CPPA study guide
CPPA · Work through your exam, one topic at a time.
The Certified Privacy and Data Protection Analyst (CPPA) is a professional credential aimed at practitioners who work with privacy operations day to day rather than at the policy-architecture level. Typical candidates include privacy analysts, compliance coordinators, data protection officers building out a programme, security and IT staff who handle personal data, and legal or risk professionals moving into a privacy-adjacent role. The CPPA study guide has 7 sections and about 3,372 words.
01Privacy and Data Protection Foundations
The Foundations domain tests the vocabulary every later domain depends on: what counts as personal data, who decides why it is processed, and how privacy differs from security and confidentiality. Items are usually definition matching, role identification in a short scenario, and "which principle or framework applies" questions.
433 words, about 2 min02Global Privacy Laws and Regulatory Frameworks
The Global Laws domain tests whether you can map a fact pattern onto the right statute, identify the regulator and the transfer mechanism, and spot when more than one regime applies. Expect scenario questions such as "which law applies to a Singapore company monitoring EU users," "what is the maximum fine," and "which mechanism permits this transfer." GDPR (EU) 2016/679 : extraterritorial under Article 3 - establishment-based processing, or targeting or monitoring EU data subjects.
446 words, about 2 min03Data Protection Principles and Lawful Processing
The Principles and Lawful Processing domain tests whether you can apply Article 5-style principles to a processing activity and select a defensible lawful basis. Questions typically present a business initiative and ask which principle is at risk, which basis fits, or whether a DPIA is required.
411 words, about 2 min04Data Subject Rights and Consent Management
This domain tests the operational side of privacy: recognising each right, running a request within the statutory clock, verifying identity without over-collecting, and applying exceptions correctly. Consent items test validity, granularity, withdrawal and children's data.
425 words, about 2 min05Privacy Program Governance and Accountability
This domain tests whether you can design the machinery that makes compliance repeatable: roles, records, risk assessments, training, monitoring and reporting. Items often ask "what should the privacy office do first" or "which artefact evidences accountability." Accountability (GDPR Articles 5(2), 24) requires demonstrable compliance, not intent: policies, records, training logs, DPIAs and audit trails.
406 words, about 2 min06Security Safeguards
This domain tests whether you can select and justify technical and organisational measures proportionate to risk, and explain how security supports privacy obligations. Expect questions on Article 32, encryption, access control and the security-privacy boundary.
406 words, about 2 min07Incident Response and Breach Notification
This domain tests the clock, the threshold and the audience. You must distinguish an incident from a notifiable breach, calculate the 72-hour window from awareness, and know what each notification must contain.
845 words, about 4 min