CIPP/C study plan

Map the constitutional and statutory foundations of Canadian privacy law, distinguishing federal PIPEDA jurisdiction from provincial substantially-similar regimes in Quebec, Alberta, British Columbia, and the health-sector statutes in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia

Trace PIPEDA's ten fair information principles to their legislative text and articulate how each principle constrains organizational conduct from collection through disposal

Differentiate personal information, business contact information, work product information, and anonymous data, and identify which categories attract statutory obligations

Sequence the knowledge and consent requirements in PIPEDA, including when knowledge and consent can be implied and when express consent is required

Analyze the Privacy Commissioner of Canada's OPC guidance on consent and breach reporting against the statutory text of PIPEDA

Compare Quebec's Law 25 obligations, including privacy officer designation, confidentiality by default, and portability, against PIPEDA baseline requirements

Identify the investigative, audit, and order-making powers held by the OPC and provincial commissioners, noting which regulators can issue binding orders versus recommendations

Interpret the reasonable-expectation-of-privacy test as applied in leading Canadian case law and explain how it changes organizational obligations

Apply the mandatory breach reporting and record-keeping regime, including the real risk of significant harm threshold and the reportable-breach categories set out in the Breach of Security Safeguards Regulations

Draft the notification content that must reach affected individuals and the Privacy Commissioner, and specify the 24-month retention obligation for breach records

Evaluate the OPC's compliance and enforcement toolkit, including audit findings, compliance agreements, and Federal Court applications

Assess how the OPC applies the Personal Information Protection and Electronic Documents Act to cross-border transfers and service providers

Examine enforcement trends in OPC investigation reports and Federal Court privacy decisions, extracting the recurring compliance failures regulators penalize

Distinguish the roles of the OPC, the Competition Bureau, and sector regulators where privacy and consumer protection overlap

Define the scope, governance, and reporting lines of a privacy program, including the accountability principle's requirement to designate an individual responsible for compliance

Draft a privacy program charter that assigns ownership across legal, IT security, marketing, and HR functions

Construct a data inventory and classification scheme that distinguishes personal information, sensitive information, and non-personal data across business processes

Build a privacy impact assessment process aligned with the OPC's PIA guidance, including triggers, thresholds, and mitigation tracking

Design a consent management approach that captures purpose, scope, and withdrawal across digital and offline channels

Establish a third-party due diligence and contract-clause framework covering transborder data flows and service providers

Develop role-based privacy training content and a completion-tracking method that satisfies the accountability principle

Design key performance and key risk indicators for a privacy program, including complaint volume, access-request turnaround, and training completion rates

Draft an access-request workflow that meets PIPEDA timelines, fee rules, and permissible exemptions

Create an incident log structure that supports the 24-month breach record-keeping requirement and trend analysis

Operationalize the access and correction process, including identity verification, fee estimates, extension notices, and refusal grounds with written reasons

Apply retention and disposal schedules consistent with purpose limitation and legal hold requirements

Integrate privacy into procurement, marketing, and analytics workflows through privacy-by-design checkpoints

Prepare a regulator-facing response package for an OPC audit or investigation, including document production and interview readiness

Synthesize all four domains into a consolidated outline that links each statutory requirement to a program control and an enforcement consequence

Complete timed practice sets weighted to the 25 percent per-domain distribution and review every missed item against source text

Rehearse explaining the PIPEDA-to-provincial interplay, breach reporting thresholds, and PIA triggers aloud to confirm recall under time pressure

Identify remaining weak areas and schedule targeted review of the specific sections and guidance documents still uncertain