CPPA study plan

Map the structure of the GDPR article-by-article, marking which articles govern scope, principles, lawful bases, rights, and enforcement

Distinguish controllers, processors, joint controllers, and sub-processors using at least four original fact patterns

Compare GDPR territorial scope (Article 3) with the extraterritorial reach of the CCPA/CPRA and Brazil's LGPD in a written comparison table

Define the GDPR's key terminology (personal data, processing, pseudonymization, anonymization) and test each definition against edge cases you invent

Summarize the substantive obligations of at least four non-EU frameworks (LGPD, PIPL, PIPEDA, APPI, POPIA) in a structured outline

Trace how adequacy decisions and standard contractual clauses operate as transfer mechanisms under GDPR Chapter V

Explain the roles of supervisory authorities, the EDPB, and one-stop-shop enforcement in cross-border cases

Identify enforcement trends by describing the categories of penalties regulators have actually imposed

Articulate the distinction between privacy, data protection, confidentiality, and security using original examples

Apply each GDPR Article 5 principle (lawfulness, purpose limitation, minimization, accuracy, storage limitation, integrity, accountability) to a single fictional organization

Select and justify a lawful basis for processing across six scenarios, including special-category data under Article 9

Draft a legitimate-interests assessment that satisfies the balancing-test elements

Evaluate consent validity against the conditions for freely given, specific, informed, and unambiguous consent

Compare consent with the other lawful bases and identify when consent is the wrong choice

Map each data subject right (access, rectification, erasure, restriction, portability, objection, automated decision-making) to its response deadline and exceptions

Design a consent withdrawal and refresh workflow that keeps records defensible

Build a records-of-processing-activity template and populate it for three distinct processing activities

Draft the core components of a privacy program charter covering roles, reporting lines, and budget authority

Conduct a data protection impact assessment for a high-risk processing scenario using a recognized methodology

Define privacy metrics and key performance indicators that a privacy office could report quarterly

Design a privacy training and awareness program with role-based curricula and completion tracking

Draft an incident response playbook covering detection, containment, assessment, notification, and post-incident review

Determine breach notification triggers and deadlines under GDPR, and contrast them with US state breach laws

Specify the technical and organizational measures expected under a security-of-processing obligation

Evaluate vendor due diligence artifacts and draft processor contract clauses covering instructions, sub-processors, audits, and breach assistance

Analyze cross-border transfer risk scenarios and select appropriate safeguards with documented rationale

Assess privacy risk in at least two emerging technology contexts such as AI training data or biometric authentication

Identify the privacy questions to ask before deploying a new tool that processes personal data

Synthesize all seven domains into a single concept map linking laws, principles, rights, governance, and security

Complete two full-length timed practice sets and log every missed question by domain and root cause

Re-drill the two weakest domains until practice accuracy exceeds eighty percent

Write a one-page exam-day strategy covering pacing, flagging, and handling scenario questions