ISACA Certified Data Privacy Solutions Engineer

You cannot protect personal data you cannot find. You build a data inventory and map flows, classify personal data, assign ownership and keep records of processing that regulators and teams can use.

• Data inventory and data mapping
• Classifying personal and sensitive data
• Data ownership and stewardship
• Records of processing activities
• Data catalogs and metadata
• Keeping the map current as systems change

You build A data map and record of processing for one business process, covering every system that touches personal data.

Privacy obligations come from law, contract and public expectation. You work with the main regimes, the lawful bases for processing, individual rights, cross-border transfer rules and breach notification duties.

• Major privacy regimes compared, including GDPR and CCPA
• Lawful bases and consent
• Rights of individuals and how to meet them
• Cross-border transfer mechanisms
• Breach notification obligations
• Sector rules and their overlap

You build An obligations matrix for an organization operating in three jurisdictions.

Privacy risk is the risk of harm to people, which differs from risk to the company. You run impact assessments, rate privacy risk, use a recognized framework and decide when a project may proceed.

• Privacy harms to individuals
• Threshold analysis and when an assessment is required
• Privacy and data protection impact assessments
• Risk rating and treatment
• The NIST Privacy Framework
• Recording and reviewing decisions

You build A completed data protection impact assessment for a new product feature.

Compliance is a continuing practice. You monitor and audit privacy controls, assess vendors, draft processing agreements, train staff and run the response to a privacy breach from detection to notification.

• Compliance monitoring and internal audit
• Vendor privacy assessments
• Data processing agreements
• Training and awareness
• Privacy breach detection and response
• Notifying regulators and individuals

You build A vendor assessment and processing agreement checklist, plus a breach response runbook.

How personal data is collected decides everything after. You apply minimization and purpose limits, write clear notices, manage consent and preferences, and run requests from individuals reliably.

• Data minimization and purpose limitation
• Notices that people can understand
• Consent and preference management
• Handling access, correction and deletion requests
• Secondary use and compatible purposes
• Children’s data and other special cases

You build A consent flow and a request handling procedure for a consumer application.

Personal data should leave the organization only deliberately and should not outlive its purpose. You govern sharing, set retention schedules, handle archives and backups, and dispose of data so it cannot return.

• Sharing with third parties and affiliates
• Data sharing agreements
• Retention schedules and legal holds
• Archives and backups in deletion
• Secure deletion and destruction methods
• Proving that data was disposed of

You build A retention schedule and disposal procedure covering live systems, backups and archives.

Privacy is cheapest to build in at the start. You apply the foundational principles of privacy by design, turn them into requirements, model privacy threats and work privacy into development and architecture.

• Privacy by design principles
• Privacy requirements and user stories
• Privacy threat modeling with LINDDUN
• Privacy in agile and DevOps workflows
• Privacy design patterns
• Reviewing architecture for privacy

You build A privacy threat model and requirement set for one system design.

Technology can limit what is exposed even when data must be used. You apply encryption, access control, masking, tokenization, pseudonymization and anonymization, and weigh advanced privacy-enhancing techniques for fit.

• Encryption and key management for personal data
• Access control and least privilege
• Masking, tokenization and pseudonymization
• Anonymization and re-identification risk
• Differential privacy and k-anonymity
• Homomorphic encryption, secure computation and federated learning

You build A set of technical controls for a dataset with a measured re-identification risk before and after.

Each technology brings its own privacy problems. You examine mobile and web applications, tracking and cookies, cloud services, connected devices, biometrics and machine learning, and design controls for each.

• Mobile and web applications, SDKs and permissions
• Cookies, tracking and analytics
• Cloud services and shared responsibility for privacy
• Internet of things and connected devices
• Biometrics and sensitive data
• AI and machine learning: training data and inference

You build A privacy review of one mobile app or connected device, with findings and fixes.

A privacy program shows itself in daily operations. You run intake of requests and complaints, monitor controls, produce metrics and reports and keep the program improving.

• Intake and workflow for privacy requests
• Monitoring and testing privacy controls
• Privacy metrics and reporting
• Complaints and escalation
• Working with regulators
• Continuous improvement of the program

You build A privacy operations dashboard with measures and thresholds for a program.

One product follows the whole path. You map its data, assess its risk, define its controls and life cycle rules, engineer privacy features into the design and document everything for review.

• Mapping data for the product
• Assessing privacy risk and obligations
• Defining life cycle rules for the data
• Designing and specifying technical controls
• Documenting the privacy case for review

You build A privacy design package for one product: data map, assessment, controls and life cycle rules.