Cyber Security & Data Protection Courses

Cyber security and data protection courses for every level, all studied online. Train your whole workforce to spot phishing and handle personal data under UK GDPR, or build specialist skills with certification courses such as CompTIA Security+, CySA+, PenTest+, ISACA CISM and CISA, ISC2 CCSP and Microsoft Azure AZ-500.

See all cyber security courses ↓Not sure which you need? Open the guide below.

Most common attackPhishingHit 38% of UK businesses in the past year (Cyber Security Breaches Survey 2025/26)

For every employeeAwareness and UK GDPRShort e-learning on cyber threats, data protection and insider threats

For security rolesCompTIA, ISACA, ISC2, MicrosoftCourse preparation for the industry certifications employers ask for

Ways to learnE-learning and live onlineSelf-paced, so staff can fit it around work

Read the guide: choosing a cyber security or data protection course

Which cyber security or data protection course do you need?

Start with what the person needs to do. Most staff need awareness and data protection basics. Only the people who will run, test or manage your security need a professional certification.

You are training your whole workforce

Cyber security awareness – phishing, passwords, safe browsing and reporting incidents, for every employee
UK GDPR and data protection – lawful handling of personal data, the Data Protection Act 2018 and data subject rights; see all GDPR courses
Insider threat – awareness for staff, plus a course on building a detection programme for managers
PCI DSS – for teams who take or handle card payments
Sector courses – handling information in health and social care, information governance, Freedom of Information and sharing information with the police

You are building a security career or team

First certificate – CompTIA Security+, the entry-level security certification employers most often ask for
Defence and testing – CompTIA CySA+ for security analysts and PenTest+ for penetration testers
Cloud and AI – Microsoft Azure Security Engineer (AZ-500), ISC2 CCSP and CompTIA SecAI+
Senior, management and audit – CompTIA SecurityX, ISACA CISM and ISACA CISA preparation
Starting from scratch – beginner pathways, bootcamps and multi-course bundles; build the IT foundations with CompTIA courses and networking courses

Professional cyber security certifications compared

These courses prepare you for the certification exam. The exam itself is usually booked and paid for separately, so check each course page.

Entry level

CompTIA Security+

The usual first security certificate. Threats and attacks, secure design, security operations, governance and risk. Pass mark 750 out of 900.

Analyst

CompTIA CySA+

Cybersecurity Analyst. Reading security data, managing vulnerabilities and running an incident from first alert to report. Best after Security+.

Offensive

CompTIA PenTest+

Planning, running and reporting on authorised penetration tests. For security staff moving into ethical hacking and red-team work.

Cloud

Azure AZ-500 and ISC2 CCSP

AZ-500 secures identities, networks and data in Microsoft Azure. CCSP is the vendor-neutral cloud security certification for experienced professionals.

Emerging

CompTIA SecAI+

How attackers target AI systems, how AI can strengthen defence, and how to govern AI use safely. A new CompTIA certification.

Senior

CompTIA SecurityX

Formerly CASP+. Enterprise security architecture, engineering and operations for security architects and technical leads.

Management

ISACA CISM

For security managers who set strategy: governance, risk, running a security programme and incident management.

Audit

ISACA CISA

The standard credential for information systems auditors: audit process, IT governance, operations and protecting information assets.

Where to start if you are new to cyber security

Learn the basics. A cyber security awareness or introductory course shows you how attacks happen and how people stop them.
Build IT foundations. Security makes more sense once you understand computers and networks, so CompTIA A+ and Network+ come first for many people.
Get Security+. It is the entry-level security certificate employers most often look for.
Specialise. Choose a direction: analysis (CySA+), testing (PenTest+), cloud (AZ-500 or CCSP) or AI security (SecAI+).
Step up. With several years' experience, move to SecurityX, CISM or CISA. ISACA and ISC2 require relevant work experience before they award their certifications.

What cyber security and data protection courses cover

Depth depends on the course, from a short awareness module to many weeks of certification study, but the core topics are consistent.

Phishing, social engineering and malware
Passwords, multi-factor authentication and access control
Recognising and reporting a security incident
UK GDPR principles and the Data Protection Act 2018
Personal data, special category data and data subject rights
Protecting confidential information and sharing it safely
Insider threats and how to detect them
Card payment security under PCI DSS
Network, cloud and application security
Vulnerability management, penetration testing and incident response
Security governance, risk management and audit
Securing and governing the use of AI

Is cyber security and data protection training a legal requirement?

No single law names a course every employee must take, but training is how most organisations meet the duties they do have. UK GDPR requires organisations to protect personal data with appropriate technical and organisational measures, and the Information Commissioner's Office (ICO) lists staff training and awareness among the measures it expects to see in its accountability framework. If you take card payments, the PCI DSS standard requires a security awareness programme for staff. With 43% of UK businesses reporting a breach or attack in the past 12 months, according to the government's Cyber Security Breaches Survey 2025/26, trained staff are one of the cheapest defences you have. The free training matrix helps you map which roles need which courses.

Keeping training and certifications current

Threats change quickly, so awareness and data protection training should be refreshed at regular intervals rather than done once. Professional certifications have their own renewal rules: CompTIA certifications such as Security+ are valid for three years and are renewed through continuing education, and ISACA and ISC2 require ongoing professional education. Record every course on the free training dashboard and use the certificate expiry checker so nothing lapses.

How you can take it

Self-paced e-learning

Most courses here are online and self-paced. Awareness courses can be finished in a sitting, which makes them easy to roll out to a whole workforce. Certification courses come with longer access so you can study around work.

Live online

Instructor-led programmes taught by video with a trainer and group, for learners who want a fixed timetable and someone to ask.

Bundles and pathways

Multi-course bundles and beginner pathways put several certifications in the right order, which suits career changers and employers developing junior staff.

Common questions

Which cyber security course is best for beginners?

If you have no IT background, start with a cyber security awareness or introductory course, then build IT foundations with CompTIA A+ and Network+ before moving on to CompTIA Security+. If you already work in IT, you can usually go straight to Security+. Beginner pathways that bundle these courses in order are also listed here.

Do the certification courses include the exam?

Usually not. Most professional certification courses prepare you for the exam, which you then book and pay for separately with the awarding body or its test provider, such as CompTIA, ISACA, ISC2 or Microsoft. Each course page says whether an exam is included.

Is GDPR training mandatory for employees?

UK GDPR does not name a specific course, but it requires organisations to keep personal data secure with appropriate organisational measures, and the ICO expects staff training as part of that. In practice, anyone who handles personal data should have data protection training and regular refreshers.

What is the difference between CISM and CISA?

Both are ISACA certifications. CISM is for people who manage information security: strategy, governance, risk and incident management. CISA is for people who audit information systems and controls. Choose CISM if you lead security, and CISA if you work in audit, assurance or compliance.

How long does it take to get CompTIA Security+?

It depends on your background and study time. Security+ courses typically involve around 30 hours of study, and many learners take four to eight weeks alongside work, longer if they are new to networking.

Can I train a whole team at once?

Yes. Awareness and data protection e-learning is well suited to rolling out across a whole workforce, and you can book several places together. Add the courses to your free training dashboard to track who has completed them, and see the full IT & Analytics range for related training.