<\/p>\n\n\n\n
Employers should ensure that their employees are well versed in security awareness and that the proper training is provided to them to protect the privacy and security of the company\u2019s sensitive data. Not only is this a best practice for employers and their employees, but it can also ensure compliance with the numerous data privacy and cybersecurity laws that mandate employee data protection training.<\/p>\n\n\n\n
One such mandate is under HIPAA whereby covered entities or business associates are required to provide HIPAA privacy training as well as security awareness training to all workforce members. Note that this training requirement may apply to employers in their role as a plan sponsor of a self-insured health plan.<\/p>\n\n\n\n
Another mandate falls under the New York Department of Financial Services\u2019 cybersecurity requirement for financial services companies whereby covered entities are required to provide cybersecurity personnel with cybersecurity updates and sufficient training to address relevant cybersecurity risks. Similarly, the Gramm-Leach-Bliley Act and the Standards for Safeguarding Customer Information Rule requires covered financial institutions to implement a written information security program to safeguard non-public information, and the program must include employee security awareness training. The Federal Trade Commission (FTC) expanded the definition of financial institutions in 2023 to include additional industries such as automotive dealerships and retailers that process financial transactions.<\/p>\n\n\n\n
Most recently, effective February 2, 2025, the EU AI Act requires all providers and deployers of AI models or systems to ensure their workforce is \u201cAI literate\u201d. This means training the employer\u2019s workforce to achieve a sufficient level of AI literacy, taking into consideration various factors such as the intended use of the AI system. The training should incorporate privacy and security awareness given the potential risks. Note that the Act applies broadly and has extraterritorial reach and therefore this training obligation may apply to organizations including but not limited to: (a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country (e.g., U.S.); (b) deployers of AI systems that have their place of establishment or are located within the Union; and (c) providers and deployers of AI systems that have their place of establishment or are located in a third country (e.g., U.S.), where the output produced by the AI system is used in the Union. Additionally, under the EU General Data Protection Regulation, a Data Protection Officer is tasked with, among other things, training staff involved in the organization\u2019s data processing activities.<\/p>\n\n\n\n
Employers should also be aware of other security awareness training obligations in numerous other laws and regulations, whether express or implied. This includes certain Department of Homeland Security contractors, licensees under state insurance laws modelled on the NAIC Insurance Data Security Model Law, and organizations that process payments via credit cards in accordance with PCI DSS.<\/p>\n\n\n\n
Providing training on employee privacy and security is imperative to safeguard an organization\u2019s sensitive data. All workforce members that have access to the organization\u2019s sensitive data and information systems\u2014not just the IT professionals\u2014are responsible for protecting data. Employers should ensure that they, along with their stakeholders and HR professionals, are aware of and are providing support for such training to its workforce. If you have any questions about the subject of this article and its implications for your business, please contact your Forework HR representative.<\/p>\n","protected":false},"excerpt":{"rendered":"
Employers should ensure that their employees are well versed in security awareness and that the proper training is provided to them to protect the privacy and security of the company\u2019s sensitive data. Not only is this a best practice for employers and their employees, but it can also ensure compliance with the numerous data privacy …<\/p>\n","protected":false},"author":1,"featured_media":2345,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","content-type":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-2344","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-employment-articles"],"yoast_head":"\n