Piecing together your team's work practices, brick by brick

Many data protection and GRC teams still rely on linear methods to navigate the complexities of their work and you as their leader are often none the wiser as to what is happening in the invisible architecture of their reality that a dashboard, spreadsheet or 1:1 meeting does not reveal. And there is a limit to what words can capture when the challenges are abstract. To really solve a problem you sometimes have to hold it.

There is a unique, rhythmic sound to 10 kg of Lego bricks being poured out onto a table. It’s a dry, clattering sound, but the sound of potential!

As I sat there the other day, sorting through a huge bin bag full of bricks that I had bought from a local online classifieds listing, I found myself doing something unexpected - deconstructing history.

I had bought the bag of bricks from a man whose son was now in his twenties and moved out long ago. The man's wife had recently died, and while they had held onto these bricks for sentimental reasons, the time had come to have a clear out, and move on. As I sorted the bricks and disassembled the occasional half-finished model buried in the pile, I reflected because I saw the evidence of many a family project - a wing from a spaceship here, a section of a castle wall there.

I pictured the mum and dad sitting on the floor with their son, just as my partner and I did with our own kids years ago. Used Lego bricks are not just mass-produced pieces of plastic, they were artifacts of a life shared.

Other lots of Lego I have bought on the classified ads site have been from people who mistakenly bought the kits thinking they were toys - Lego® Serious Play® kits are very specific - and also recently, over 10 boxes from a Copenhagen tech-startup that had just been acquired and most of the boxes were unopened.

Longevity of Lego
This fascination with secondhand objects isn't new for me. My house is full of various British vintage amplifiers and loudspeakers, and my album collection consists of many records bough secondhand over the past five decades.

And then there are books. About 15 years ago, when I was studying for my CGEIT and CRISC certifications, I bought quite a few textbooks online. Many of them were former library books, some from New York, some from San Francisco to name a couple of places. They still had the library stamps, the lending history, and the occasional margin note scribbled by someone who had previously borrowed the book. I couldn't help but conjure up stories of these books in my hands living their previous life.

To me, those books were knowledge carriers. In the same way, the bin bag of bricks that had clearly seen years of play are story carriers. Buying them secondhand isn’t just about sustainability and price I think it’s also about the philosophy of the work.

Complex systems
Lego® Serious Play® has become an important and fun part of my work with Data Protection, Infosec, Risk, and Legal teams. These departments often deal with the invisible. Things like hidden data flows, abstract threat landscapes, and complex legal and compliance requirements. Words alone are sometimes inadequate when you are trying to map a personal data breach response plan or explain the nuances of data protection risk,

When your colleagues sit down with handfuls of bricks you can quickly notice things change. They are not building models of Stonehenge, they are building models of their reality.

Whether it is a legal team mapping out the complexities of an emerging law or an infosec team visualising the potential attack surface of a remote workforce, Lego® Serious Play® allow them to:

• Move the problem from inside their heads onto the table where it can be seen, debated, and stress-tested.

• Rapidly represent opportunities and challenges - co-creating with their hands is far quicker than trying to write everything down

• Hierarchy disappears because the brick models are the focus, . The most junior analyst has the same opportunity to contribute to the model as the head of the department.

Ongoing recycling
When I wash, dry, and sort these used pieces, I am preparing them for their second act. They will soon be piled up on the tables of my upcoming in-person workshops, where participants will use them to build models that represent their own complex business challenges. And then at the end of the sessions, those models will be broken down again, the bricks returned to the container ready to be transformed into someone else's story.

For my virtual workshops, I send out kits that participants can keep and hopefully reuse themselves.

Purpose and Means is a niche data protection and GRC consultancy based in Copenhagen and operating globally. We work with companies providing services with flexibility and a slightly different approach to the larger consultancies. We have the agility to adjust and change as your plans change. Take a look at some of our client cases to get sense of what we do.

We are experienced in working with data protection leaders and their teams in addressing troubled projects, programmes and functions. Feel free to book a call if you wish to hear more about how we can help you improve your work.