Your LMS Says 98% Passed. So Why Do Incidents Keep Happening?

The Comfortable Illusion

Every major UK GDPR e-learning provider now includes an end-of-course quiz. iHasco, VinciWorks, High Speed Training, Praxis42—the format is remarkably consistent: 10–20 multiple-choice questions, an 80% pass mark, unlimited retakes, and a certificate on completion.

And so the ritual plays out every year. The DPO rolls out training, chases completions for three weeks, and eventually reports to the board: "98% of staff have completed mandatory GDPR training. 95% passed first time."

Everyone nods. Compliance is ticked. The slide gets filed.

Six months later, an employee in Sales emails a client list to a competitor. A contact centre agent shares personal data over the phone without verifying the caller's identity. A marketing campaign launches without consent records.

The board asks: "Didn't we train everyone?"

Yes. You did. And the quiz proves it. The problem is that the quiz measures the wrong thing.

The 83-Point Gap

Here is the most important number in training effectiveness research:

Think about what that means in the context of your training dashboard:

Quiz pass rates are not a measure of competence. They are a measure of short-term recall, tested immediately after watching a video, with unlimited retakes. They tell you who sat through the course. They tell you nothing about who will behave differently tomorrow.

Four Structural Problems with Compliance Quizzes

1. 1
   They test recognition, not recall

   Selecting the right answer from a list is a fundamentally different cognitive skill from generating the right response under pressure. In the real world, there is no multiple choice. Your staff need to recognise a data breach in the middle of a busy day—not tick option C.

2. 2
   They test at peak memory, not retention

   The quiz is taken immediately after the training video. Short-term memory is at its highest. Research consistently shows that retention drops steeply within days—ATD puts it at 75% of content forgotten within six days. A quiz taken five minutes after training tells you almost nothing about knowledge three months later.

3. 3
   They are trivially easy to game

   Unlimited retakes. Small question banks of 10–20 items. Answers shared informally between colleagues. "All of the above" options that give away the correct response. Researchers at Washington University found that poorly formatted quiz questions can actually reinforce incorrect information through the "negative suggestion effect"—learners who are unsure may commit wrong answers to memory.

4. 4
   Pass rates are meaningless at scale

   When everyone can retry until they pass, a 95% first-time pass rate sounds impressive but tells you nothing. The 5% who failed first time just retook it. Your organisation-wide "success rate" is an artefact of unlimited attempts, not a signal of knowledge or capability.

What the Quiz Can't See

Training quizzes sit at Level 2 of the Kirkpatrick evaluation model: "Did they learn it?" This level is measured by roughly 70% of training programmes. It's necessary, but it is not sufficient.

Level 3—"Do they behave differently?"—is measured by only about 20% of programmes. Level 4—"Did business outcomes improve?"—by fewer than 10%. Quizzes don't reach these levels. They were never designed to.

A person can score 100% on a GDPR quiz and still:

These are the factors that predict whether someone will actually do the right thing when it matters—and no quiz in the world can measure them.

Knowledge vs Culture: The Seven Dimensions

A culture survey measures what a quiz structurally cannot. Here's the gap:

The quiz covers one dimension out of seven—and only partially at that. The other six are invisible to your LMS analytics. They are also the dimensions that actually predict incidents.

The "Care But Can't Cope" Problem

Research from the Global Privacy Culture Survey has identified a widening paradox: employees increasingly value privacy but feel less equipped to act on it. Knowledge scores are rising. Confidence scores are falling. People care more, but cope less.

This pattern would never surface in quiz data. A quiz tests whether someone knows the right answer. It cannot reveal that the same person feels overwhelmed, unsupported, and likely to cut corners when pressure mounts. The knowledge is there—it's everything surrounding it that's failing.

Three Different Questions

The sharpest way to understand the difference:

Quizzes test the individual. Culture surveys test the environment. The quiz asks: "Does this person know the breach reporting procedure?" The culture survey asks: "If this person spots a breach, will they actually report it—given their team's culture, their workload, and their fear of blame?"

Quizzes measure training effectiveness. Culture surveys measure organisational risk. The quiz asks: "Did the content land?" The culture survey asks: "Where will the next incident come from?"

Quizzes are backward-looking. Culture surveys are predictive. The quiz says: "They passed—we're compliant." The culture survey says: "Your Sales team scores 40% on psychological safety to report. That's your highest-risk area."

What This Means for DPOs

None of this argues against training. Training matters. Knowledge is a necessary foundation. But it is not sufficient—and measuring knowledge alone creates a dangerous blind spot.

If you are spending £50,000–100,000 a year on privacy training (the typical range for a 500-employee organisation), you deserve to know whether it is actually changing behaviour. Not whether people passed the quiz. Not whether they completed the course. Whether the organisation is genuinely safer than it was before.

That requires measurement across all seven dimensions. It requires team-level analysis, not just individual scores. It requires benchmarks so you know whether your numbers are strong or weak. And it requires a methodology designed to surface risk—not just confirm that training was delivered.

Quiz scores don't predict breaches. Culture does.