CIPM cheat sheet

Strategy outputs include vision, principles, scope, risk appetite, priorities, governance model, resourcing plan, and measurable outcomes.

OECD FIPPs are collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability.

Privacy by Design's seven principles are proactive not reactive, privacy as default, embedded into design, full functionality, end-to-end security, visibility and transparency, and respect for user privacy.

The data lifecycle is collection, use, retention, disclosure, archiving, and destruction; each stage requires a lawful basis, a control, and an owner.

Risk treatment options are avoid, mitigate, transfer, and accept; residual risk is compared with the documented risk appetite.

GDPR Article 5 principles are lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Strategy inputs include legal and regulatory obligations, business model, data inventory, threat landscape, stakeholder expectations, and maturity assessment.

Decision rule: a new use incompatible with the specified purpose requires a new legal basis or compatibility assessment before processing.

Accountability requires named owners, documented decisions, evidence of compliance, and escalation paths to executive leadership.

Framework components include policy hierarchy, roles and RACI, data inventory and ROPA, controls, procedures, training, incident response, vendor management, and metrics.

Policy hierarchy: charter to policy to standard to procedure to guideline; upper levels are mandatory, and lower levels provide implementation detail.

NIST Privacy Framework functions are Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P.

RACI means Responsible performs the work, Accountable owns the outcome, Consulted gives input, and Informed receives updates.

ROPA fields include purpose, data categories, data subjects, recipients, cross-border transfers, retention period, security measures, and legal basis.

A DPIA is triggered by high-risk processing such as systematic monitoring, large-scale sensitive data, profiling, or innovative technology.

Privacy by default sets the most privacy-protective settings as the initial state for products and processes.

Processor contract terms include scope, security, subprocessors, breach notification, audit rights, assistance with data subject requests, and return or deletion.

Control crosswalks map obligations from laws and frameworks, such as GDPR, NIST, and ISO 27701, to specific implemented controls.

Implementation sequence: plan, design controls, deploy, train, operate, monitor, and improve.

Project intake uses a privacy threshold analysis to screen for personal data and determine whether a DPIA or additional controls are needed.

Consent operations capture granular choices, timestamps, source, scope, and withdrawal; consent records must be retrievable.

DSAR process: verify identity, locate data, apply exemptions, respond within the statutory deadline, and retain evidence.

Incident response: detect, contain, assess risk, notify if the threshold is met, remediate, and document lessons learned.

Data minimization at collection and purpose limitation at use are enforced through forms, access controls, and system configuration.

Retention schedules define triggers for deletion or archiving; automated enforcement reduces storage-limitation risk.

Vendor onboarding includes privacy and security review, contract clauses, subprocessor approval, and periodic reassessment.

Privacy-enhancing technologies include encryption, pseudonymization, de-identification, differential privacy, and access controls.

KPI measures effectiveness, KRI measures risk exposure, and KCI measures compliance status.

Privacy risk equals likelihood times impact; the register records owner, treatment, due date, and residual risk.

Control testing distinguishes design effectiveness from operating effectiveness and relies on evidence sampling.

Common maturity levels are initial, repeatable, defined, managed, and optimized.

Monitoring sources include DSAR volume and timeliness, incident metrics, training completion, vendor assessments, and audit findings.

DPIA review is triggered by changed processing, new technology, new law, or a material incident.

Audit types include internal self-assessment, independent internal audit, external audit, and regulator inquiry.

Reporting cadence: operational metrics monthly, leadership quarterly, and board annually or upon material incidents.

Continuous improvement follows plan-do-check-act: set objectives, implement, measure, and adjust controls.

A stakeholder map records interests, influence, impact, and preferred communication channel for each audience.

Communication plan fields include audience, message, channel, frequency, owner, approval path, and feedback mechanism.

Tone at the top is demonstrated through executive decisions, resourcing, and visible privacy messaging.

The ADKAR change model is Awareness, Desire, Knowledge, Ability, and Reinforcement.

Board reporting covers risk posture, material incidents, regulatory changes, program metrics, and resource needs.

A crisis communication protocol defines spokesperson, approval chain, notification timelines, and message templates.

Escalation decision rule: high or critical privacy risks go to the executive owner within the defined SLA.

Role-based training targets different audiences such as developers, marketers, HR, and incident responders.

Privacy champion networks distribute accountability and improve local adoption across business units.