Your hostage situation is masquerading as a privacy training if it works only while people are trapped in the meeting. Your stakeholders don't hate privacy (or you). They hate being asked to absorb abstract rules that have no bearing on the decisions waiting for them on Tuesday. They hate the bland, boring slide decks with too many hard words.
Making it actionable has always been the easier part to navigate. Making it interesting is a whole other ballgame, and it's an important one too, because your training is only effective if your stakeholders aren't practicing astral projection during the session. So, I made a toy catalog.
Actionable Figures: Issue Zero is twenty-one sheets of sweet 80s and 90s toy aisle nostalgia. Seven principles represented by the Built-In Brigade mech squad, combining forces to become the GRC-7 Titan. Eight fake back-page ads, and a final boss called The B Word. HR will be thrilled.
The magazine is not the assignment
Before you scroll any further, you should be aware that this is a worked example, not a finished curriculum, and it is not meant to be handed to your team as-is. Good training is tailored to the people in the room and the decisions actually waiting for them, and you know your constituents far better than I do.
You also don't have to make a whole toy magazine, though I'll be the first to admit that it's a pretty rad project. Read Issue Zero as one of the endless possibilities of what 'interesting' looks like, and read this article as the thinking behind it: the calls I made, the ones I threw out, and why I believe a format like this teaches privacy where another deck of rules just fills an hour. Choose one privacy idea, give it a visual system, and let people explore it instead of asking them to survive another bullet-point barrage.
Interrupt the pattern on purpose
The magazine repeatedly interrupts itself with absurd flashback ads, and yes, I unapologetically had way too much fun making them. Conventional training wisdom would tell us to preserve the learning journey, maintain clean progression, and never distract the learner. Conventional training wisdom has also produced a great many decks that people remember only as “that one before lunch.”
Have fun with it, but keep in mind that the interruption still has to teach. A fake fourth-party detective ad can reinforce vendor-chain risk. A ridiculous deletion product can restate lifecycle protection. A movie poster can turn a control into a visual shorthand people reuse later. Using parody ads as teaching tools for privacy professionals? Chef's kiss.
Why a toy catalog is the right container
A toy catalog page has roughly four seconds to equip a nine-year-old with the info they need to give mom and dad the sales pitch: what the thing does, what it comes with, what it fights, and why they need the other six. Every element on the page plays a crucial role, because the page is trying to close a sale against a very short attention span and a limited time allowance.
How to make your own
Making twenty-one pages of illustrated art look like one cohesive product is no longer just a matter of giving AI the right prompts. It is a consistency problem: art, formatting, narrative, and overall presentation.
The idea engine is four roles, not one prompt
Every PbD principle page runs on the same four-part template:
The mech
The embodiment of the principle itself. The control, made into an object with a shape and a function you can point at.
Answers: what is the thing?
The pilot
The human-in-the-loop and the work required to operate it. Nothing runs autonomously, and a control with nobody in the cockpit is a diagram, not a practice.
Answers: who has to do something?
The nemesis
Demonstrates the failure mode that leaves the risk in place. Not there just for the dramatic effect.
Answers: what does failure look like?
The accessories
Each one is an actual responsibility. A threat radar is a red team exercise. A gate lance is a go/no-go rule.
Answers: what is in the box?
If you ask a model to "illustrate privacy by design", you'll get a padlock on a blue gradient, because you asked for a mood. Ask it for those four roles and the image is forced to make an argument: here is the control, here is the person who runs it, here is how it fails, here is what you actually get.
A starter prompt you can actually paste
You should definitely use an AI model capable of generating images. For this project, I used ChatGPT Sol 5.6 Max and Gemini 3.5 Flash. Not sure if your AI agent can generate images? Try it with the prompt below to start, or just ask it. If image generation is possible, keep on adjusting this prompt to tailor it for your own usage.
Copy this
Illustrate one collectible action figure sealed in a blister package, in the style of a late-1980s toy catalog: dense, authored illustration, molded-plastic sheen, visible paint apps, blister reflections, a die-cut silhouette, and believable toy joints. The figure embodies [YOUR PRINCIPLE OR CONCEPT]. Include a mini pilot figure showing the human work required to operate it. Include three accessories, each a concrete thing a person actually does. Package header reads [FACTION NAME]. Figure name reads [FIGURE NAME]. Generate all package text as part of the artwork, spelled correctly and large enough to read at half size. Original visual language only: no real toy brand, logo, character, or trade dress. Portrait, 816 x 1056.
Swap the principle for whatever you are trying to make land. It works on incident response roles, data-flow stages, or the parts of a contract nobody reads. The toy aisle is not the point, but rather that a format with rules forces the teaching to get specific.
Editor's Note
Issue Zero is called Issue Zero because there is meant to be an Issue One. There's a preview on the last page: Quantum 3-Body Privacy. Coming soon, with a question mark, which is the most honest publishing schedule I have ever committed to.
This article, the magazine, and the interactive example were made by a working privacy practitioner and an AI. They are teaching tools, not legal advice. Check every generated scenario and answer against your own policies, systems, and legal requirements before using it with your people.
Catch something wrong, or just want to argue with me? hello@advokatfrida.com