The difference between security awareness and privacy awareness

In training programmes, security awareness and privacy awareness are often mentioned in the same breath. Organisations buy them together, schedule them in the same annual round and cast them in the same format, usually an e-learning module with a test. Yet the two subjects ask something fundamentally different of an employee. The hypothesis of this study is that privacy is mainly about applying knowledge of rules and procedures at the right moment, while security is mainly about changing one's own behaviour, right down to the reflexes.

This report tests that hypothesis against the scientific research. It follows on from two earlier reports in this series: The attention problem, on what phishing simulations do and do not achieve, and The vulnerable first months, on the timing of initial training. Those reports were about security; this one places security and privacy side by side.

01 · FRAMEWORKTwo concepts from different traditions

Anyone who lays the scientific literature on the two forms of awareness side by side immediately notices a difference in origin. Research into security awareness is rooted in the question of how an organisation gets employees to comply with security policy. The most widely used foundation for this is the KAB model, which treats awareness as a triad of knowledge (what you know), attitude (what you think) and behaviour (what you do) (Kruger and Kearney, 2006). The most thoroughly validated measurement instrument, the Human Aspects of Information Security Questionnaire (HAIS-Q), is built explicitly on that model and measures the three layers across seven focus areas, from passwords to incident reporting (Parsons et al., 2014). In this tradition, behaviour is therefore not a by-product of awareness but a fixed part of the definition. The influential compliance study by Bulgurcu, Cavusoglu and Benbasat (2010) likewise views awareness through the question of whether employees ultimately behave in line with policy.

Research into privacy awareness is younger and different in nature. The broad review by Smith, Dinev and Xu (2011) shows that privacy research has traditionally focused on concerns, attitudes and the trade-offs around sharing data, and far less on behaviour in a working environment. Where the concept is elaborated, this strikingly often takes the form of knowledge. The Online Privacy Literacy Scale (OPLIS) explicitly treats privacy literacy as knowledge, both factual knowledge of rules and practices and knowledge of strategies for protecting data (Trepte et al., 2015). Correia and Compeau (2017) go a step further and describe privacy awareness as a form of situational awareness, following Endsley's model: perceiving a situation, understanding what it means and projecting what may happen. On that reading, privacy awareness is the ability to see that personal data is involved and to understand which standard applies, after which the knowledge can be applied.

02 · FINDINGFor security, the bottleneck is not knowledge

That knowledge and behaviour do not coincide for security was already apparent in the very first application of the KAB model. In Kruger and Kearney's (2006) case study at an international mining company, employees scored 77 per cent on knowledge and 76 per cent on attitude, but only 54 per cent on behaviour. What employees knew and thought was more than adequate, but what they did in practice lagged far behind. Later validation studies confirm that picture. Among five hundred Australian employees, knowledge of policy and procedures was more strongly associated with attitude than with their own security behaviour, leading the researchers to conclude that training should explain not only what is expected but also why it matters (Parsons et al., 2014).

The review research points in the same direction. A systematic review of 142 studies on security training finds that most studies measure their effect in terms of knowledge or intentions rather than actual behaviour, that effects are usually measured after a single training session without a follow-up measurement, and that lasting behaviour change therefore cannot be established with certainty, even though such change requires repetition, since habits only form through repetition (Prümmer, van Steen and van den Berg, 2024). The accompanying meta-analysis shows that training clearly improves end-users' knowledge and awareness, but that the effect on behaviour in the longer term is more modest (Prümmer, van Steen and van den Berg, 2024). As early as 2015, Bada, Sasse and Nurse concluded that information on its own does not change behaviour: people must also be able to apply the advice and be motivated to do so. ENISA draws the same lesson and argues for a shift from information provision to behaviour change and culture (ENISA, 2019).

For the part of the hypothesis that concerns security, the evidence is therefore solid: the bottleneck lies not in what employees know but in what they do under the pressure of the moment. In The attention problem we already described that phishing is an attention problem rather than a knowledge problem, and that a falling click rate says little about what employees have actually learned.

03 · FINDINGWith privacy too, knowing and doing diverge

Anyone taking the hypothesis literally would expect knowing and doing to coincide neatly for privacy. The research shows something else, and the phenomenon even has its own name: the privacy paradox. In the experiment that gave it its name, participants disclosed considerably more personal information than they had said beforehand they would (Norberg, Horne and Horne, 2007). Pötzsch (2009) describes the same gap: even those who are privacy-aware often do not act accordingly. Review studies confirm that attitudes and concerns about privacy only weakly predict what people actually do when sharing data, and explain this partly through trade-offs of convenience and benefit, through uncertainty, and through the strong influence of context on privacy preferences (Kokolakis, 2017; Gerber, Gerber and Volkamer, 2018; Acquisti, Brandimarte and Loewenstein, 2015).

Yet the working environment differs in an important respect. Almost all of this research concerns people deciding about their own data, as consumers who share something in exchange for convenience, a discount or contact. Solove (2021) further points out that little can be inferred about attitudes from such behaviour, because people weigh up something different in a concrete situation than in a general question. An employee who processes the personal data of customers, patients or colleagues plays a fundamentally different role: it is not their own data, the personal trade-off largely disappears, and the question is not how much they want to share but whether the processing fits within the rules of the organisation and the law. That role calls above all for recognising and applying: seeing that something is personal data, knowing whether there is a legal basis, recognising a request from a data subject, and reporting a breach in good time. Strikingly little research has been done into this employee role, and the way privacy awareness is defined varies from study to study (Smith, Dinev and Xu, 2011; Correia and Compeau, 2017).

One nuance deserves emphasis here. The figures from practice show that privacy incidents are by no means always knowledge failures. Across Europe, supervisory authorities now receive an average of 443 reported data breaches per day, a 22 per cent rise in a single year (DLA Piper, 2026). A substantial share of these are not sophisticated cyberattacks but routine human errors: a letter or email sent to the wrong recipient is consistently among the most commonly reported breach types, and human error is one of the leading causes of breaches across Europe (ENISA, 2019). A letter in the wrong envelope is not a gap in knowledge of the GDPR but a routine slip, and therefore a behavioural problem par excellence. In privacy practice, applying knowledge and embedding careful routines thus occur side by side.

04 · EXPLANATIONThe adversary and the decisive moment differ

The pattern from the previous two chapters is well explained by the kind of situation in which each form of awareness has to prove itself. Security is about protecting information and systems against deliberate compromise (von Solms and van Niekerk, 2013). There is therefore a thinking adversary facing the employee, and that adversary determines the moment, the form and the pressure. Research into phishing shows that most phishing messages are processed via the fast, superficial route: people decide on the basis of simple cues in the message, without thorough consideration, especially when the sender plays on urgency and authority (Vishwanath et al., 2011). At such a moment there is no opportunity to apply knowledge calmly. What counts then is the behaviour a person has made their own: pausing for a moment, checking the request through another channel, and reporting anything out of the ordinary. That is why security awareness is at its core a behavioural matter, and why training that is short, repeated and lets employees practise in the context of their work works better than one-off knowledge transfer (Prümmer, van Steen and van den Berg, 2024).

For privacy, the decisive moment is different. The standard comes not from an attacker but from the law and the organisation's policy, and the questions usually arise in ordinary work: may I share this file with this colleague, how long do we keep this data, is this request a subject access request, and is this incident a breach that has to be reported? With such questions there is almost always an opportunity to think, to look something up or to consult the data protection officer. The bottleneck here is not the time pressure of an adversary but recognising the situation: anyone who does not see that something is personal data or a breach never gets as far as applying knowledge. That fits precisely with the description of privacy awareness as situational awareness (Correia and Compeau, 2017).

The two domains do overlap. Phishing frequently targets personal data in particular, so that a successful attack is at once a breach, and the misdirected letters and emails in the supervisory authorities' figures are routine behaviour that calls for the same behaviour-focused approach as security habits. Conversely, knowledge does matter for security: those who score higher on the HAIS-Q, including the knowledge component, demonstrably perform better in an experimental phishing test (Parsons et al., 2017). The difference between the two domains is therefore not a sharp dividing line between knowledge and behaviour; the difference lies in which of the two is decisive in the critical situation.

05 · CONCLUSIONA difference in emphasis

The answer to the main question is this: the hypothesis is largely supported, provided it is understood as a difference in emphasis. Security awareness is at its core a behavioural matter: knowledge is necessary, but the research shows time and again that knowledge and attitude run well ahead of behaviour, and that the decisive moments are so short and so deliberately exploited by the attacker that only ingrained habits offer a foothold. Privacy awareness in the working environment, by contrast, is mainly a matter of recognising and applying: seeing that a situation falls under the rules, knowing which standard applies and acting accordingly, with the time and the resources that are usually available in those situations.

For the design of a training programme, this means that a single format falls short for both subjects. Security training calls for short, repeated, behaviour-focused practice in the context of the work, so that habits can form. Privacy training calls for recognisable case studies, clear decision rules and easily findable reference material and reporting routes, so that the knowledge is available at the moment the situation arises. For both, what the research has long said holds true: merely distributing information changes little, because employees must also be able and willing to apply the advice (Bada, Sasse and Nurse, 2015; ENISA, 2019).

At the same time, modesty is in order. The privacy paradox shows that, for privacy too, knowing and doing do not go together automatically, and the breach figures show that a large share of privacy incidents consists of routine errors that themselves call for behaviour change. Anyone using the distinction in this report would therefore do well to treat it as a difference in emphasis and not as a strict division: a mature programme trains mainly behaviour for security while maintaining the knowledge, and trains mainly recognising and applying the rules for privacy, without losing sight of careful routines.