CIPP/E study plan

Sequence the foundational instruments - Council of Europe Convention 108, the 1980 OECD Guidelines, Directive 95/46/EC, the EU Charter Articles 7 and 8, the Lisbon Treaty Article 16, and the GDPR - on a single timeline with adoption and application dates

Explain in writing why the Charter and Article 16 TFEU gave the EU a dedicated competence to legislate on data protection

Distinguish the material and territorial building blocks of the GDPR from the older directive regime, naming three concrete changes

Define the GDPR's core vocabulary (personal data, processing, controller, processor, pseudonymisation, anonymisation) in your own words without notes

Map the GDPR's chapter structure and state which chapter governs principles, rights, controller obligations, transfers, and supervision

Apply each of the Article 5 principles to a hypothetical processing operation and identify which principle is at risk

Compare all six Article 6 lawful bases, selecting the correct one for eight short scenarios and justifying each choice

Determine when Article 9 special category data and Article 10 criminal offence data are in play, and list the applicable lifting conditions

Evaluate the validity of consent under Articles 4(11), 7 and 8, including the conditions for child consent in online services

Trace a data subject request through Articles 12 to 22, specifying timeframes, permitted extensions, and grounds for refusal

Differentiate controller from processor obligations across Articles 24 to 29, including joint controllership

Draft the mandatory contents of a Record of Processing Activities under Article 30 for two contrasting business units

Decide when a Data Protection Impact Assessment is required under Article 35 and outline its minimum content

Sequence the Article 33 and 34 breach notification steps, including the 72-hour deadline and the risk threshold for notifying data subjects

Design accountability artefacts - policies, training records, and audit trails - that evidence compliance with Article 5(2) and Article 24

Apply data protection by design and by default under Article 25 to a new product feature and document the design changes

Select appropriate technical and organisational measures under Article 32 for three risk profiles and justify each selection

Determine when a DPO must be designated under Article 37 and describe the position and tasks set out in Articles 38 and 39

Distinguish codes of conduct under Article 40 from certification under Article 42 as accountability tools

Outline the competences, independence and powers of supervisory authorities under Articles 51 to 59

Explain the one-stop-shop mechanism and the consistency mechanism, including when the EDPB issues a binding decision

Classify administrative fines into the two Article 83 tiers and match sample infringements to the correct tier and cap

Analyse the remedies available to data subjects under Articles 77 to 82, distinguishing compensation from administrative complaint

Compare GDPR obligations with the ePrivacy Directive and the Law Enforcement Directive in the electronic communications and public-security contexts

Map the Chapter V transfer routes and state the conditions under which each may be relied on

Evaluate an adequacy decision under Article 45 and explain what happens when adequacy is withdrawn or under review

Select the correct 2021 Standard Contractual Clauses module for four transfer scenarios and identify the clauses requiring completion

Explain the effect of the Schrems II judgment on transfers and how it changes the role of Standard Contractual Clauses

Describe the Binding Corporate Rules approval path under Article 47 and the derogations available under Article 49

Apply the Article 3 territorial scope test, including the targeting and monitoring criteria, to six organisations

Determine when onward transfers under Article 44 require a fresh legal basis

Distinguish the occasional-and-non-repetitive derogation from the compelling-legitimate-interests derogation and state their limits

Identify public-sector and employment-context constraints that narrow the available transfer mechanisms

Reconcile transfer obligations with the Article 5 principles and the accountability requirement

Complete a full-length timed mock examination covering all four domains under exam conditions

Diagnose weak areas from the mock results and rank them by expected score impact

Re-drill the ten most frequently missed concepts using spaced repetition

Consolidate cross-domain linkages, particularly how transfers, rights and accountability intersect in a single fact pattern