GDPR training as a SCORM package: seamless integration into the corporate LMS

Starting point: GDPR awareness for an internationally distributed workforce

An internationally operating chemical group with sites in the USA and Germany wanted to raise data protection awareness among its employees group-wide – via the learning management system (LMS) that is used in the company every day anyway. And that is exactly how the training eventually reached the employees: as an imported SCORM package in the existing system, without a second platform, without additional logins, and without a break in the IT landscape that had grown over time. This practical report shows what the path there looked like.

The starting situation was typical of large organizations: All internal learning and record-keeping processes are embedded in the established LMS. A separate platform solely for data protection training would have meant two systems, duplicate administration, additional logins, and more work for IT. At the same time, the content could not make any compromises: The awareness training had to be professionally reviewed, up to date with the GDPR, and documented in a traceable way for a large workforce spread across several countries.

The conflict of objectives: reviewed standard content meets an established LMS landscape

Many corporations face the same conflict: They want to use high-quality, externally maintained training content without giving up their existing LMS infrastructure. The question is not "Platform A or B?" but: How does current, reviewed content get into the system that the workforce uses anyway, in a verifiable way – without switching media and without parallel user management?

With an international workforce, there is also the fact that data protection awareness training must not only be rolled out once but kept up to date for years and proven uniformly across all sites. Why and for whom such awareness training is expected is explained in detail in our article on data protection training for employees; this practical report focuses on the technical integration.

Why a SCORM package was the obvious solution

A note on our own behalf: Bridgly provided the data protection awareness training as a standardized SCORM package. SCORM (Sharable Content Object Reference Model) is the established technical standard for exchanging e-learning content between systems: A SCORM package can be imported into almost any compatible LMS and runs there entirely in the familiar environment – including progress and completion tracking. If you want to know more about what makes a SCORM package, you will find the basics in the glossary; we cover the differences between SCORM and xAPI as tracking standards separately.

For the group, one thing was decisive: The content comes professionally reviewed from outside, while delivery stays in-house. This made it possible to import the complete training directly into the existing corporate LMS without detours; the rollout ran via the familiar IT landscape, without a new platform and without additional logins. Because Bridgly maintains the content, it is also regularly adapted to the current legal situation.

The rollout step by step

SCORM export from Bridgly

The training was exported as a standards-compliant SCORM package – independent of the source system and ready for import into the group's target environment.

Import into the existing LMS

The package was imported directly into the corporate LMS. Employees completed the training via the system they use anyway – without a new login and without switching context. Participation was recorded via the LMS, as with other courses.

Proof and completion tracking

Because SCORM reports progress and completion back to the LMS, the documentation of the completed awareness training was created where the group keeps its records anyway – centrally and uniformly across all sites.

Staying current through legal changes

If the legal situation changes, Bridgly provides the updated version as a new SCORM package; it replaces the old version in the LMS. Internal research effort decreases significantly because the content is maintained externally; importing and reassigning updated packages remains with the company.

The data protection perspective: verifiability, TOMs, and processing on behalf of a controller

From a data protection perspective, raising employee awareness is not an end in itself. In Art. 32 (Security of processing), the GDPR requires appropriate technical and organisational measures and, in Art. 39 (1) lit. b GDPR, expressly names "awareness-raising and training of staff involved in processing operations" as a task of the data protection officer. Training that has demonstrably been completed is thus a building block with which controllers can prove their organizational measures – and the central completion tracking in the LMS provides the basis for this.

A second aspect concerns the choice of system itself: Because the training runs in the group's own, already regulated LMS, the participant data remains in the group's system. In this constellation, no additional processing relationship with another external platform operator is therefore required, such as the one that processing on behalf of a controller under Art. 28 GDPR governs for cases in which a service provider processes personal data on someone else's behalf; the data protection assessment must still be made on a case-by-case basis. The content is purchased, while data processing remains in the existing, controlled system landscape.

The result: group-wide awareness without restructuring systems

All employees in the USA and Germany were trained in the basics of data protection and their participation was documented – via the system they use anyway. The group works with professionally reviewed, continuously updated content without having to restructure its IT landscape. How smoothly the integration went was shown above all by the fact that the training ran in the familiar environment without a system break or additional logins, and that the records converged centrally in the LMS.

What other corporations can take away from this

• Build on the existing LMS. SCORM enables mandatory and awareness training without a second platform and without a system break.
• Keep proof central. If the training runs in your own LMS, completion records are created where the organization keeps them anyway.
• Largely outsource keeping content current. Externally maintained content significantly reduces internal research effort; importing and reassigning the updated packages remains the company's task.
• Locate data processing deliberately. The content comes from outside, while the participant data stays in your own controlled system.

Further practical reports from our case studies show how organizations of different sizes implement their mandatory and compliance training with Bridgly.

What is a SCORM package?

SCORM (Sharable Content Object Reference Model) is a technical standard for e-learning content. A SCORM package can be imported into almost any compatible learning management system – the training then runs in the existing LMS, including progress and completion tracking.

Is SCORM data protection training GDPR-compliant?

GDPR compliance depends on the content and how up to date it is, not on the format. What matters is that the awareness training is professionally reviewed, current, and demonstrably completed – SCORM takes care of the technical integration and the completion documentation.

Can training courses be integrated into your own LMS?

Yes. Via SCORM export, ready-made training courses can be imported directly into an existing learning management system – without a second platform and without additional logins for employees.

How does SCORM content stay legally up to date?

By the provider maintaining the content and updating it when the law changes. The updated version is provided as a new SCORM package and replaced in the LMS; the company takes care of import and reassignment. This significantly reduces internal research effort.

• Regulation (EU) 2016/679 (GDPR), in particular Art. 32 (security of processing / technical and organisational measures), Art. 39 (1) lit. b (awareness-raising and training by the data protection officer), and Art. 28 (processing on behalf of a controller), EUR-Lex – accessed 8 Jun 2026.
• SCORM (Sharable Content Object Reference Model) – overview by the Advanced Distributed Learning (ADL) Initiative; technical standard for the exchange and LMS import of e-learning content – accessed 8 Jun 2026.
• Image license: AI-generated motif (production pending); use with visible label "Created with AI" (overlay) in line with Art. 50 EU AI Act; document proof of license/source on upload.