IAPP Certified Information Privacy Professional, Europe

Every analysis starts with definitions. You decide what counts as personal data, special categories and processing, and who is a controller, joint controller or processor, using the case law that shapes each term.

• Personal data, identifiability and pseudonymous data
• Special categories and criminal data
• Processing and its stages
• Controllers, joint controllers and processors
• Data subjects and children
• Case law on the meaning of personal data

You build A role-and-data classification for three processing scenarios, with reasons.

The GDPR reaches beyond Europe’s borders and has exceptions at home. You test material and territorial scope, apply the household and law enforcement exceptions, and decide when a non-European company must comply.

• Material scope and the main exclusions
• Establishment and processing in the context of its activities
• Targeting and monitoring of people in the EU
• Representatives for non-EU organizations
• National law and the room left to member states
• Applying the scope test to scenarios

You build A scope analysis memo for a company based outside Europe.

Lawful processing is the heart of the regulation. You apply the data protection principles, choose among the legal bases, run a legitimate interests balancing test, and handle special categories and children’s data.

• The data protection principles
• Consent and what makes it valid
• Contract, legal obligation and vital interests
• Public task and the legitimate interests balance
• Conditions for special categories
• Further processing and compatible purposes
• Children and consent online

You build A legal basis decision record for five processing activities.

People hold real rights over their data. You write notices that meet the transparency rules and handle access, rectification, erasure, restriction, portability, objection and automated decisions within the time allowed.

• What information to give, and when
• Writing clear privacy notices
• Access and rectification
• Erasure, restriction and portability
• Objection and direct marketing
• Automated decision-making and profiling
• Exercising rights: process, deadlines and limits

You build A privacy notice and a rights-request procedure for one controller.

Most processing involves more than one organization. You allocate responsibility between controller and processor, write the contract the law requires, and manage sub-processors and joint arrangements.

• Responsibilities of controllers and processors
• Required processor contract terms
• Selecting and auditing processors
• Sub-processors and chains of processing
• Joint controller arrangements
• Liability and compensation between parties

You build A processor agreement checklist and a vendor review of one cloud supplier.

Security is a legal duty, and breaches carry deadlines. You choose measures proportionate to risk, judge when a breach must be reported to a regulator or to individuals, and run the first 72 hours of a response.

• Appropriate technical and organizational measures
• Risk-based security: encryption, access and resilience
• Defining a personal data breach
• Notifying the supervisory authority
• Telling affected individuals
• Breach documentation and response drills

You build A breach assessment and notification decision for two simulated incidents.

Data leaving the European Economic Area needs a lawful route. You compare adequacy decisions, standard contractual clauses, binding corporate rules and derogations, and assess whether a transfer is safe in practice.

• What counts as a transfer
• Adequacy decisions and the EU–US Data Privacy Framework
• Standard contractual clauses
• Binding corporate rules
• Transfer impact assessments and supplementary measures
• Derogations for specific situations
• Lessons from the Schrems cases

You build A transfer assessment for a group that sends data to several countries.

Organizations must show that they comply, not just claim it. You keep records, build in data protection by design, run impact assessments, and decide when a data protection officer is required and what that role does.

• The accountability principle
• Records of processing
• Data protection by design and by default
• When a DPIA is required and how to run one
• Prior consultation with the authority
• Appointing and supporting a data protection officer
• Codes of conduct and certification

You build A DPIA and a DPO appointment memo for a new service.

Compliance is tested by regulators and courts. You learn the powers of supervisory authorities, how the one-stop-shop and the consistency mechanism work, and what fines, claims and judicial remedies follow a violation.

• Supervisory authority powers and tasks
• Lead authority and the one-stop-shop
• Cooperation and the consistency mechanism
• Administrative fines and how they are set
• Complaints, judicial remedies and compensation
• Reading enforcement decisions for lessons

You build A case study of a published enforcement decision, with what the company should have done.

Employers hold more personal data than most organizations, and consent is rarely free in that relationship. You apply the rules to recruitment, monitoring, whistleblowing and works councils.

• Legal bases in the employment relationship
• Recruitment and background checks
• Monitoring email, devices and location
• Video surveillance at work and in public
• Employee rights and works councils
• Whistleblowing schemes and transfers within a group

You build A workplace monitoring policy with a proportionality assessment.

The ePrivacy rules sit beside the GDPR and often decide marketing practice. You apply consent and opt-out rules to email and calls, and set up cookie and tracking consent that stands up to scrutiny.

• The ePrivacy rules and their link to the GDPR
• Email, SMS and telephone marketing
• The soft opt-in and its conditions
• Cookies and similar technologies
• Consent banners that meet the standard
• Profiling and online advertising

You build A consent and marketing compliance review of a company’s website and email program.

New technology tests old rules. You assess cloud outsourcing, social media and platforms, and AI systems against the GDPR, and see where the EU AI Act and other digital laws add requirements.

• Cloud services: roles, contracts and transfers
• Social media, plug-ins and shared responsibility
• Machine learning and the data protection principles
• Automated decisions and profiling in AI systems
• How the EU AI Act relates to the GDPR
• Other European digital laws that touch personal data

You build A compliance assessment of a cloud-based AI feature under the GDPR.

A single scenario pulls the whole law together. You advise a group that processes customer and employee data in several countries, with vendors and transfers, and write the opinion a data protection officer would give.

• Establishing facts, roles and scope
• Choosing legal bases and fixing transparency
• Allocating responsibility and securing transfers
• Setting accountability measures and breach readiness
• Writing and defending the advice

You build A written legal opinion on a multinational’s data protection compliance.