Privacy Governance
CDPSE Domain 1, Privacy Governance, tests whether you can describe how a privacy program is directed, resourced, and held accountable. Expect questions on roles, policy architecture, oversight bodies, third-party governance, training, and metrics-not just reciting laws.
Core rules and concepts
- Accountability sits with executive leadership. A DPO or privacy officer may advise and monitor, but the DPO must not be placed in a position that determines purposes and means of processing where independence is required.
- Use a policy hierarchy: charter or privacy policy, standards, procedures, and guidelines. Map it to a recognized framework such as the NIST Privacy Framework (Govern-P, Identify-P, Control-P, Communicate-P, Protect-P) or ISO/IEC 27701.
- Embed privacy by design and by default into project intake and gate reviews, so privacy requirements exist before design and launch.
- Govern vendors: due diligence, data processing agreements, subprocessor approval, and ongoing monitoring-not a one-time contract.
- Measure the program: training completion by role, PIAs completed before launch, DSAR timeliness, incidents, and vendor review coverage.
Worked example
A product team proposes a wellness app that collects heart-rate and mood data. Governance should require a privacy intake, assign a privacy owner, classify the data as sensitive, trigger a DPIA before build, review the consent flow, assess the cloud vendor, and report residual risk to the privacy steering committee. The reasoning: governance creates evidence of accountability before engineering choices harden.
Traps
Equating publishing a privacy policy with running a program; treating the DPO as the sole decision-maker; relying on annual training only; assuming a signed vendor contract replaces monitoring; using privacy by design as a slogan without gate criteria.