Cyber Security & Data Protection in Care

What this course covers

• Explain why care services are attractive targets and how UK GDPR and the Data Protection Act 2018 apply on an ordinary shift
• Spot phishing emails, scam texts and scam calls aimed at care staff, and verify a sender before acting
• Use passphrases, unique passwords and multi-factor authentication to keep accounts out of criminal hands
• Handle devices safely on shift — shared computers, personal phones, photos and messaging, and working in people's homes
• Recognise a personal data breach and report it immediately so your service can meet the ICO's 72-hour deadline, and describe what the DSPT expects of care providers

What's in each section

Cyber Security & Data Protection in Care runs across 17 sections, each ending in a quick knowledge check:

1. Why Attackers Target Care Data
2. The Law on a Care Shift: UK GDPR and the DPA 2018
3. The DSPT — and the Free Help Behind It
4. Phishing: Lures Written for Care
5. Check Before You Click: Verifying a Sender
6. Smishing and Scam Calls
7. Passwords and Passphrases That Hold
8. MFA: The Second Lock
9. Shared Computers and Screens on Shift
10. Personal Phones, WhatsApp and Resident Photos
11. Cyber Security in Someone's Home
12. Ransomware — and Why Backups Matter
13. What Counts as a Breach — and Spotting One Fast
14. Report Fast, Without Blame: the 72-Hour Clock
15. Lost Devices and Safe Leavers
16. Your Service's Cyber Floor: DSPT Expectations in Daily Life
17. Habits That Protect People

How much does Cyber Security & Data Protection in Care training cost?

£3.99 per person on Care2Learn, with no minimum order and no subscription. If your team needs a full training matrix rather than one course, a subscription from £1.99 per learner per month — one flat team rate, set by your team’s size — covers every course in the catalogue. See the 2026 price comparison.

Who needs it

Everyone in a care service — carers, seniors, kitchen, domestic, maintenance, admin and managers — written for people with no technical background. Care records are among the most valuable data criminals can steal, care services are small enough to look easy, and almost every successful attack starts with an ordinary person on a busy shift. The course covers phishing and scam texts written the way they actually arrive in care (fake CQC and NHSmail lures, rota and payroll bait), passphrases and multi‑factor authentication, shared computers and personal phones, photos and WhatsApp, working in people's homes, ransomware and backups, spotting and reporting a breach inside the ICO's 72‑hour window, and what the Data Security and Protection Toolkit expects of care providers in England.

What the learner receives

A certificate in their own name carrying our CPD Member badge (The CPD Certification Service), showing the completion date and the renewal date, downloadable at any time. The record belongs to the learner, not just the employer — it travels with them rather than sitting in one provider's system.

Related courses

Data protection covers the law in depth; this course covers the attacks. They pair well.

• Data Protection & GDPR — 40 min online, £3.99 per person
• Record Keeping & Care Planning — 45 min online, £3.99 per person
• Online Safety & Digital Safeguarding — 45 min online, £3.99 per person

You can also browse the full catalogue of 81 courses, or read about the Care Certificate for staff new to care.

Frequently asked questions

How long does Cyber Security & Data Protection in Care training take?

About 60 min of e‑learning, across 17 sections with 10 assessment questions. Learners can stop and resume at any point, and it works on a phone.

Is Cyber Security & Data Protection in Care CPD Aligned, and how is it assessed?

Yes — it is CPD Aligned, and the certificate carries our CPD Member badge. The assessment is multiple choice with a pass mark of 70%; attempts are recorded and learners can retake it. Renewal defaults to 12 months from the completion date — your organisation can set 24 or 36 months per course — so it reappears on your training matrix when it is due.

Our staff aren't technical — is this really for them?

It was written for exactly them. There is no jargon and no configuration: it teaches what a phishing email smells like when it is dressed up as the CQC or payroll, why three random words beat P@ssw0rd1, what an MFA code is and why you never read one out to a caller, what to do about photos and WhatsApp on shift, and the single most important habit — report fast, without blame, because the 72‑hour breach clock starts when the service becomes aware.

Does it cover the DSPT?

Yes, at the level care staff and managers need: what the Data Security and Protection Toolkit is, what the entry levels mean for a care provider in England, the free help available from Better Security Better Care, and the practical controls the toolkit expects — access removed on a leaver's last day, offline backups, MFA on email. Scotland and Wales have no DSPT duty for care services, and learners there see a notice pointing to their own national guidance; everything on UK GDPR, the ICO, phishing and passwords applies UK‑wide.

What should someone do the moment they think they've clicked a bad link?

Tell their manager straight away — the course is emphatic that the person who reports in minutes is the hero of the story, whatever they clicked. It then covers the service's side: containing the account, judging whether personal data is at risk, the ICO's 72‑hour reporting window for notifiable breaches, and telling affected people when the risk to them is high.

Does it cover working in people's own homes?

Yes — a dedicated section for domiciliary and supported‑living work: paper records in cars and kitchens, calls overheard in shared spaces, the family's Wi‑Fi, lost phones and bags, and what belongs in the handover notes rather than a text thread.