CDPSE study plan

Map the privacy engineering domain into its component activities: requirements elicitation, privacy-by-design integration, technical controls, and validation/testing

Explain how privacy requirements are derived from legal obligations, data classification, and business process analysis, and translate one obligation into a technical requirement

Compare privacy-enhancing technologies (PETs) such as pseudonymization, tokenization, differential privacy, homomorphic encryption, and secure multi-party computation by use case and limitation

Draft a build-versus-buy decision note for a privacy control (for example consent management or data discovery) listing evaluation criteria

Design a privacy-by-design and default review checklist that a solution architect could apply at design review

Specify functional and non-functional privacy requirements for a sample customer-facing application, including data minimization, retention, and access controls

Describe how consent, preference, and rights-request workflows are implemented technically and where they touch downstream systems

Identify logging, monitoring, and evidence artifacts that demonstrate a privacy control is operating

Trace a record through collection, use, sharing, retention, and disposal stages and identify the engineering control at each stage

Define data classification tiers and specify handling rules for each tier, including test and analytics environments

Explain de-identification, anonymization, and pseudonymization differences and assess re-identification risk for a described dataset

Design retention and deletion logic that handles backups, archives, derived data, and third-party copies

Build a records-of-processing inventory template and populate it for two distinct processing activities

Connect governance structures (roles, accountability, policy hierarchy) to the technical controls they authorize and oversee

Explain how privacy program metrics and reporting flow from engineering evidence to governance oversight

Draft a data retention schedule for three data categories with justification tied to purpose and legal basis

Perform a privacy risk assessment on a described processing activity using a likelihood-by-impact method and document mitigating controls

Distinguish privacy risk from information security risk and explain where the two assessments overlap and diverge

Map common legal and regulatory obligations to the controls that satisfy them, without overstating jurisdiction-specific conclusions

Design a third-party/vendor privacy due diligence questionnaire and scoring approach

Assemble a privacy governance framework outline covering policy, roles, training, monitoring, and incident escalation

Describe how a data protection impact assessment is scoped, triggered, and reviewed, and when engineering input is required

Explain the components of a privacy incident response process and the engineering evidence needed for investigation and notification decisions

Define audit and assurance activities that test control design and operating effectiveness

Integrate all four domains into a single end-to-end scenario walkthrough from business request to control evidence

Identify weak links where governance intent fails to reach engineering implementation and propose fixes

Practice scenario-based question analysis: extract the requirement, eliminate distractors, and justify the best answer

Time-box and complete a mixed set of practice scenarios under exam-like pacing

Revisit every weak area logged during weeks 1-7 and close each gap with a written explanation in your own words

Rehearse concise definitions for core terms across all four domains without referring to notes

Complete a final timed mixed practice run and analyze every incorrect or uncertain response

Finalize a one-page pre-exam summary sheet organized by domain weighting