IAPP Certified Information Privacy Technologist

Risk has to be named before it can be reduced. You use risk models and frameworks, build a privacy threat model for a system, and weigh what could go wrong for the people whose data it holds.

• Privacy harms and a taxonomy to describe them
• Contextual integrity as a way to spot problems
• Privacy threat modeling with LINDDUN
• Data flow diagrams as the starting point
• Rating likelihood and impact
• Prioritizing threats for mitigation

You build A privacy threat model with a data flow diagram for one application.

Legal compliance is not the same as doing right by users. You examine ethical principles for data use, the line between useful personalization and intrusion, and how to raise ethical concerns inside a product team.

• Ethical principles for data use
• Intrusion and decisional interference
• Manipulation and the limits of personalization
• Ethics review of data projects
• Raising concerns inside a team
• Linking ethics to privacy risk

You build An ethics review of a product idea, with concerns and mitigations recorded.

Collection sets the terms for everything after it. You design consent and notice flows that people can understand, build preference management, and decide what you need to collect at all.

• Deciding what to collect and why
• Consent models: opt-in, opt-out and granular
• Writing and showing notices
• Preference and consent management systems
• Collecting from children and sensitive sources
• Recording consent so it can be proven

You build A consent and notice flow for a mobile app, with a consent record design.

Data should stay within the purpose it was collected for and leave when it is no longer needed. You enforce purpose limits and access controls, set retention rules, and make deletion work across backups, logs and copies.

• Purpose limitation in systems design
• Access controls and need-to-know
• Retention schedules and legal holds
• Deletion in databases, backups and logs
• Secure destruction of media
• Proving that data is gone

You build A retention and deletion design for one system, including its backups.

Some uses do not need identifiable data. You apply pseudonymization, anonymization, aggregation and newer techniques, and test honestly whether a dataset can be re-identified.

• Identifiability, from identified to anonymous
• Pseudonymization, tokenization and masking
• k-anonymity and its limits
• Differential privacy
• Encryption and key management for privacy
• Federated learning and processing without sharing raw data
• Testing for re-identification

You build A de-identified dataset with a written re-identification risk assessment.

Every disclosure creates new risk. You control what goes to vendors, partners, SDKs and APIs, check what leaves a system, and respond to requests for disclosure from authorities.

• Mapping who receives data
• Third-party SDKs and libraries
• APIs and data sharing agreements
• Technical controls on outbound data
• Disclosures to authorities and legal process
• Monitoring what leaves your systems

You build A data sharing review of a mobile app and its third-party components.

Tracking technology and interface choices can undermine trust. You study cookies, fingerprinting, location tracking, workplace monitoring and dark patterns, and learn to design and audit for better alternatives.

• Cookies, fingerprinting and cross-site tracking
• Location and device data
• Behavioral advertising and its controls
• Dark patterns in consent and settings
• Workplace monitoring and surveillance technologies
• Auditing a site for tracking

You build A tracking audit of a live website with written recommendations.

Machine learning changes the privacy equation. You assess how models memorize and leak data, how inference creates sensitive facts, and what extra controls AI systems, connected devices and workplace technology need.

• Personal data in training sets
• Memorization, leakage and inference attacks
• Automated decisions and the right to an explanation
• Biometrics and facial recognition
• Internet of Things and connected devices
• Assessing an AI feature for privacy risk

You build A privacy risk assessment for a feature that applies machine learning to personal data.

Privacy by design is a method, not a slogan. You apply the seven principles, evaluate user experiences for privacy risk, and use value sensitive design to bring users’ values into the requirements.

• The seven privacy by design principles
• Privacy as the default setting
• Privacy in user research and UX design
• Value sensitive design
• Prototyping and testing privacy features
• Design reviews with a privacy lens

You build A privacy by design review of a product prototype, with design changes.

Engineering objectives give privacy something to measure. You apply NIST’s privacy engineering objectives, add privacy requirements, review code, test, and monitor systems at runtime through to retirement.

• Predictability, manageability and disassociability
• Privacy requirements in agile and traditional projects
• Privacy-aware coding practices
• Code reviews and testing for privacy defects
• Runtime monitoring and logging for privacy
• Privacy in retirement and decommissioning

You build Privacy requirements and a test plan for one feature in an agile backlog.

Engineering needs governance to last. You keep records of processing and data inventories, run impact assessments and audits, and feed what you find back into the engineering process.

• Data inventories and records of processing
• Privacy impact and data protection impact assessments
• Audits of technical controls
• Reviewing IT controls against frameworks
• Metrics for engineering teams
• Closing the loop with product teams

You build A record-of-processing entry and a DPIA for one technical system.

One system carries the course. You review a connected product from collection to deletion, find the risks, design the fixes, and present a privacy engineering plan to the product team.

• Scoping the system and its data
• Threat modeling and risk rating
• Designing controls across the life cycle
• Writing requirements and test cases
• Presenting the plan to engineers and counsel

You build A complete privacy engineering plan for a connected product.