CPPA case studies
CPPA · Put your knowledge to work in context.
The Certified Privacy and Data Protection Analyst (CPPA) is a professional credential aimed at practitioners who work with privacy operations day to day rather than at the policy-architecture level. Typical candidates include privacy analysts, compliance coordinators, data protection officers building out a programme, security and IT staff who handle personal data, and legal or risk professionals moving into a privacy-adjacent role. The exam tests breadth across the privacy lifecycle: foundational concepts and terminology, the global regulatory landscape, lawful processing and data protection principles, handling data subject requests and consent, governance and accountability structures, security safeguards and breach response, and the risk that comes with vendors, cross-border transfers, and emerging technology. Expect scenario-based multiple choice and multiple response items that ask you to apply a rule to a messy fact pattern rather than recite a definition. The CPPA case studies are 5 cases and about 3,514 words.
1Analytics and Session Replay Rollout Across EU and Brazil
Cartograph is a B2B workforce-analytics SaaS with 8,000 EU users and 2,000 Brazilian users. Product wants to turn on session replay and behavioral analytics.
711 words, about 4 min2Employee DSAR Covering Investigation File, CCTV, and Loyalty Data
Priya has worked in store operations at Northwind Retail for four years and is also a loyalty member. She emails the privacy office demanding 'every piece of data you hold about me' within 30 days.
733 words, about 4 min3Ransomware at a Clinic Network With Unconfirmed Exfiltration
Aster Care runs 14 outpatient clinics in the US and Ireland. On a Friday, ransomware encrypts the billing server.
728 words, about 4 min4EU-to-US-to-India Transfer After a Stale TIA
Helio Analytics GmbH in Berlin provides HR benchmarking. It transfers employee survey data to its US parent, Helio Inc., and to a subprocessor in Pune, India.
688 words, about 3 min5Forty Subsidiaries, Twelve DPOs, and an AI Training Plan
Verdant Group is a consumer-goods company with 40 subsidiaries, 6,000 employees, and operations in the EU, UK, US, and Singapore. It has no central record of processing activities; each subsidiary uses its own spreadsheet.
654 words, about 3 min