DAPLE (C1) study plan

Map the C1 exam blueprint domain weights to a personal gap list, scoring your current confidence 1-5 per domain and ranking the three weakest areas

Outline the structure of a core privacy statute (controller/processor roles, lawful bases, data subject rights, supervisory authority powers) into a one-page diagram

Distinguish the seven GDPR-style principles and write one concrete engineering or process control that operationalizes each

Explain the difference between accountability, transparency, and lawfulness using two original workplace scenarios

Draft a table of at least 10 regulatory terms with your own definition and one example of a violation

Compare at least three privacy regimes (comprehensive omnibus, sectoral, and self-regulatory models) on scope, enforcement, and penalty structure

Trace how a cross-border transfer mechanism interacts with a lawful basis and with data subject rights in a worked example

Build a governance RACI that assigns accountability for policy ownership, DPIA approval, records maintenance, and incident escalation

Write a 300-word memo arguing when a legitimate-interest assessment is defensible and when it is not

Self-quiz on domain 1 and 2 objectives and log every missed item with the underlying concept

Construct a data inventory schema with at least 12 fields (source, purpose, lawful basis, retention, storage location, recipients, sensitivity tier)

Perform a mock data mapping exercise for a fictional HR and payroll system, documenting flows from collection through deletion

Apply a four-tier classification scheme to 15 sample data elements and justify each tier assignment in one sentence

Translate the classification tiers into baseline security controls per tier, covering storage, transmission, and access

Diagram a defense-in-depth architecture showing network segmentation, logging, and monitoring layers

Select and justify cryptographic primitives for data at rest, data in transit, and data in use, naming the algorithm family and key length rationale

Explain symmetric versus asymmetric encryption trade-offs and where envelope encryption fits in a cloud architecture

Design a key management lifecycle covering generation, distribution, rotation, storage, retirement, and destruction

Describe how a hardware security module or cloud KMS enforces separation of duties and auditability for key operations

Identify three common cryptography implementation failures (for example nonce reuse, weak randomness, hard-coded keys) and the control that prevents each

Compare authentication factors and select an appropriate multi-factor approach for three user populations with different risk profiles

Design a role-based access control model with at least five roles and demonstrate least privilege and separation of duties

Draft an incident response runbook with detection, triage, containment, eradication, recovery, and post-incident review stages

Determine breach notification obligations for two scenarios, specifying who must be notified, within what timeframe, and with what content

Outline forensic evidence handling steps that preserve integrity, including chain of custody and hashing of acquired images

Run a tabletop breach exercise on paper, walking a fictional ransomware scenario through every runbook stage and recording decisions

Write the four required elements of a regulator notification and a plain-language individual notification for the tabletop scenario

Build a vendor risk tiering model with due diligence questions, contractual clauses, and ongoing monitoring cadence per tier

Assess transfer mechanisms for a vendor hosting data in another jurisdiction, including supplementary safeguards and transfer impact analysis

Draft contract clauses covering breach notification timelines, subprocessor approval, audit rights, and data return or deletion

Apply privacy by design and by default to a new feature, documenting data minimization, purpose limitation, and retention decisions at design time

Conduct a mock data protection impact assessment for a high-risk processing activity, scoring likelihood and severity of harms

Evaluate privacy risks in at least two emerging technologies (for example AI model training on personal data, or biometric authentication) and propose mitigations

Design privacy-enhancing techniques such as pseudonymization, aggregation, or differential privacy into a data analytics use case

Review an AI or analytics pipeline for automated decision-making transparency and human review requirements

Re-score all nine domains against week 1 and close the three largest remaining gaps with targeted review

Complete a timed 60-question mixed practice set and analyze every error by domain and by failure type (knowledge gap versus misread)

Rehearse explaining five core concepts aloud in under two minutes each to test recall without notes

Consolidate all prior deliverables into one indexed study binder with a one-page quick-reference sheet per domain