US DPO study plan
US DPO · Give each week a clear focus.
8 weeks · About 6 hours per week
US Privacy Landscape and Legal Foundations
Map the federal privacy statutes (FTC Act, GLBA, HIPAA, COPPA, FCRA, VPPA, ECPA) to their sector and enforcement agency
Explain the legal significance of the FTC's unfairness and deception authority for privacy compliance
Distinguish federal preemption and sectoral gaps that leave room for state law
Identify the constitutional and common-law privacy torts that underpin US privacy claims
Your checkpoint
A one-page matrix listing each federal statute, its sector, its regulator, and one enforcement example, scored at 80% or better on a self-quiz.
Sectoral and State Privacy Laws
Compare the CCPA/CPRA obligations for notice, opt-out, and service provider contracts
Contrast the scope and thresholds of five major state comprehensive privacy laws (e.g., VA, CO, CT, UT, TX)
Identify sectoral state laws that overlay general privacy statutes, such as biometric and health data rules
Map state breach-notification triggers to the incident-response domain for later use
Your checkpoint
A comparison table of at least six state laws across applicability thresholds, consumer rights, and enforcement, with a 10-question practice set answered at 80% or better.
Data Governance and Privacy Program Management
Draft the core elements of a privacy program charter, including roles, reporting lines, and accountability
Build a data inventory template that captures purpose, legal basis, retention, and cross-border flow
Define a records-of-processing and data-classification standard consistent with US state-law definitions
Outline a privacy-by-design review gate for new products and features
Your checkpoint
A privacy program charter and a data inventory template with at least 10 sample fields, reviewed against a checklist of program-management criteria.
Data Subject Rights and Consent Management
Map consumer rights under CCPA/CPRA and other state laws to intake, verification, and fulfillment workflows
Design a consent and opt-out mechanism that satisfies global privacy control and dark-pattern restrictions
Draft a verification standard for authorized agents and sensitive-data requests
Define response timelines and escalation paths for rights requests
Your checkpoint
An end-to-end data subject rights workflow diagram with timeline and verification steps, plus a 10-question quiz at 80% or better.
Privacy Risk Assessment and Data Protection Impact Assessments
Conduct a privacy risk assessment using a recognized methodology (e.g., NIST Privacy Framework) on a sample processing activity
Distinguish a DPIA from a data-protection risk assessment and identify when each is required under US state law
Build a risk register with likelihood, impact, and mitigation fields
Apply a threshold analysis to decide whether a DPIA is triggered
Your checkpoint
A completed sample DPIA for a hypothetical high-risk processing activity, including a risk register and mitigation plan, scored against a rubric.
Cross-Border Data Transfers and Vendor Management
Evaluate cross-border transfer mechanisms relevant to US organizations, including adequacy, SCCs, and the Data Privacy Framework
Draft vendor due-diligence questions covering security, subprocessors, and breach notification
Negotiate key data protection terms in a vendor contract, such as purpose limitation and audit rights
Create a vendor tiering model based on data sensitivity and access
Your checkpoint
A vendor risk-tiering matrix and a redlined sample data processing agreement with at least five negotiated clauses explained.
Incident Response, Breach Notification, and Security Safeguards
Build a breach-response playbook with containment, assessment, notification, and remediation phases
Map state breach-notification deadlines and regulator/consumer notice requirements
Identify security safeguards required by FTC, GLBA, and HIPAA security rules
Draft a tabletop exercise scenario and facilitation guide
Your checkpoint
A breach-response playbook outline and a 30-minute tabletop exercise guide, with a post-exercise lessons-learned template.
Privacy Operations, Training, and Auditing
Design a role-based privacy training curriculum with completion metrics
Create an audit plan with sampling methodology and evidence standards
Define key privacy metrics and a reporting cadence for leadership
Assemble a full practice exam and review missed items by domain
Your checkpoint
A training and audit plan with at least five metrics, plus a timed 60-question practice exam with a domain-level score report and remediation list.
Milestones
Week 2: Score 80% or better on a 20-question quiz covering domains 1 and 2, and produce the state-law comparison table.
Week 4: Complete the DSR workflow and pass a 10-question quiz on rights and consent at 80% or better.
Week 6: Submit the vendor tiering matrix and DPIA for peer review, and score 75% or better on a mixed 30-question set covering domains 3 through 6.
Week 8: Achieve 80% or better on the full 60-question practice exam and complete all eight deliverables in the study portfolio.