EXIN PDPF study plan
EXIN PDPF · Give each week a clear focus.
8 weeks · About 6 hours per week
Basics of the Personal Information Protection Law
Outline the scope and structure of China's Personal Information Protection Law (PIPL), listing its chapters and the subject matter each covers.
Define the core terms 'personal information', 'personal information processing', 'sensitive personal information', and 'anonymization' in your own words from memory.
Distinguish PIPL's territorial and extraterritorial reach, including the conditions that trigger application outside China.
Map the relationship between PIPL and adjacent regimes (Data Security Law, Cybersecurity Law, Civil Code personality rights) at a conceptual level.
Your checkpoint
A one-page terminology and scope sheet covering at least 12 defined terms with your own one-sentence definitions and the article reference for each.
Basics of the Personal Information Protection Law
Explain the legal bases for processing personal information and state which bases require separate consent.
Describe the principles governing processing (lawfulness, legitimacy, necessity, good faith, minimization, transparency, accuracy, accountability).
Summarize the rights granted to individuals and the corresponding handler obligations for each right.
Identify the roles and duties of the national and departmental regulators that supervise personal information protection.
Your checkpoint
A legal-basis decision table with at least 7 processing scenarios, the applicable basis for each, and whether separate consent is required.
Processing of Personal Information
Trace the full lifecycle of a processing activity from collection through storage, use, transfer, and deletion, noting the compliance checkpoint at each stage.
Explain the rules for processing sensitive personal information, including the additional conditions and impact assessment requirement.
Describe the requirements for privacy notices and the elements that must be disclosed to individuals.
Differentiate consent, separate consent, and written consent, and give an example scenario for each.
Your checkpoint
A lifecycle checklist of at least 15 compliance checkpoints organized by processing stage, each with a one-line rationale.
Processing of Personal Information
Analyze the rules on cross-border transfer of personal information, including the available transfer mechanisms and when each applies.
Explain the role of the personal information protection impact assessment: when it is triggered, what it must cover, and how long records are kept.
Describe the obligations that apply when entrusting processing to a third party and when sharing information with separate handlers.
Compare the handling of deceased persons' information and of information on minors under 14.
Your checkpoint
A cross-border transfer scenario write-up (minimum 400 words) choosing the correct transfer mechanism for three distinct fact patterns and justifying each choice.
Ensuring Personal Information is Protected
List the organizational measures a personal information handler must adopt, including designation of a responsible person and internal rules.
Describe the technical safeguards expected for storage, access control, encryption, and de-identification.
Outline the breach response workflow from detection to notification of authorities and affected individuals.
Explain the purpose and required content of the regular compliance audit.
Your checkpoint
A breach response runbook with a timeline of required actions, notification content items, and the decision rule for whether individuals must be informed.
Ensuring Personal Information is Protected
Summarize the enforcement powers of regulators, including inspection, interview, and document production demands.
Catalog the legal liabilities under PIPL: civil, administrative, and criminal, with the types of penalties for each.
Explain the aggravated liability provisions for serious violations and the personal liability of responsible individuals.
Describe how a handler can demonstrate accountability to a regulator during an investigation.
Your checkpoint
A liability matrix matching at least 8 violation types to their administrative consequences and any personal liability exposure.
Basics of the Personal Information Protection Law & Processing of Personal Information & Ensuring Personal Information is Protected
Rehearse all three domains with timed practice sets, scoring each domain separately.
Diagnose your weakest two sub-topics from practice results and re-study them against the source text.
Practice applying articles to short fact patterns rather than reciting them.
Build a personal error log classifying each miss as knowledge gap, misreading, or terminology confusion.
Your checkpoint
A scored practice summary showing per-domain accuracy and an error log of at least 20 entries with a correction note for each.
Basics of the Personal Information Protection Law & Processing of Personal Information & Ensuring Personal Information is Protected
Complete at least two full-length timed mock exams under exam conditions.
Review every missed item from the mocks and close remaining gaps in your error log.
Recite the key article numbers and their subject matter for the highest-frequency topics.
Finalize a one-page pre-exam review sheet you can read in 20 minutes.
Your checkpoint
A final one-page review sheet plus a mock-exam score trend showing improvement from week 7 to week 8.
Milestones
Week 2: You can state every legal basis for processing from memory and correctly say which ones require separate consent, scoring at least 80% on a self-made 15-item quiz.
Week 4: You can explain the cross-border transfer mechanisms and the impact assessment trigger conditions without notes, and your scenario write-up is internally consistent on all three fact patterns.
Week 6: You can map a described violation to the correct liability category and penalty range in under two minutes per item.
Week 8: Your two full-length mocks both score at or above your target pass threshold, with no single domain below 70% accuracy.