Training records that stay inside the organization.
Which training an employee completed, and what they scored, is personal data. Saga delivers data protection awareness training alongside every other mandatory program, and keeps the records on the organization's own server. The tools that KVKK and GDPR compliance call for are part of the application.
A training record is personnel data.
A completion record identifies a named employee, states what that employee was required to know, and records whether they demonstrated it. In most organizations it falls under the same handling rules as any other employee record.
A training service hosted abroad raises the question of transferring that data as well. Saga runs on the organization's own server. Records, results, and certificates are held on infrastructure the organization controls and are not sent to any outside service, and notification mail leaves through the organization's own mail server.
The tools a data controller needs, inside the application.
None of these needs separate software, a script, or direct access to the database. Each one is carried out from the compliance section of the application.
Consent. An employee's consent is collected the first time they use the application, and it is recorded. A user who has not consented does not reach the training content.
Data export. The personal data held about an employee is exported in response to a data subject request, without anyone compiling records by hand.
Anonymization and retention. Records past their retention period are removed by the application's own purge. Where an employee's data has to be de-identified and kept, it is anonymized from the administration screens, with no database administrator involved.
Request channel. Employees submit data subject requests inside the application, and those requests are resolved there.
Data protection training comes with its own evidence.
Training the employees who handle personal data is one of the administrative measures a data controller takes to secure it. Saga runs that program like any other mandatory training: it is assigned to the relevant groups with a deadline, video and written material are completed in sequence, and the assessment is graded on submission.
Every completed program issues a numbered certificate, and the issue is written to the audit log against the employee's name. A line manager sees the completion rates, exam results, and deadlines of their own group and of no other.
Evaluate Saga against your own compliance obligations.
Tell us the obligations you carry as a data controller and how your workforce is grouped. We will structure the demonstration around them.
Request a demo