You need a legal basis for the processing of personal data. In the context of training programmes, this is usually the contract that you as a training provider conclude with your participants or your General Terms and Conditions, which your participants accept when booking a training course. 

You are therefore authorised to process participants' data for the duration of the training course. 

However, the principle of data minimisation also applies here: you may only collect and process the data of the participants that is necessary for the implementation of the training.

What are these specifically? 

• Contact details: You can argue that you need the participants' contact details in order to contact them about any changes to the training programme or to provide them with other important information about the training. 
• Personal data: To fulfil the contract, you will of course need certain personal data. Name and address for invoicing purposes, possibly further data for billing purposes or for issuing the training certificate. 

Irrespective of this, data may be automatically collected through participation in the training. During an online webinar, technical usage data and possibly communication data are collected. This may be information that you do not need or analyse yourself, but which is generated solely through the use of the respective technical platforms. You must also inform your participants about this data processing.

Source: Maicon Fonseca Zanco on Pixabay