ICDL Data Protection (ICDL) study plan

Define personal data, data subject, controller, processor, and processing in your own words

Distinguish personal data from anonymous and pseudonymous data using five self-written examples

List the key principles of data protection law and match each to a one-line practical meaning

Classify six fictional scenarios as controller, processor, or joint controller

Explain the difference between the GDPR-style regime and other national data protection models at a conceptual level

Identify the categories of sensitive/special-category data and explain why they get extra protection

Describe the roles of a supervisory authority and a data protection officer

Summarize the lawful bases for processing and give one original example of each

Apply each lawful basis to a realistic processing scenario and justify the choice

Draft a valid consent request that meets clarity, specificity, and withdrawal requirements

Explain the purpose-limitation and data-minimization principles with before/after examples

Outline the conditions for a valid data processing agreement between controller and processor

Conduct a simplified data protection impact assessment for a fictional high-risk processing activity

Identify when a DPIA is required and list the minimum contents

Map the data lifecycle (collection to deletion) for one example process

List technical and organizational measures and match each to a specific risk

List each data subject right and state what it entitles the individual to do

Explain the timelines and grounds for responding to an access request

Distinguish erasure from restriction and from objection with worked examples

Describe the limits on rights, such as legal obligations and freedom of expression

Draft a response to a fictional access request within the legal deadline

Design a procedure for handling a rights request from receipt to resolution

Explain the right to data portability and when it applies

Identify what to include in a privacy notice to support rights awareness

Outline the steps for detecting, assessing, and notifying a personal data breach

State the notification deadlines and what must be reported to the authority and to data subjects

Create a records-of-processing-activity entry for one business process

Describe how to build a training and accountability program for staff

Integrate concepts, processing, rights, and implementation into a single compliance scenario

Complete a timed 40-question practice set and score at least 80%

Review every missed question and write the correct reasoning for each

Summarize the ten most testable facts across all four domains