EXIN PDPP study plan

Define core privacy concepts (personal data, processing, controller, processor, data subject) in your own words and map each to a concrete example from your own workplace

Distinguish privacy from data protection and from information security, and explain why the three are not interchangeable

List the processing operations that most commonly trigger legal obligations (collection, storage, sharing, deletion) and rank them by risk

Identify the main categories of legal instrument that govern privacy (statutes, regulations, self-regulatory codes, case law) and give one example of each

Outline the structure of a comprehensive data protection statute: scope, definitions, principles, lawful bases, data subject rights, obligations, enforcement

Explain each lawful basis for processing and match it to a scenario where it would and would not apply

Describe the roles and responsibilities of controller versus processor and where liability attaches

Summarise the conditions that make processing of special-category or sensitive data lawful

Compare how two different jurisdictions structure their privacy law and note where obligations diverge

Enumerate data subject rights and state the response timeframe and any permitted exceptions for each

Trace the obligations that attach to international data transfers and identify the safeguards that legitimise them

Explain the notification duties that arise after a personal data breach, including who must be told and when

Describe how enforcement works in practice: complaints, investigations, corrective orders and fines

Identify the accountability instruments a regulator expects to see (records, assessments, policies)

Apply the privacy principles (lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity, accountability) to a described processing activity

Diagnose which principle is breached in 10 short scenarios and justify each answer

Explain the relationship between risk, harm and the proportionality of safeguards

Summarise how privacy principles are operationalised through privacy by design and by default

Conduct a data protection impact assessment on a realistic high-risk project and document necessity and proportionality

Draft a privacy notice that satisfies transparency requirements for a specified audience

Design a consent capture and withdrawal flow that meets the conditions for valid consent

Apply data minimisation and retention limits to a dataset and justify each field retained

Respond to a simulated data subject access request within the legal deadline, including redaction reasoning

Build a breach response runbook covering detection, containment, assessment, notification and post-incident review

Evaluate a vendor agreement for processor obligations and identify missing clauses

Design technical and organisational measures for a given dataset and map each measure to the risk it reduces

Assign accountability across an organisation using a RACI matrix covering the privacy function, IT, HR, marketing and procurement

Draft the elements of a privacy programme: policy set, training, records of processing, monitoring and audit

Design metrics that demonstrate programme effectiveness rather than activity volume

Explain how to evidence compliance to a regulator or auditor using documentation you would actually hold

Consolidate all four domains into a single revision sheet of no more than two pages

Complete two full-length timed practice exams and score each against the domain weightings

Re-teach your three weakest topics aloud or in writing without notes

Verify every exam-logistics detail: format, duration, question types and identification requirements