IAPP CIPP/CN study plan

Map the full hierarchy of PRC data protection instruments (CSL, DSL, PIPL, Data Security Law, plus implementing regulations and national standards) and state which instrument governs which obligation.

Define and distinguish core statutory terms: personal information, sensitive personal information, processing, processor, entrusted processing, separate consent, and anonymization versus de-identification.

Outline the PIPL's legal bases for processing and explain when separate consent is required versus ordinary consent.

Draft a one-page glossary of 20 terms with the statutory source for each definition.

Explain the individual rights regime under PIPL (access, copy, correction, deletion, portability, explanation) and the timelines and conditions attached to each.

Describe the obligations attaching to sensitive personal information, including separate consent, impact assessment, and notification duties.

Summarize the rules on automated decision-making and targeted push delivery, including the opt-out and non-discrimination requirements.

Compare PIPL consent standards with the notice-and-choice model you may know from other jurisdictions and list three practical divergences.

Identify the regulators in the Chinese system (CAC and its local counterparts, MIIT, SAMR, MPS, PBOC for financial data) and state each one's enforcement jurisdiction.

Trace the enforcement tools available: rectification orders, warnings, fines, suspension of service, and the serious-violation penalty structure including percentage-of-turnover fines.

Outline the personal information protection impact assessment (PIPIA) trigger list and required contents.

Analyze two publicly reported enforcement actions and identify which obligation was breached and which penalty tier applied.

Explain the accountability and designated-representative obligations for processors, including the appointment of a person in charge of personal information protection.

Describe breach notification duties: what triggers notification, to whom, within what timeframe, and what the notice must contain.

Summarize data security obligations that intersect with personal information processing, including classification and grading duties.

Build a compliance checklist that a mid-size company could use to self-assess against the enforcement priorities you have studied.

Draft a compliant privacy notice structure covering the required disclosure items under PIPL.

Design a consent capture and withdrawal workflow, including separate consent for sensitive information and for cross-border transfer.

Produce a data mapping template that records processing purpose, legal basis, retention period, recipients, and transfer mechanism.

Explain how to operationalize data subject requests, including identity verification and response timelines.

Compare the three cross-border transfer mechanisms: CAC security assessment, certification by a professional institution, and standard contractual clauses, and state the thresholds that select each.

Explain the data localization requirements for critical information infrastructure operators and for processors meeting volume thresholds.

Describe the role of the standard contract filing requirement and what must be submitted.

Assess how a multinational should structure intra-group transfers to satisfy both Chinese requirements and its home-jurisdiction obligations.

Explain the interplay between PIPL and the Data Security Law and Cybersecurity Law when a dataset is both personal and important data.

Describe the restrictions on providing data to foreign judicial or law enforcement bodies and the approval route.

Summarize the rules on data export security assessment, including what the assessment evaluates and how long the result remains valid.

Identify three gray areas where practice is unsettled and state what a conservative compliance posture would be.

Consolidate all four domains into a single one-page mental model linking law, regulator, obligation, and transfer mechanism.

Complete a timed 60-question practice set and categorize every miss by domain and by failure type (knowledge gap versus misread).

Re-drill only the weak areas identified, targeting at least 80 percent accuracy on the second pass.

Rehearse explaining the three transfer mechanisms aloud in under three minutes each.