AegisAI Perspectives · 047
Get written approval, test a lawful basis, tell staff, consult any works council and ban harmful lures before the first simulated phishing email goes out.
To run a phishing simulation legally, get written approval, document a lawful basis for click data, tell staff it exists and never punish a click. California's standard for state entities keeps a 72 hour advance notice to Cal-CSIC14. The NCSC says simulations can create legal risk1. AegisAI turns phishing that reached your people into the test, keeping the same lure and people with a safe payload21.
This is not legal advice. The rules differ by country and sector, so check your plan with counsel before the first send.
Finish the approvals and records in steps 1 to 7 before anyone builds a lure in step 8.
Write the purpose and get written approval. California's standard requires written approval from the Information Security Officer or Chief Information Officer and sets protocols for coordinating the plan with Human Resources and Legal13. The NCSC says to always check with HR before any simulation3.
Pick the lawful basis and test it before processing. The EDPB says legitimate interest needs three cumulative conditions to hold10. The interest must be legitimate and the processing necessary, and data subject rights must not override it. The ICO says to assess each test before processing and document the outcome8.
Run a data protection impact assessment. The ICO calls the DPIA an important accountability tool for monitoring workers. Name the purpose and choose the least intrusive means to reach it.
Collect only the click data you need. The ICO's data minimisation principle means collecting no more information than the purpose needs. Report department totals by default, keep names only for follow up training, and set a deletion date.
Tell staff the program exists. The ICO says workers must know how and what personal information is collected, and be told when that changes. In a 793 person experiment, prior consent made a campaign more acceptable (b = 0.90)16. Announce the program and the data kept; keep the send dates private.
Consult the works council or union where one exists. In Germany, Section 87(1) item 6 of the Works Constitution Act gives the works council co-determination over technical devices designed to monitor employee behaviour or performance11.
Ban harmful lures and punishment in writing. A test at Tribune Publishing promised bonuses of $5,000 to $10,000 after layoffs and wage cuts, and sparked public outrage. List pay, bonuses, health and layoffs as banned pretexts. The NCSC says punishing clicks starts to resemble entrapment2.
Rate and test every lure before launch. The NIST Phish Scale, Technical Note 2276, rates how hard an email is for people to detect15. In Microsoft 365, Send a test mails the payload to the signed in admin first20.
AegisAI sanitizes caught phishing and sends it back to the people it was aimed at, with a safe training page as the payload22. Recipients are targeted from your identity provider, such as Entra ID, over the connection detection already uses. Link scanner clicks are separated from human clicks before scoring. Whoever clicks learns it was a simulation and gets a short video and a quiz, and whether that training is required is set per campaign.
Find the country where your staff work and keep the record that row names.
| Where | Source | What it asks | Record to keep |
|---|---|---|---|
| United Kingdom | NCSC phishing guidance | Check with HR first; do not punish clicks | HR sign off, dated |
| United Kingdom | ICO, monitoring workers | Lawful basis, least intrusive means, notice to workers | Legitimate interests assessment, staff notice |
| European Union | EDPB Guidelines 1/2024 | Three cumulative conditions for legitimate interest | The three tests, dated |
| Germany | BetrVG Section 87(1) item 6 | Works council co-determination on monitoring devices | Works agreement or council decision |
| California state entities | Technology Letter 25-03, SIMM 5320-A12 | HR and Legal coordination, ISO or CIO approval, 72 hour notice | Approval and the Cal-CSIC notice email |
| Any country | NIST Phish Scale, TN 2276 | Rates how hard a lure is to detect | Rating per lure |
Every field below belongs in the record before the first send. Copy the fields and replace the values.
Illustrative example, figures are fictional. Halden Freight has 1,400 staff in the United Kingdom and Germany. Purpose: measure how many staff report credential phishing, and train those who click. Approved on 24 February by the CISO with the HR director and Legal; the works council signed a works agreement on 3 March. Lawful basis: legitimate interests, with the three tests dated 20 February and a DPIA dated 21 February. Notice: an all staff email in January announced the program and the data kept, with no send dates. Recipients: 1,400 staff from the HR system, minus 38 on leave. Allowed lures: parcel notice, shared document, password expiry. Banned lures: pay, bonuses, health, layoffs, restructuring. Data kept: clicked, reported, training completed; names seen by two security analysts; managers see department totals; raw data deleted after 90 days. Consequence of a click: a training page and nothing else. Stop: the CISO or HR director can end the campaign at any hour. Result: 112 of 1,362 recipients clicked (8.2%) and 290 reported the email.
The GDPR sources here ask for a lawful basis tested before processing, and legitimate interest is one they describe. Neither page says consent is required for a phishing test, and neither says it is not. Consent still helps acceptance: prior consent raised acceptability in the USEC 2025 experiment. Tell staff the program exists in every case, because the ICO requires workers to know what is collected.
Keep repeat clicks inside training. The NCSC says punishing clicks starts to resemble entrapment and advises against reprimanding users who struggle to spot phishing4. In the USEC 2025 study, an interview after a click lowered acceptance, and termination lowered it most17. Give repeat clickers practice on lures rated with the NIST Phish Scale.
The Tribune Publishing bonus email came after layoffs and wage cuts, and the paper says it eroded trust18. The NCSC lists legal risk among the problems with simulations. Tool choice is a separate question, covered in how to choose phishing simulation and awareness tools.
Written approval is what the sources ask for; none of them defines unauthorised access. Microsoft describes its simulations as benign cyberattacks that you run in your own organization19. California's standard asks for written approval from the ISO or CIO. Keep the approver's name with the scope and dates of the test. Send only inside your own tenant.
Track three numbers from the first campaign, each from a system you already run.
Get written approval from security with HR and Legal, then document a lawful basis and a DPIA. Tell staff the program exists and bring in any works council. Ban pay and layoff lures, and keep clicks out of discipline. The NCSC says to check with HR before any simulation.
Sending first and asking HR afterwards. The NCSC says to always check with HR before any simulation. Under the GDPR, the ICO says the lawful basis tests are assessed before processing starts.
Show the dated approval with the lawful basis assessment and the DPIA. Add the staff notice and the rules of engagement. California state entities also keep the 72-hour Cal-CSIC notice. For US financial firms, the record test is in FTC Safeguards Rule awareness training.
Pay, bonuses, health and layoffs. The Tribune Publishing lure offered bonuses after layoffs and wage cuts and sparked public outrage. Write the banned list into the rules of engagement and have HR approve it.
Section 87(1) item 6 of the Works Constitution Act gives the works council co-determination over technical devices designed to monitor employee behaviour or performance. Bring the council in before the first send and record its decision.
Tell them the program exists and what data it keeps, without the send dates. The ICO says workers must know how and what personal information is collected.
