Your team knows the policies exist — but standard meetings don’t surface the real gaps between documentation and daily practice. LEGO® Serious Play® makes the invisible visible.

The problem with standard workshops #

Most data protection workshops follow the same pattern: slides, discussion, action items that never get actioned. The people who talk the most dominate. The people closest to the real problems stay quiet. And the gap between what your policies say and what actually happens on the ground remains invisible.

LEGO® Serious Play® (LSP) changes this fundamentally. It’s a facilitated, neuroscience-based methodology where every participant builds 3D models of their real working environment — not the version that exists in policy documents, but the version they experience every day. Abstract compliance issues become tangible objects that can be discussed, connected, and understood.

This is not an icebreaker. It is a structured process for navigating complexity and aligning teams.

Why it works for data protection and GRC #

Data protection, AI governance, and digital regulation involve invisible risks, abstract concepts, and complex stakeholder relationships. Standard meetings can’t capture these dependencies. LSP makes them concrete and manageable by:

• Levelling the playing field. 100% participation — not just the loudest voices. Team members share perspectives they wouldn’t voice in standard meetings.
• Exposing hidden gaps. By visually mapping the landscape of pressures on their work, hidden risks and resource gaps become apparent.
• Focusing on reality, not aspiration. We focus entirely on the right now — the messy reality of daily work, the strengths, the bottlenecks, the workarounds. Only by visualising the actual gap between policy and practice can we bridge it.
• Moving from insight to action. Sessions conclude with agreed, concrete priorities for the coming period.

Two workshop formats #

The compact approach (half day, 4 hours online) #

A focused strategy session designed for data protection leaders and their teams, or clusters of cross-functional data protection responsibles. Ideal when you need to reset, align on strategy, or prioritise for the coming period.

How it works:

1. Foundation and warm-up. Quick exercises to establish the hand-mind connection and rules of engagement.
2. Your data protection reality. In breakout groups, participants build models representing specific topics from two perspectives: internal reality (strengths/weaknesses) and external perceptions (stakeholders/regulators).
3. Your data protection landscape. We expand the view to identify the agents — trends, regulatory pressures, technological gaps, or stakeholders — impacting the topic right now. Mapped visually to show proximity and impact.
4. Priorities and planning. Analysing the visual landscape, workgroups define key conclusions and agree on 3–5 concrete priorities for the period ahead.

The session closes with a knowledge-sharing plenary.

Participants receive a small pack of LEGO® bricks in the post prior to the workshop. We use MS Teams for dialogue and Miro as our digital canvas to capture results.

The extended approach (two half days, or one full day) #

The longer format allows deeper mapping of your data protection landscape. We recommend splitting across two half-days — giving participants time to reflect and recharge between sessions.

Day 1: Mapping the reality (The “What”). Building the foundation, defining the current identity of selected data protection topics, and mapping the surrounding landscape of pressures. The day ends with a completed visual map of the LEGO® models on Miro.

Day 2: Analysing and planning (The “So What & Now What”). Returning to the maps to define connections, analyse implications, and develop concrete strategic actions.

How it’s delivered #

Workshops can be in-person, online, or hybrid. For online delivery, small LEGO® kits are posted to participants in advance. We use MS Teams for dialogue and Miro as the digital canvas to capture results — making LSP particularly effective for dispersed teams.

LEGO® Serious Play® explainer #

The following explainer provides the gist of what the LSP approach is all about.

Let’s talk about your situation #

If standard meetings aren’t surfacing the real issues in your data protection programme — book a call to discuss how an LSP workshop could work for your team.

Frequently Asked Questions #

What is LEGO® Serious Play® and why is it used for data protection? #

LEGO® Serious Play® is a facilitated methodology where participants build 3D models to represent complex systems and challenges. It works particularly well for data protection because the discipline involves abstract concepts, invisible risks, and complex stakeholder relationships that standard meetings struggle to surface. Building makes the invisible visible.

Do participants need experience with LEGO® or facilitation methods? #

No. The warm-up phase establishes the hand-mind connection and rules of engagement. The method is designed to be accessible to everyone regardless of background. What matters is domain expertise — participants bring their knowledge of how things actually work in practice.

How does the online version work? #

Small LEGO® kits are posted to all participants before the workshop. On the day, we use MS Teams for dialogue and Miro as the shared digital canvas. Participants build at their desks, share via camera, and the facilitator captures models and conclusions on Miro in real time. This makes it effective for geographically dispersed teams.

How long does a workshop take and what are the outcomes? #

The compact format runs 4 hours online. The extended format runs across two half-days (recommended) or one full day. Both formats deliver agreed, concrete priorities for the coming period, plus a visual record of the team’s landscape and key dependencies captured in Miro.

Can this approach be applied beyond data protection? #

Yes. The same methodology works for AI governance, information security, ESG programmes, and any discipline where teams need to surface hidden dynamics, align on priorities, and move from discussion to action.