CIPM key terms

A documented plan that links an organization's privacy objectives to its business goals, setting out where to invest, which risks to accept, and how privacy will be governed over a multi-year horizon.

A short aspirational statement describing the future state the organization wants to reach with respect to privacy, used to motivate staff and guide long-term decisions.

A statement of what the privacy function does day to day, covering its purpose, scope, and primary responsibilities, and translating the vision into a concrete mandate.

A formal document that authorizes the privacy program, defines its scope, assigns accountability, and secures the resources and executive backing needed to operate.

The structure of decision rights, committees, roles, and reporting lines that determines who sets privacy policy, who implements it, and who oversees compliance.

The amount and type of privacy risk an organization is willing to accept in pursuit of its objectives, expressed as qualitative or quantitative thresholds that guide decisions.

The organized set of policies, standards, controls, roles, and processes that together define how an organization manages privacy consistently across business units.

A high-level statement, approved by senior management, of the organization's commitment and principles for handling personal data; it sets direction and is mandatory.

A document that translates the privacy policy into specific, measurable requirements, such as retention periods or encryption rules, that teams must meet without prescribing step-by-step tasks.

A structured register describing what personal data an organization holds, why it holds it, where it came from, who it is shared with, and how long it is kept.

A scheme that groups data by sensitivity and business value so that handling rules, access controls, and protection requirements can be applied consistently.

A structured review, done before or during a project, that identifies privacy risks to individuals, evaluates their likelihood and severity, and defines mitigations.

The broader process of identifying, analyzing, and evaluating privacy risks across the organization and deciding how to treat them in line with the stated risk appetite.

An approach that builds privacy protections into systems, processes, and products from the outset rather than adding them after development is complete.

A responsibility matrix that labels each privacy activity as Responsible, Accountable, Consulted, or Informed, clarifying who does the work and who owns the outcome.

A designated role responsible for advising on privacy obligations, monitoring compliance, and acting as a contact point for regulators and data subjects where law requires it.

A cross-functional oversight body, usually chaired by the privacy leader, that sets priorities, resolves escalations, and monitors program performance on behalf of executives.

A rule set specifying how long each category of personal data is kept and what happens at the end of that period, such as deletion or archiving.

The process of assessing, contracting with, and monitoring vendors and partners that handle personal data, including due diligence, contract terms, and ongoing oversight.

A sequenced plan of projects, milestones, owners, and timelines that moves the organization from its current privacy state to the target state.

A request from an individual to exercise privacy rights such as access, correction, deletion, or objection; it must be verified, logged, and answered within legal deadlines.

The systems and processes for capturing, recording, honoring, and withdrawing an individual's permission to process their data, including preference records and audit trails.

A legal tool, such as standard contractual clauses, an adequacy decision, or binding corporate rules, that allows personal data to move to another jurisdiction lawfully.

Documented procedures for detecting, containing, investigating, and reporting a personal data breach, including assigned roles, escalation paths, and notification timelines.

A recurring set of role-based learning activities that build employee knowledge of privacy obligations and reinforce the desired data handling behaviors.

The structured methods used to help people adopt new privacy processes and behaviors, addressing communication, training, resistance, and reinforcement of the change.

An independent, evidence-based examination of whether privacy controls and processes are designed and operating as intended across the organization.

A metric that shows how well privacy activities are being executed, such as the percentage of staff trained or the share of requests answered on time.

A forward-looking metric that signals rising privacy risk, such as a growing number of unclassified data stores or increasing failures in third-party assessments.

A comparison of the current privacy program against a target framework, law, or standard that identifies missing or weak controls requiring action.

The practice of sampling and examining evidence to confirm that a privacy control is actually working in practice, not merely documented on paper.

A structured evaluation that rates the program against progressive levels of capability, from ad hoc to optimized, in order to guide improvement planning.

A tracked list of remediation steps, owners, and deadlines created in response to audit findings, incidents, or assessment gaps, with follow-up until closure.

A senior leader who provides authority, budget, and visible support for the privacy program and removes organizational obstacles that would otherwise slow it down.

The messages and behaviors of senior leaders that signal how seriously privacy is taken, shaping whether staff follow privacy rules in everyday practice.

Employees embedded in business units who receive extra training and act as local points of contact, promoting sound privacy practices among their colleagues.

Regular, concise updates to the board or one of its committees on privacy risk, program performance, and emerging issues, enabling informed oversight and resourcing decisions.

A plan defining audiences, messages, channels, and timing for privacy communications, ensuring consistent and effective engagement with stakeholders across the organization.