DPO case studies
DPO · Put your knowledge to work in context.
The DPO (Data Protection Officer) credential is a professional certification aimed at practitioners who design, operate, and oversee privacy and data protection programmes inside an organisation. It suits privacy officers, compliance and risk managers, legal and IT professionals, consultants, and anyone moving into a role where personal data handling must be governed, documented, and defended. The DPO case studies are 5 cases and about 4,039 words.
1The Retention Clock Nobody Reset
A mid-sized insurer's marketing team built a lead-capture form that writes prospects into a CRM. The privacy notice says prospect data is deleted 12 months after last contact.
822 words, about 4 min2Consent That Outlived Its Scope
A telehealth app collected consent in 2022 for "sharing your health intake data with partner clinics to coordinate your care." The consent screen listed three named clinics. In 2024, the company signed a data-sharing agreement with a national analytics vendor and began sending de-identified intake summaries - age band, condition category, ZIP3 - to that vendor for "population health insights." The company's position is that the data is de-identified, so consent is not required.
780 words, about 4 min3The Access Request That Crossed a Border
A SaaS company headquartered in the EU receives an access request from a customer's employee (a data subject) on day 1. The company is a processor for the customer, but also a controller for the employee's account and support-ticket data.
812 words, about 4 min4The Vendor That Failed Its Own Audit
A payments company uses a cloud vendor to process transaction data. The vendor's SOC 2 Type II report, dated 14 months ago, has a qualified opinion: one control (encryption key rotation) failed for a 3-month window.
837 words, about 4 min5The Model That Learned Too Much
A bank deploys an internal AI assistant trained on 10 years of customer service transcripts to help agents draft replies. Before deployment, the team removed names, account numbers, and phone numbers from the training data.
788 words, about 4 min