CIPM Certification Prep

Establish the foundation and governance model for the privacy program.

1. I.A Define program scope and develop a privacy strategy: identify PI, business model & risk appetite; choose governance model; structure the team; identify stakeholders
2. I.B Communicate organizational vision and mission: create internal/external awareness; ensure access to policies; establish common privacy terminology
3. I.C Indicate in-scope laws, regulations and standards: territorial/sectoral/industry regulation; impact of non-compliance; oversight-agency authority; cross-border implications; AI privacy risks

Implement governance, policies, roles, metrics, and training.

4. II.A Create policies and processes across the privacy life cycle: organizational model & reporting; data policies; collection-point transparency; breach-management, DSR and complaint plans; retention & disposal
5. II.B Clarify roles and responsibilities: privacy-team & stakeholder roles; data sharing & disclosure; breach-response accountability by function
6. II.C Define privacy metrics for oversight and governance: metrics per audience; audit purposes & life cycles; monitoring law changes across jurisdictions
7. II.D Establish training and awareness activities: targeted training for employees, management and contractors across the life cycle

Identify and minimize privacy risk across systems and processes.

8. III.A Document data governance systems: map inventories, flows, life cycle & integrations; measure policy compliance; gap analysis against laws/standards
9. III.B Evaluate processors and third-party vendors: assess outsourcing risks; carry out assessments at the right functional level
10. III.C Evaluate physical and environmental controls: risks of physical locations; document retention/destruction; media sanitization; device security
11. III.D Evaluate technical controls: risks of digital processing; limits on use & retention; data location & cross-border flows
12. III.E Evaluate risks in mergers, acquisitions and divestitures: due diligence; contractual & data-sharing obligations; risk and control alignment

Protect data assets through privacy and security controls.

13. IV.A Apply information security practices and policies: data classification; control purposes & limits; access controls; technical, administrative & organizational measures
14. IV.B Integrate Privacy by Design (PbD): privacy across the SDLC and business processes; principles and purposes of PbD
15. IV.C Apply organizational guidelines for data use and enforce technical controls: verify secondary-use guidelines & safeguards; effective access controls; collaborate on obfuscation, minimization & PETs

Sustain the program with metrics, audits, and continuous assessment.

16. V.A Use metrics to measure program performance: metrics for trending, ROI & resiliency; link data to program goals and compliance measures
17. V.B Audit the privacy program: select monitoring forms; complete compliance monitoring against standards and regulatory change
18. V.C Manage continuous assessment: risk assessments on systems & processes; purpose & life cycle of PIA, DPIA, TIA, LIA, PTA; post-M&A mitigation & communication

Respond to data-subject requests and privacy incidents.

19. VI.A Respond to data subject access requests and privacy rights: transparent notices; comply with consent, rectification, objection, access & complaints; global rights legislation
20. VI.B Follow incident handling and response procedures: assessment, containment & remediation; stakeholder communication; incident register & records
21. VI.C Evaluate and modify the incident response plan: post-incident reviews; changes to reduce likelihood and impact of future breaches