↓Skip to main content

Data Protection Day 2027: two formats worth considering

·4 mins
Data Protection Day Behaviour Change Training Design Employee Engagement Awareness Campaigns

Data Protection Day 2027 is now just three months away.

Your employees deserve better

I wrote in September about why stories make Data Protection Day stick. This post is a follow-up and is more specific, more practical, and aimed at data protection leaders who should now be planning what that day, or week, will actually look like in their company.

There are basically two main audiences in most companies who need something from Data Protection Day, and they need different things.

For your data protection team #

If you have a data protection team the most useful thing you can do on Data Protection Day is not deliver another briefing. It is give your team members structured time to look honestly at where the programme stands and where it should go.

I offer two formats for this, depending on what the team needs most.

The Honest Room is a session for the things your team has quietly decided not to say out loud. Which parts of the programme do you have low confidence in? What risk have you absorbed because raising it felt futile? Where is the gap between what leadership believes is in place and what you know to be true? The session is facilitated and structured. It is not a venting session, but a deliberate process for uncovering the things that usually only get said in corridors, or around the coffee machine.

The Inversion Session takes one compliance practice the team currently runs and asks a single question: what would the complete opposite of this look like? Not as a thought experiment, but as a serious challenge to whether the current approach is actually the right one. Teams consistently find that describing the opposite reveals improvements they would never have reached by refining what they already do. It runs at two hours or can expand to a half day if the team wants to work through more than one practice.

Run together, The Honest Room and The Inversion Session make a natural half day, or for large teams, a full day. Both can be run in-person or remotely on a digital canvas for distributed and international teams.

For companies with larger ambitions, the next step is turning what the session uncovers into a concrete, actionable plan. I run a From Issues to Action workshop which is a structured half day or longer session, that takes the issues your team has identified, works through their impact across processes, technology, information assets and people/organisation, and produces a prioritised action plan with owners and timelines. It is the difference between a good conversation and a good conversation that changes something.

For everyone else #

I am often asked to run all-employee sessions for Data Protection Day, and I am happy to deliver them. A well-designed presentation, delivered live or as a webinar, can reach the whole company at once and give people a sound reason to care rather than a compliance reminder they easily forget.

But I always make the same case to the data protection leaders who request them - go further and make your message unmissable.

You know full well that marketing and finance process personal data differently, think about risk differently, and need different examples to recognise themselves in the message. In some companies, an awareness webinar that the whole workforce attends on the same day is designed to produce a record of attendance. It is rarely designed to change anything the following morning.

An alternative I often propose are shorter, role-specific sessions for specific teams built around a real enforcement case from your sector, with enough detail to feel uncomfortably close to home. One session with the right framing for the right audience tends to do more than a company-wide event that nobody quite believes is meant for them.

For companies that need broader reach, I design interactive materials that can be embedded in their corporate LMS or intranet, such as scenario-based exercises, role-specific explainers, short interactive formats. See how I approach this.

The timing #

Data Protection Day 2027 falls on a Thursday. That is three months away. November and December will fill up quickly, and the company that gets something worthwhile out of 28 January are usually the ones that make the decision in October.

If you want to talk through what would work for your organisation, get in touch.

If you found this useful, the Purpose and Means newsletter covers data protection, GRC, and AI governance — fortnightly, in plain language.

Purpose and Means works with companies on data protection strategy, governance, and compliance - going beyond the legal text to focus on how things actually get done. If you would like to discuss what this means for your organisation, book a call or explore our services.

Author
Tim Clements
Tim Clements is Business Owner of Purpose and Means, a data protection and GRC consultancy based in Copenhagen, operating globally. He helps data protection and GRC leaders simplify complexity into actionable strategies, providing tools, training, and support to engage and influence across the organisation. Tim is a Chartered Fellow of the BCS (British Computer Society).

Browse by Topic

access controls accountability accountability frameworks ai act ai ethics ai governance ai infrastructure sovereignty ai literacy ai regulation article 12 article 13 article 22 article 25 article 28 article 30 article 32 article 35 article 46 article 5 article 6 article 7 audit and assessment automated decision-making awareness awareness campaigns behaviour change beyond legal board level board reporting case law change management chief people officer cloud infrastructure compliance monitoring consent cookie compliance cross-border transfers customer success dark patterns data accuracy data breach data breach notification data flows data mapping data minimisation data processing agreements data protection data protection by design data protection culture data protection day data protection hero data protection leader data quality data residency data retention data science data sovereignty data subject rights datatilsynet deceptive design design thinking direct marketing dora dpia education employee data employee engagement enterprise architecture eprivacy esg executive communication external legal counsel field talk finance and banking gdpr gdpr at 10 generative ai governance grc healthcare history horizon scanning hr and data protection hr and employment incident response information security intellectual property internal communications international transfers lawful basis leadership legalese lego serious play machine learning marketing newsletter nis2 passwords plain language planning policy bonfire privacy by design privacy culture privacy notice privacy policy product management profiling public sector purpose limitation quantum computing records-of-processing regulatory guidance risk management risk reduction ropa sales security software development special category data standard contractual clauses strategic planning sub-processors supply chain sustainability system design third-party risk training training design transparency trend radar ux design vendor management visual communication weak signals workshop facilitation

Related Posts