ICDL Data Protection (ICDL) study plan

Define the core data protection vocabulary (personal data, data subject, controller, processor, processing) in your own words

Distinguish controllers from processors using five short workplace scenarios

List the main categories of personal data and identify which are treated as sensitive or special-category

Explain the foundational principles of lawful processing and match each principle to a concrete example

Explain the lawful bases for processing and select an appropriate basis for six sample activities

Describe what consent requires to be valid and identify three invalid consent examples

Outline the purpose-limitation and data-minimisation principles and apply them to a mock form

Summarise accountability and privacy-by-design obligations in a short written note

Map the lifecycle of personal data through a sample organisation from collection to deletion

Draft a short privacy notice that covers purpose, basis, retention, and rights

Identify where a data protection impact assessment would be required and list its key sections

Describe the role of a data protection officer and when one must be appointed

Explain each individual right (access, rectification, erasure, restriction, portability, objection) and the typical response timeline

Draft a template response to a subject access request

Describe obligations around international transfers and list two safeguards

Compare the roles of controller, processor, and DPO in handling a rights request

Identify technical and organisational security measures appropriate to three risk scenarios

Distinguish pseudonymisation from anonymisation with worked examples

Explain access-control and least-privilege principles in a workplace context

List common causes of personal data breaches across people, process, and technology

Define a personal data breach and classify three examples by severity

Describe the breach notification workflow including who to notify and within what timeframe

Draft an internal breach report form covering detection, containment, and remediation

Explain the role of a breach log and post-incident review

Summarise the compliance obligations of controllers and processors under the applicable framework

Explain the consequences of non-compliance and the role of supervisory authorities

Describe how records of processing and accountability documentation are maintained

Evaluate three short case vignettes for compliance gaps and recommend fixes

Consolidate all four domains into a single concept map linking principles, rights, security, and breach handling

Complete two timed full-length practice sets and score above 80 percent

Review and correct every missed question with a written explanation of the correct reasoning

Rehearse explaining five key concepts aloud as if training a colleague