ICS CDPP case studies
ICS CDPP · Put your knowledge to work in context.
The ICS Certified Data Protection Professional (CDPP) is a professional credential for practitioners who handle privacy and data protection compliance in an operational or advisory role: privacy officers, compliance and risk staff, legal and IT professionals moving into privacy work, and consultants supporting client compliance programmes. The syllabus is organised around seven domains: data protection law and regulatory frameworks; principles and lawful bases for processing; data subject rights and consent management; privacy governance, accountability and programme management; impact assessments and risk management; breach management and incident response; and international transfers. The ICS CDPP case studies are 5 cases and about 3,748 words.
1The Marketing List That Outlived Its Consent
A UK retailer's CRM holds 1.2 million contacts. 410,000 were captured at in-store sign-up between 2019 and 2021 on a paper form whose wording read: 'We may share your details with carefully selected partners for marketing.' No separate opt-in box existed; the form was collected with a purchase.
726 words, about 4 min2The 71-Hour Breach Clock
At 16:40 on Friday a SaaS provider's on-call engineer notices anomalous queries against a multi-tenant customer database. Investigation shows an API token belonging to a contractor's laptop was used from an unfamiliar IP.
791 words, about 4 min3The DPIA That Was Signed Off in a Day
A financial-services firm plans to deploy an AI model that scores loan applicants and auto-declines the bottom 15%. The model is trained on five years of historical application data including postcode, age band, and prior repayment history.
668 words, about 3 min4The Support Team That Could See Everything
A US-headquartered software company runs a single global support desk in Manila. EU and UK customers' tickets routinely contain personal data - sometimes special-category data pasted into free-text fields.
776 words, about 4 min5The Retention Policy Nobody Enforced
A mid-sized insurer's data retention schedule says customer records are kept for '7 years after the end of the relationship, or as required by law'. In practice: (a) the CRM never deletes anything because no deletion job was built; (b) a legacy claims system holds records from 2009; (c) marketing preferences are stored in a spreadsheet owned by one team member; (d) the privacy notice says records are kept 'only as long as necessary'.
787 words, about 4 min