St Christopher’s Data Protection Escape Room

The project

The hospice, like any organisation, has a range of data protection threats to combat daily including internal processes and external attacks e.g. phishing.

Working with learning technology consultants LearnMP, St Christopher’s Data Protection Officer (DPO) Dave Tustin co-designed an interactive digital escape room to make data protection awareness engaging, memorable, and directly relevant to everyday work in the hospice.

By using gamification, staff can explore real-world scenarios they may encounter – like phishing emails, unattended confidential documents or device security – in a safe, problem-solving environment.

St Christopher's Hospice Logo

The process

Target audience and considerations

  • Audience: Clinical and non-clinical staff and new starters
  • Not embedded within an LMS to ensure reduction in barriers to access (however SCORM package also available for LMS)
  • Designed for mobile, tablet and PC
  • Accessibility considerations includes Closed Captions (CC) on all animations, audio, meaningful alt text on images, options to skip less accessible interactive activities e.g. drag and drop

Learning objectives

At the end of the Escape Room game, the participant will be able to:

  • Recognise common data protection risks in the hospice setting.
  • Make secure choices under time pressure.
  • Have confidence in spotting and preventing data breaches.

Promotion

The escape room was officially launched at the end of October 2025, marking the end of Cyber Security Awareness Month, promoting that data protection is a daily necessity, not just restricted to a month. Promotion included:

  • Teaser campaign centred around the hospice cat (who also features in the game)
  • Promoted to groups via Microsoft Teams, Wednesday Learning Forum presentation, employee newsletter, employee intranet

Impact measurements

The project was designed for quick uptake and measurable behaviours. Impact measurements therefore combined knowledge, behaviour, and culture indicators.

Leading indicators (directly/soon after completion)

  • Reach & completion: % invited who started and who completed the game
  • Knowledge uplift: pre/post questionnaire

Lagging indicators (over 4–12 weeks)

Some metrics expected to rise as awareness improves (e.g. phishing reports) – a positive signal when paired with fewer risky clicks as people are noticing and surfacing issues earlier.

  • Phishing simulation click-through decrease and report rate increase
  • Near-miss reporting increase (normalisation of safe reporting)
  • Data-handling breaches (minor) decrease (or faster containment times)
  • Initial results indicate a clear improvement in confidence compared with pre-analysis data.
  • Early feedback suggests participants felt better equipped to recognise phishing attempts relevant to the hospice following playing the Escape Room.

Future developments

  • Inclusive avatars for better relatability and investment
  • Extended ‘micro rooms’ for additional learning
  • Short pulse (“I know what to do if…”) at spaced intervals following participation – providing qualitiative impact analysis
  • Impact measurements of decision quality (percentage of secure choices in the scenarios)
  • Deployment to volunteers

Results

Confidence in spotting phishing

  • Initial results indicate a clear improvement in confidence compared with the pre-analysis data.
  • Early feedback suggests participants felt better equipped to recognise phishing attempts relevant to the hospice.

Confidence in escalating a data concern

  • Post-learning responses show a noticeable shift toward higher confidence in reporting/escalating a data concern.
  • While further data collection will confirm longer-term trends, the early pattern is encouraging.

Overall patterns

  • Initial responses indicate this new method of e-learning has supported a more consistent baseline of confidence across participants.
  • Initial responses suggest fewer misunderstandings and less uncertainty compared with pre-analysis findings.
  • Engagement levels were high, with many participants expressing clarity and ease of navigation.

Summary

Initial results from this early evaluation show a positive shift in staff confidence following playing the Escape Room.

Compared with the pre-analysis data, uncertainty and lower-confidence ratings have reduced, and participants provided consistently positive feedback across both confidence measures.

While this is an ongoing project and further data will help validate long-term impact, the early indications suggest that the Escape Room has been well received and is supporting improved confidence in key data protection behaviours.

Ready to see it in action?

Drop us an email and we’ll be in touch with more details on how you can see the Escape Room.

Name(Required)
Email(Required)