CIPM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Privacy strategy

A long-term plan aligning privacy objectives with organizational goals, legal obligations, risk appetite, and resource priorities; it defines vision, principles, scope, governance, and measurable outcomes.

OECD privacy principles

Eight principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability; they guide fair information practices across data lifecycles.

Privacy by Design

Seven principles: proactive not reactive; privacy as default; embedded into design; full functionality; end-to-end security; visibility and transparency; and respect for user privacy.

Data lifecycle stages

Collection, use, retention, disclosure, archiving, and destruction; privacy strategy maps legal bases, controls, and retention rules to each stage.

Risk appetite statement

A formal declaration of how much privacy risk an organization is willing to accept in pursuit of its objectives; it guides treatment decisions such as avoid, mitigate, transfer, or accept.

Accountability principle

The requirement that an organization designate owners, document decisions, demonstrate compliance, and be answerable to regulators and stakeholders for personal data processing.

Purpose limitation

Personal data may be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; compatibility review is required for new uses.

Privacy program framework

The structured set of policies, roles, controls, procedures, data inventories, training, incident response, and metrics that operationalizes privacy strategy and legal obligations across the organization.

Policy hierarchy

A governance structure typically ordered as charter, policy, standard, procedure, and guideline; higher levels state mandatory requirements while lower levels provide implementation detail.

NIST Privacy Framework functions

Five core functions: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P; they organize privacy activities from risk assessment through protection and communication.

RACI matrix

A responsibility assignment tool defining who is Responsible, Accountable, Consulted, and Informed for each privacy activity; it clarifies decision rights and escalation paths.

Record of Processing Activities

An inventory documenting processing purposes, data categories, data subjects, recipients, transfers, retention periods, and security measures; it supports accountability, risk assessment, and regulatory requests.

DPIA trigger

A data protection impact assessment is required for processing likely to result in high risk, such as systematic monitoring, large-scale sensitive data, profiling, or innovative technology use.

Processor due diligence

Pre-contract and ongoing review of a vendor's security, privacy practices, subprocessors, breach notification, audit rights, and data return or deletion commitments before and during processing.

Privacy threshold analysis

An intake screening that determines whether a project collects personal data and whether a full privacy impact assessment or additional controls are required before implementation.

Consent management

Operational process for capturing, recording, honoring, and withdrawing consent, including granular choices, timestamped evidence, and linkage to processing activities.

DSAR workflow

A documented process to verify identity, locate data across systems, apply legal exemptions, respond within statutory deadlines, and record the request and outcome.

Incident response phases

Detection, containment, risk assessment, notification, remediation, and documentation; privacy incidents require evaluation of legal reporting thresholds and affected individuals.

Data minimization

Collecting and retaining only personal data that is adequate, relevant, and necessary for the specified purpose; it reduces risk and supports storage limitation compliance.

Privacy enhancing technologies

Technical measures such as encryption, pseudonymization, de-identification, differential privacy, and access controls that reduce identifiability or limit data exposure during processing.

Privacy KPI

A key performance indicator measuring program effectiveness, such as training completion, DSAR timeliness, or assessment coverage; it shows whether intended privacy outcomes are being achieved.

Privacy KRI

A key risk indicator tracking exposure or adverse trends, such as rising incident volume, overdue remediation, or high-risk vendors; it signals where risk may exceed appetite.

Control effectiveness testing

Evaluation of whether a privacy control is designed appropriately and operates consistently; it uses evidence sampling, walkthroughs, and re-performance to identify gaps.

Privacy risk register

A log of identified privacy risks with likelihood, impact, owner, treatment plan, due date, and residual risk; it supports prioritization and monitoring.

Maturity model

A staged scale, often initial, repeatable, defined, managed, and optimized, used to assess privacy program capabilities and plan improvements over time.

Three lines model

Governance structure where operations own risk, a risk or compliance function monitors it, and internal audit provides independent assurance; it clarifies accountability for privacy controls.

Stakeholder map

A visual inventory of individuals and groups affected by or influencing the privacy program, including their interests, influence, and communication needs.

Communication plan

A document specifying audiences, key messages, channels, frequency, owners, and feedback mechanisms for privacy communications; it supports consistent and timely engagement.

Tone at the top

Executive leaders' visible commitment to privacy through decisions, resourcing, and messaging; it shapes organizational culture and employee behavior toward data protection.

ADKAR change model

A change management sequence: Awareness, Desire, Knowledge, Ability, and Reinforcement; each element must be addressed for privacy process adoption to succeed.

Board privacy reporting

Periodic executive reporting on privacy risk posture, incidents, regulatory changes, program metrics, and resource needs; it enables governance and informed oversight.

Crisis communication protocol

Predefined roles, approval paths, spokesperson rules, notification timelines, and message templates for privacy incidents; it supports accurate and timely communication with stakeholders and regulators.