Case · Odense Municipality
The rule was never the problem. It was the workflows, and colleagues interrupting at the wrong moments
Information security, GDPR, good administrative practice and health and safety — for a
large and varied workforce. Five modules, 90 minutes in total.
5 modulesbasics, information security, GDPR, administrative practice, health and safety
90 minutestotal running time for all of it
Several departmentslawyers who had to reach agreement
From the course “Good conduct in Odense Municipality”.
The task
Four subjects that are legally heavy, context-dependent and apply to everyone — from those who
handle personal data every day to those who almost never do. The municipality wanted it
professionally correct and usable, and was clear from the start that learning costs time.
Digital learning has to make sense — and not take longer than it needs to.
That made the work harder, not easier. It is easy to pour in the whole handbook and be covered. The hard part is deciding what to leave out, without compromising
the substance — and that decision has to be made subject by subject, together with the lawyers who
answer for the content.
Why compliance is a behaviour problem
A course in the rules assumes the problem is capability: people do the wrong thing because they do not know
better. But most data breaches do not happen because someone did not know the rule. They happen because in the
moment it was easier not to — busy, unclear, nobody watching.
So the material is built on behavioural design throughout: the target is the action that
has to happen in the working day, not the knowledge that can be recited afterwards. Two examples from the courses:
- “What do high-visibility vests have to do with GDPR?”A behavioural design technique for
preventing data breaches — it is about making a risky situation visible, not about explaining the rules one more time.
- The single most important thing against IT fraudThe information security module leads with
the action that changes the most — rather than with an exhaustive tour of the threat landscape.
The collaboration
Lawyers from several departments, with different concerns, had to find common ground. We
were responsible for the learning design and the didactic structure — structure,
scripts, animation and coherence across the modules.
The client’s words · translated from Danish
“The collaboration with Tomas and elearningspecialist has been driven by high ambitions on both
sides the whole way through. It has been great to work with someone who challenges our ideas and
wishes in the right way. All through the process we have found solutions that put our audience and
their needs first and are of high professional quality in learning terms. It has been a real
pleasure.”
Ida Bohn, chief consultant,
Management Support, Odense Municipality
See the courses
They are openly available — you can go through them without talking to anyone (in Danish):
GDPR ·
information security ·
good conduct ·
good administrative practice ·
health and safety.
Produced in Vyond and Articulate Storyline, delivered as SCORM to the municipality’s LMS.
What we cannot claim
We have not measured whether fewer data breaches happen in Odense Municipality. It has not been measured, and we
do not invent a number. What the case shows is that four legally heavy subjects can be delivered in
90 minutes without simplifying them — and that deciding what to leave out is the work
itself.