US DPO study guide
US DPO · Work through your exam, one topic at a time.
The US Data Privacy Officer (DPO) Certification is a professional credential for practitioners who build and run privacy programs under United States law. It suits privacy officers, compliance managers, in-house counsel, security leads, and consultants who need to show working command of the US regulatory patchwork rather than a single statute. The US DPO study guide has 8 sections and about 2,494 words.
01US Privacy Landscape and Legal Foundations
The US privacy landscape is fragmented: no single federal comprehensive privacy statute governs all personal data. The exam checks whether you can identify the legal source that applies-constitutional, common-law, federal statute, FTC enforcement, or state law-and the enforcement body.
332 words, about 2 min02Sectoral and State Privacy Laws
This domain tests whether you can match a data type, entity, or consumer to the correct federal sectoral statute or state comprehensive law-and spot exemptions. HIPAA regulates protected health information held by covered entities (providers, plans, clearinghouses) and business associates; it does not generally cover consumer wellness apps.
338 words, about 2 min03Data Governance and Privacy Program Management
Privacy program management tests how you build accountability: governance, roles, data inventory, policies, privacy by design, and metrics that make privacy operational rather than aspirational. Governance : assign a privacy lead with authority, a steering committee, and RACI clarity among legal, security, product, marketing, HR, and procurement.
310 words, about 2 min04Data Subject Rights and Consent Management
This domain tests the operational mechanics of consumer rights and consent: scope, verification, timelines, exceptions, authorized agents, appeals, and preference signals. Common rights in state laws: know/access, delete, correct, portability, opt out of sale/share, opt out of targeted advertising, limit sensitive data, and non-discrimination.
323 words, about 2 min05Privacy Risk Assessment and Data Protection Impact Assessments
Privacy risk assessment tests when a DPIA or data protection assessment is required, how to assess likelihood and severity of harm, and how to document mitigations and residual risk. Triggers : high-risk processing such as profiling, sensitive data, systematic monitoring, large-scale data, AI inference, biometrics, or combining datasets.
299 words, about 1 min06Cross-Border Data Transfers and Vendor Management
Cross-border transfers and vendor management test whether you can map data flows, select a lawful transfer mechanism, and impose contractual and oversight controls on processors and subprocessors. US federal law has no general adequacy regime ; transfers are governed by sectoral rules, state law, and contracts.
292 words, about 1 min07Incident Response, Breach Notification, and Security Safeguards
This domain tests incident response and breach notification: how to distinguish an incident from a reportable breach, scope it, contain it, and notify within the correct deadlines and to the correct parties. Incident vs breach : an incident is any security event; a breach is unauthorized acquisition or access that triggers legal notification.
335 words, about 2 min08Privacy Operations, Training, and Auditing
Privacy operations, training, and auditing test whether privacy controls run reliably day to day: DSAR workflows, records, training, monitoring, audits, and remediation. Operations : documented procedures for intake, triage, verification, fulfillment, and closure of privacy requests; a request tracker; and SLA reporting.
265 words, about 1 min