I85PREP
⌘ K
CPPA study materials
CPPA study resources

CPPA: Privacy Program Governance and Accountability

CPPA · Work through your exam, one topic at a time.

All guide sections

Privacy Program Governance and Accountability

This domain tests whether you can design the machinery that makes compliance repeatable: roles, records, risk assessments, training, monitoring and reporting. Items often ask "what should the privacy office do first" or "which artefact evidences accountability."

Core elements

  • Accountability (GDPR Articles 5(2), 24) requires demonstrable compliance, not intent: policies, records, training logs, DPIAs and audit trails.
  • DPO (Articles 37–39): mandatory where processing is carried out by a public authority, where core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal data. The DPO monitors compliance, advises, and acts as contact point for the supervisory authority; they must be independent and report to the highest management level. The DPO is not personally liable for the organisation's non-compliance.
  • Records of processing (Article 30): controllers and processors each maintain records; the under-250-employee exemption is narrow and does not cover risky or regular processing.
  • DPIA (Article 35): required for high-risk processing, including large-scale profiling, systematic monitoring, large-scale special category data and new technologies. Include a description, necessity assessment, risks and mitigations; consult the supervisory authority if residual risk stays high.
  • Operating model: RACI, privacy champions, role-based training, vendor onboarding gates, DSAR and incident workflows, metrics, board reporting.
  • Frameworks: NIST Privacy Framework (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P) and ISO/IEC 27701 as an extension to 27001.

Worked example

A 400-person telehealth company asks what to build first. Start with an inventory of processing and a ROPA, because DPIA scoping, retention and vendor contracts all depend on knowing what data exists. Then assess whether a DPO is mandatory - likely yes, given large-scale health data - adopt a DPIA procedure with explicit triggers, and establish training and vendor review cadences.

Traps that cost marks

  • Assuming a DPO can simultaneously hold a conflicting role such as head of marketing or IT.
  • Thinking processors need no ROPA.
  • Treating a DPIA as a one-page checklist completed after launch.
  • Confusing policy existence with accountability; evidence of operation matters.
  • Appointing a DPO without independence, resources or management access.