EXIN PIPL Foundation study plan

Define the key terms of the PRC Personal Information Protection Law (PIPL), including personal information, sensitive personal information, processor, and handling, in your own words

Identify the scope of application of PIPL, covering territorial scope, extraterritorial reach, and exceptions

Differentiate between personal information and anonymized information, and explain the legal consequences of each

Outline the structure of PIPL and locate the provisions that correspond to each of the four exam domains

Explain the categories of sensitive personal information and the stricter rules that apply to them

Compare the legal bases for processing personal information, including consent, contract necessity, legal duty, public interest, and others

Describe the requirements for valid consent under PIPL, including informed, voluntary, and explicit consent

Analyze scenarios where consent is not the appropriate legal basis and justify an alternative

Apply the rules for processing sensitive personal information, including separate consent and impact assessments

Outline the conditions for processing personal information of minors under 14 and the role of guardians

Explain the requirements for cross-border transfer of personal information and the available mechanisms

Evaluate a given processing activity against the legal basis and consent requirements, identifying compliance gaps

List the individual rights of personal information subjects under PIPL and explain the scope of each

Describe the process for handling a data subject request, including verification, timelines, and response format

Distinguish between the rights to access, copy, correct, delete, and withdraw consent, and identify when each applies

Explain the conditions under which a processor may refuse a request and the limits on such refusal

Analyze the right to explanation and the right to obtain a copy of personal information in the context of automated decision-making

Outline the obligations of personal information processors regarding transparency, privacy policies, and notification

Describe the requirements for appointing a personal information protection officer and establishing internal governance

Explain the rules on personal information protection impact assessments (PIPIAs) and when they are mandatory

Detail the obligations for data breach notification, including internal reporting, notification to authorities, and notification to individuals

Explain the rules on entrusting processing to third parties and the required contractual safeguards

Describe the accountability measures, including records of processing, training, and audits

Identify the penalties for non-compliance and the factors that aggravate or mitigate liability

Synthesize all four domains by mapping each PIPL obligation to the corresponding individual right and legal basis

Solve at least 30 practice questions spanning all domains, and review incorrect answers to identify weak areas

Create flashcards for key articles and definitions, and use them to test recall

Revisit the terminology sheet and comparison tables from earlier weeks, updating them with new insights

Complete a full-length timed mock exam under exam conditions

Review all incorrect answers and write a brief explanation for why the correct answer is correct

Re-read the summary sheet and flashcards daily to reinforce memory

Simulate explaining PIPL concepts to a colleague to test depth of understanding