Understanding data protection practices in the health and social care sector: A survey on professionals' experiences and training needs

Abstract

The digitalisation of health and social care services has increased the need for strong data protection competence among professionals who handle personal information in their daily work. Although legislation such as the GDPR provides a clear regulatory framework, the practical implementation of data protection depends largely on employees’ knowledge, judgement, and ability to apply guidelines in real‑life situations. This thesis examines health and social care professionals' experiences, perceived competence, and training needs related to data protection, with a particular focus on the effectiveness of current security education, training and awareness (SETA) practices. The thesis explores how professionals assess their understanding of data protection requirements, how helpful they find existing training tools, and what kinds of challenges they encounter when applying data protection principles in practice. Quantitative results indicate that professionals generally feel confident in their understanding of data protection, although experience appears to strengthen this confidence. Qualitative findings reveal specific areas where competence gaps persist, including the handling of special categories of personal data and the practical challenges of ensuring confidentiality in fast‑paced or shared work environments. Participants also expressed a desire for more practical, scenario‑based training rather than solely independent reading or self‑paced online modules. The results highlight the importance of aligning organisational training practices with the realities of service user work. By incorporating professionals' perspectives, organisations can develop more effective training strategies, strengthen internal communication, and support a culture in which data protection is actively discussed and integrated into everyday practice.