CDPSE case studies

CDPSE · Put your knowledge to work in context.

The Certified Data Privacy Solutions Engineer (CDPSE) is an ISACA credential that validates expertise in implementing privacy-by-design principles into existing and future systems, networks and applications. It is aimed at technical professionals - security practitioners, engineers, architects and privacy or compliance staff - who work cross-functionally to engineer privacy solutions that are ethical and human centered. The CDPSE case studies are 5 cases and about 3,963 words.

The Privacy Scorecard Standoff at a Regional Health Insurer

You are the first chief privacy officer at a regional health insurer with 2.4 million members and six business units, each with its own general counsel liaison. The board audit committee has asked for a quarterly privacy risk score for every unit, rolled into one board-level number.

824 words, about 4 min 2

Prioritizing DPIAs Before a Peak-Season Personalization Launch

You are the privacy risk lead at an online retailer with 18 million customers. Marketing plans to launch a personalization engine in six weeks that combines browsing history, purchase history, and precise location to rank offers and send push notifications.

799 words, about 4 min 3

Erasure Requests Meet Immutable Backups and a US Litigation Hold

You are the privacy operations lead at an HR SaaS provider serving 900 enterprise clients across 14 countries, holding about six million employee records. The retention schedule says terminated employee records are kept for seven years for tax purposes.

800 words, about 4 min 4

The Analytics SDK That Phones Home

You are the privacy engineer for a fitness app with five million monthly active users on iOS and Android. A third-party analytics SDK collects the advertising identifier, precise location every 30 seconds, and the contact list during onboarding.

767 words, about 4 min 5

Data Room Diligence in a Cross-Border Acquisition

Your company is acquiring a fintech with 1.2 million users in the EU and Brazil. Diligence finds that consent records are stored as screenshots, about 60% of privacy notices are outdated, seven of 22 vendor contracts lack data processing terms, and the target's primary cloud region is in the United States.

773 words, about 4 min