IAPP Certified Information Privacy Professional, United States

Rules mean little without enforcers. You study the FTC’s authority over unfair and deceptive practices, the other federal and state regulators, and how enforcement actions, consent orders and private suits work.

• The FTC Act: deception and unfairness
• FTC consent orders and what they require
• Sector regulators such as HHS, the CFPB and the FCC
• State attorneys general
• Private rights of action and class actions
• Reading an enforcement action for compliance lessons

You build A case brief of one FTC privacy action, with the compliance steps it implies.

Privacy duties follow data through its life. You apply information management principles such as notice, choice and security, and handle the rules on moving personal data into and out of the United States.

• Fair information practice principles in US law
• Data inventories and the information life cycle
• Privacy notices and choice
• Transfers into the US: frameworks and agreements
• Data localization and cross-border limits
• Records management and retention

You build An information life cycle map with notice and transfer controls for one dataset.

Health data carries the most detailed federal rules. You apply the HIPAA Privacy, Security and Breach Notification Rules to covered entities and business associates, and handle patient rights, permitted uses and enforcement.

• Covered entities, business associates and protected health information
• The Privacy Rule: uses, disclosures and minimum necessary
• Patient rights of access and amendment
• The Security Rule’s safeguards
• Breach notification
• HITECH and enforcement

You build A HIPAA compliance checklist and a business associate review for one provider.

Banks, lenders and the data they hold are regulated by overlapping statutes. You apply the privacy and safeguards rules of the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and the rules on identity theft.

• The Gramm-Leach-Bliley Act: privacy and safeguards rules
• Financial privacy notices and opt-outs
• The Fair Credit Reporting Act: consumer reports and permissible purposes
• Adverse action and dispute duties
• Identity theft and red flags programs
• The CFPB and other financial regulators

You build A financial privacy notice and a permissible-purpose review for a lender.

Students and children receive special protection. You apply FERPA to education records and COPPA to online services directed at children, and decide when a service must obtain verifiable parental consent.

• FERPA: education records and student rights
• Directory information and disclosures without consent
• Schools and vendors under FERPA
• COPPA: scope and actual knowledge
• Verifiable parental consent and notice
• Teenagers and newer state rules for minors

You build A children’s privacy review of an education app, covering FERPA and COPPA.

Each marketing channel has its own statute. You apply the rules for email, telephone, text and fax marketing, the Do Not Call rules, and the privacy rules for telecom and video services.

• CAN-SPAM and commercial email
• The TCPA: calls, texts and consent
• The Telemarketing Sales Rule and Do Not Call
• Telecom customer information rules
• The Video Privacy Protection Act
• Behavioral advertising and self-regulation

You build A marketing compliance matrix that sets out the rules for each channel.

Companies receive requests for customer data from police, regulators and intelligence agencies. You learn the legal standard for each type of request and how to respond to it, challenge it or refuse it.

• The Fourth Amendment and the third-party doctrine
• The Wiretap Act, Stored Communications Act and Pen Register Act
• Search warrants, court orders and subpoenas
• National security: FISA and national security letters
• Responding to a request: validation and scope
• Transparency reporting and customer notice

You build A law enforcement request procedure with a decision flowchart.

Personal data gets pulled into lawsuits. You handle subpoenas and discovery requests, protective orders and privilege, and the privacy limits on what a party may ask of you.

• Subpoenas and civil discovery requests
• Protective orders and sealing
• E-discovery and personal data
• Privilege and work product in privacy matters
• Litigation holds and retention conflicts
• Cross-border discovery issues

You build A subpoena response protocol that protects the personal data of third parties.

Employment generates sensitive data from hiring to retirement. You apply the rules on background screening, medical data, monitoring, automated hiring tools and records retention.

• Background checks and the FCRA
• Medical, disability and genetic information in employment
• Drug and alcohol testing
• Monitoring email, devices, video and location
• Automated employment decision tools
• Records retention after employment ends

You build An employee monitoring policy and a background-screening procedure.

Every state requires notice after a breach, and many set security standards. You identify the common elements, compare the differences, and plan a notification that runs across several states at once.

• State breach notification: triggers, timing and content
• Definitions of personal information
• Data security and disposal requirements
• Notice to regulators and consumer reporting agencies
• Biometric laws such as Illinois BIPA
• Running a notification across many states

You build A multi-state breach notification matrix and decision tool.

States have passed broad consumer privacy laws that differ at the edges. You compare California, Virginia and Colorado on scope, rights and duties, and add the rules on health data, cookies and AI bias.

• Common elements across state privacy laws
• California: CCPA, CPRA and the California Privacy Protection Agency
• Virginia and Colorado compared
• Sensitive data, opt-outs and universal opt-out signals
• Consumer health data laws
• Cookies, tracking and wiretap claims
• Rules on automated decisions and AI bias

You build A comparison chart of three state laws, with one program that satisfies all of them.

One company brings every part of the course together. You assess an online retailer with health, children’s and employee data across several states, identify the laws that apply, and prepare a compliance plan.

• Establishing the facts and data types
• Identifying the federal and state laws that apply
• Finding gaps and prioritizing risks
• Drafting policies, notices and procedures
• Presenting the plan to counsel and management

You build A multi-state compliance assessment and remediation plan for a retailer.