ICS CDPP study guide
ICS CDPP · Work through your exam, one topic at a time.
The ICS Certified Data Protection Professional (CDPP) is a professional credential for practitioners who handle privacy and data protection compliance in an operational or advisory role: privacy officers, compliance and risk staff, legal and IT professionals moving into privacy work, and consultants supporting client compliance programmes. The syllabus is organised around seven domains: data protection law and regulatory frameworks; principles and lawful bases for processing; data subject rights and consent management; privacy governance, accountability and programme management; impact assessments and risk management; breach management and incident response; and international transfers. The ICS CDPP study guide has 7 sections and about 2,056 words.
01Data Protection Law and Regulatory Frameworks
A privacy professional must distinguish instruments (statutes, regulations, directives, guidance) from regulators (supervisory authorities) and from standards (ISO, NIST) that are not law. Know the difference between a regulation (directly applicable in all member states) and a directive (requires national implementing law).
298 words, about 1 min02Data Protection Principles and Lawful Bases for Processing
Master the core principles: lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability . For each processing activity, identify a lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests) and, where sensitive data is involved, a separate special-category condition .
297 words, about 1 min03Data Subject Rights and Consent Management
Know the rights: information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making . Understand timelines (typically one month, extendable), verification of identity , manifestly unfounded or excessive requests, and permitted exemptions (legal claims, crime, confidentiality).
278 words, about 1 min04Privacy Governance, Accountability, and Program Management
Accountability requires demonstrable, not merely intended, compliance. Know the building blocks: policies and standards, records of processing activities (ROPA), privacy roles (DPO or privacy lead), training and awareness, privacy by design, vendor management, monitoring and audit, and metrics .
287 words, about 1 min05Data Protection Impact Assessments and Risk Management
A DPIA is a structured risk assessment for processing likely to result in high risk to individuals. Triggers include systematic and extensive evaluation, large-scale special-category data, systematic monitoring of a publicly accessible area , and novel technologies.
305 words, about 2 min06Data Breach Management and Incident Response
A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data. Know the three types: confidentiality, integrity, availability .
306 words, about 2 min07International Data Transfers and Cross-Border Compliance
A transfer occurs when personal data is sent to, or made accessible from, another jurisdiction, including remote access. Understand the transfer mechanisms : adequacy decisions , standard contractual clauses , binding corporate rules , certification codes , and derogations (explicit consent, contract necessity, important public interest, legal claims).
285 words, about 1 min