they are back. It also suits hybrid work between home office and the office: everyone learns wherever they happen to be working. You will find a direct comparison above.

A course takes 30 to 100 minutes and can be paused at any time. Each license is valid for 12 months, including all updates.

All courses are available in German and English. The language is set individually for each participant.