IAPP Certified Information Privacy Manager

Obligations come from many places at once. You identify the laws, regulations, contracts and standards that apply to your data and your markets, reconcile their overlaps, and add the new risks that AI brings.

• Finding applicable laws by data type and jurisdiction
• Industry codes, contracts and standards
• Reconciling overlapping and conflicting requirements
• Building one approach for several regions
• Privacy risks created by AI systems
• Keeping up with regulatory change

You build A requirements register for a multinational, with each obligation traced to its source.

Who owns privacy shapes how well it works. You compare centralized, local and hybrid governance, place the privacy function in the organization, and structure a team with the right roles and ties to legal, security and IT.

• Centralized, local and hybrid models compared
• Where privacy sits in the organization
• Roles: privacy officer, champions, data owners
• Working with legal, security, HR and IT
• Executive and board reporting
• Building and developing the team

You build An operating model with team structure and reporting lines for one organization.

Written rules turn requirements into daily behavior. You draft policies and procedures for each stage of the privacy life cycle, write notices that people can read, and keep them aligned with how data is actually handled.

• The privacy life cycle and the policy for each stage
• Writing a privacy policy and internal standards
• Privacy notices and layered notices
• Retention, sharing and consent procedures
• Procedures for breaches and data subject requests
• Keeping policy and practice aligned

You build A policy set with an internal privacy standard and a customer notice.

A program you cannot measure is hard to defend and harder to improve. You choose metrics that show how it performs, build training matched to roles, and run awareness work that changes behavior.

• Choosing metrics: process, performance and outcome
• Collecting the data behind a metric
• Reporting to different audiences
• Role-based privacy training
• Awareness campaigns that change behavior
• Measuring whether training worked

You build A privacy dashboard design and a role-based training plan.

You cannot protect data you cannot find. You build inventories and data maps, trace how personal information moves between systems, vendors and countries, and keep the picture current as the business changes.

• Inventories, records of processing and data maps
• Interviews and tools for discovering data
• Tracing data flows across systems and borders
• Classifying data by sensitivity and purpose
• Keeping the map current
• Using the map for requests and incidents

You build A data inventory and flow diagram for one business process.

Risk arrives through third parties and transactions. You assess processors before and after contract, review privacy in mergers and acquisitions, and compare current practice with a standard to see where the gaps are.

• Vendor selection and privacy due diligence
• Contract clauses for processors
• Ongoing vendor monitoring and audit
• Privacy in mergers, acquisitions and divestitures
• Gap analysis against a framework or law
• Prioritizing and closing gaps

You build A vendor assessment and a gap analysis against one regulation.

Protection combines process and technology. You classify data, control who can reach it, apply security practices, and build privacy into systems from the start, working alongside the engineers who run them.

• Data classification and handling rules
• Access controls and least privilege
• Security practices: encryption, logging, devices and cloud
• Privacy by design in projects
• Technical controls such as masking and de-identification
• Working with security and engineering teams

You build A control set that protects one system’s personal data from collection to deletion.

Assessments find risk before it becomes harm. You learn when a privacy or data protection impact assessment is needed, run one from scoping to sign-off, and choose among the other assessment types a program uses.

• When an assessment is required or wise
• Running a privacy impact assessment
• Data protection impact assessments and legal triggers
• Assessing AI systems and new technologies
• Recording risks, decisions and mitigations
• Building assessments into project intake

You build A completed impact assessment for a proposed product feature.

A program has to hold up after its first year. You audit against policy and law, run continuous assessment, report to leadership, and keep improving as the business, the law and the technology change.

• Internal and external audits
• Preparing for a regulator’s inquiry
• Continuous monitoring and assessment
• Reporting results to leadership
• Managing findings and corrective action
• Improving the program over time

You build An annual audit and improvement plan for a privacy program.

Rights requests show whether a program works. You build a process to receive, verify, route and answer requests within the time the law allows, handle exceptions, and learn from the volume and the complaints.

• Types of requests and the rights behind them
• Receiving and verifying a request
• Searching systems and compiling a response
• Exemptions, exceptions and refusals
• Deadlines, templates and records
• Handling complaints and appeals

You build A request-handling procedure with templates and a response-time tracker.

Breaches are a question of when. You prepare a plan, assemble a response team, assess harm, decide whom to notify, and review each incident afterward so that the plan gets better.

• Building an incident response plan
• Roles and the response team
• Assessing harm and notification duties
• Notifying regulators, individuals and others
• Working with forensics, legal and communications
• Post-incident review and lessons learned

You build An incident response plan and a tabletop exercise for a personal data breach.

Everything joins in one organization. You assess a fictional company, set its strategy and governance, map its data, plan its assessments and responses, and present a first-year program to its leadership.

• Assessing the starting position
• Setting priorities and sequence
• Designing governance, policy and metrics
• Planning operations: assessments, requests, incidents
• Presenting the plan and defending trade-offs

You build A first-year privacy program plan for a fictional company, presented to its leadership.