CIPT study plan

Map each major web and mobile technology (cookies, local storage, web beacons, embedded SDKs, browser fingerprinting signals) to the personal data it exposes and to who can observe it

Distinguish first-party, third-party, session, and persistent tracking mechanisms by building a comparison table from memory, then correcting it against source material

Explain in plain language how client-side versus server-side processing changes what a user and a third party can actually see

Define 25 core technology-vocabulary terms in your own words in a running glossary

Trace one user request end to end (browser, network, application, database, logs, backups) and annotate every point where personal data is created, stored, or shared

Identify the privacy touchpoints in a product development lifecycle and name an accountable owner for each

Summarize in writing how the technology professional coordinates with legal, security, and privacy stakeholders, including when to escalate

Contrast privacy by design with privacy by default using two concrete product examples you can defend aloud

Translate five sample product requirements into testable privacy requirements with explicit acceptance criteria

Apply the data lifecycle (collection, use, sharing, retention, deletion) to one system and flag the gaps at each stage

Select and justify a de-identification or pseudonymization approach for three different data sets, stating the re-identification risk you accept

Draft three negative test cases that would catch a privacy requirement being silently violated

Build a reusable privacy review checklist and run it against a feature you know well

Compare at least three privacy design patterns and state the conditions under which each one fails

Write the escalation path a technology professional follows when an engineering constraint conflicts with a privacy requirement

Draft the finding-and-remediation section of a review memo, ranked by user impact

Classify common attack categories (injection, credential compromise, tracking-based collection, inference and re-identification) by the privacy harm each produces

Match each threat to at least two neutralizing controls and assign a residual-risk rating with a stated rationale

Explain how encryption, hashing, tokenization, and aggregation differ and when each is the right tool

Assess the privacy impact of a breach scenario that involves application logs and backups, not just the primary database

Analyze how IoT telemetry, mobile app permissions, and cloud architectures each produce a distinct data-protection challenge

Evaluate the privacy implications of an AI/ML pipeline across data sourcing, training, inference, and model leakage

Identify the points where notice and consent break down technically, including third-party SDK chains and dark patterns

Argue both sides of one contested trade-off (for example, personalization versus data minimization) in writing

Revisit every item in your error and remediation log and rewrite each concept from memory without notes

Explain cross-border data transfer mechanics (cloud regions, sub-processors, vendor chains) at a level a legal colleague can act on

Map each of the five domains to the day-to-day decisions a technology professional actually makes

Draft the ten questions you would ask a product team before a launch

Take two full-length timed practice sets and log every incorrect answer by domain and by error type (knowledge gap, misread, or guess)

Rewrite your 20 weakest concepts as flashcards and drill them to full recall

Simulate answering three scenario-style questions aloud in under 90 seconds each, then tighten the wording

Re-verify your weakest two domains against source material one final time