"How often should we refresh compliance training?" is the most common HR question after the first year of a compliance program. The answer "annually" is not wrong — but it is not complete. GDPR, workplace safety law, and NIS2 imply three different intervals, and each falls into a different HR planning logic.
Compliance is not one program. It is three, each with its own cadence.
What the law actually requires
EU workplace safety directives require periodic training, but rarely fix a single interval. The rule is simple: the employer sets the interval in the Risk Assessment. For workplaces with elevated risk of accidents or occupational disease, the interval must not exceed two years. Office roles with minimal risk often refresh every three to five years. That only holds when the Risk Assessment explicitly permits it.
GDPR has no fixed interval. Article 39 requires the DPO to ensure "awareness-raising and training of staff involved in processing operations" as an ongoing task. A new subject-rights procedure, a new processor, or a new CRM triggers a refresh — the calendar does not lead. Supervisory authorities across the EU treat training as a baseline expectation, not a one-off event.
NIS2 (Article 20) is explicit: management and staff must receive regular cybersecurity training. The directive does not quantify "regular", but practice and supervisory authorities expect at least an annual cycle. More exposed roles also need more frequent phishing simulations.
Practical intervals by domain
Three pillars keep the program manageable:
- Workplace safety. Refresher every two years for all roles with elevated risk — production, logistics, assembly, height work, lab. Office roles every three years where the Risk Assessment permits. Always re-train on transfer, on introduction of new technology, and after an incident.
- GDPR. Annual refresher for anyone processing personal data — in an SMB, nearly everyone. Additional training on process change (new CRM, new marketing tool) or after an incident.
- NIS2. For entities in scope (essential and important): an annual mandatory module for management and staff. Plus quarterly phishing simulations for roles with production or financial access.
Bundling all three into a single annual compliance month (January or September) works best. HR then pushes a refresh module of under 30 minutes total. The rest of the year goes to new hires and incident-driven training. For how to structure the NIS2 module itself, see cybersecurity awareness training for SMBs.
When not to wait for the calendar
Three triggers override the fixed interval:
- New law. A safety-code amendment, a new privacy statute, a NIS2 transposition: every material regulatory change triggers a targeted refresh within three months.
- Incident. A data breach, a workplace injury, a successful phishing click: refresh for the affected role within 30 days. Supervisors almost always ask "what did you do after the incident". A documented refresh is the answer.
- Role change. An office worker who becomes a server admin, or a CRM administrator who gets production access: new risk means a new module. Do not wait for next year.
Two worked examples
Example 1: metal fabricator with 40 employees.
Program mix:
- Safety: all production staff refresh every two years (12 modules of 15 minutes, split into blocks). The 12 office staff refresh every three years.
- GDPR: all 40 employees each January. A 20-minute module with 10 scenario questions. Target pass rate ≥80 %.
- NIS2: the company falls in scope as an "important entity" via the automotive supply chain. Management (5 people) do a 45-minute annual module. Anyone with ERP access runs a quarterly phishing simulation.
Result: 3 refresh cycles a year, roughly 1.5 hours per employee. Internal hours go into the Risk Assessment, not into building slides.
Example 2: SaaS company with 120 employees.
Program mix:
- Safety: all staff every three years (screen work, ergonomics). Short 10-minute refresh.
- GDPR: all in January, plus a September repeat for support (highest exposure to personal data). Two separate modules — 15 min general, additional 15 min for support.
- NIS2: in scope as an "important entity" as a digital service provider. Management (7 people) do an annual 60-minute module on Article 20 duties. All staff take an annual 30-minute cyber module. Engineering and on-call run quarterly phishing campaigns and one tabletop exercise a year.
Total: 4 refresh cycles, spread across the year. New hires automatically receive the same modules in their first 30 days, so no one falls through the cycle.
What HR documents
An audit under any of the three regimes checks three things:
- Who completed which module and when. Not "January campaign delivered" — a per-employee completion log. This is the legal evidence, not HR aesthetics.
- Quiz pass rate. If the average is below 70 %, the module needs a fix — not just a repeat.
- Trigger-driven refreshers. Every incident-driven refresh needs a date, the affected roles, and a short note on what changed in the module.
For safety, keep medical fitness records and periodic-examination dates in the same flow. When they sit in one system, an inspector gets the answer in a single PDF instead of three folders.
Compliance is not one obligation but three running in parallel — every two years for safety, annually for privacy, annually plus simulations for cybersecurity. HR that handles them under one calendar saves manual hours and stands up under audit without scanning folders. An LMS like Mentor keeps that calendar alive — interval per role, triggers, and completion log in one report, ready for the next inspector visit.