CDPSE 國際認可證書課程

DOMAIN 1: PRIVACY GOVERNANCE (GOVERNANCE, MANAGEMENT & RISK MANAGEMENT)

• Identify the internal and external privacy requirements specific to the organization's governance and risk management programs and practices.
• Participate in the evaluation of privacy policies, programs and policies for their alignment with legal requirements, regulatory requirements and/or industry best practices.
• Coordinate and/or perform privacy impact assessments (PIA) and other privacy-focused assessments.
• Participate in the development of procedures that align with privacy policies and business needs.
• Implement procedures that align with privacy policies.
• Participate in the management and evaluation of contracts, service levels and practices of vendors and other external parties.
• Participate in the privacy incident management process.
• Collaborate with cybersecurity personnel on the security risk assessment process to address privacy compliance and risk mitigation.
• Collaborate with other practitioners to ensure that privacy programs and practices are followed during the design, development and implementation of systems, applications and infrastructure.
• Develop and/or implement a prioritization process for privacy practices.
• Develop, monitor and/or report performance metrics and trends related to privacy practices.
• Report on the status and outcomes of privacy programs and practices to relevant stakeholders.
• Participate in privacy training and promote awareness of privacy practices.
• Identify issues requiring remediation and opportunities for process improvement.

DOMAIN 2: PRIVACY ARCHITECTURE

• Coordinate and/or perform privacy impact assessment (PIA) and other privacy-focused assessments to identify appropriate tracking technologies and technical privacy controls.
• Participate in the development of privacy control procedures that align with privacy policies and business needs.
• Implement procedures related to privacy architecture that align with privacy policies.
• Collaborate with cybersecurity personnel on the security risk assessment process to address privacy compliance and risk mitigation
• Collaborate with other practitioners to ensure that privacy programs and practices are followed during the design, development and implementation of systems, applications and infrastructure.
• Evaluate the enterprise architecture and information architecture to ensure it supports privacy by design principles and considerations.
• Evaluate advancements in privacy-enhancing technologies and changes in the regulatory landscape.
• Identify, validate and/or implement appropriate privacy and security controls according to data classification procedures.

DOMAIN 3: DATA LIFECYCLE

• Identify the internal and external privacy requirements relating to the organization's data lifecycle practices.
• Coordinate and/or perform privacy impact assessments (PIA) and other privacy-focused assessments relating to the organization’s data lifecycle practices.
• Participate in the development of data lifecycle procedures that align with privacy policies and business needs.
• Implement procedures related to data lifecycle that align with privacy policies.
• Collaborate with other practitioners to ensure that privacy programs and practices are followed during the design, development and implementation of systems, applications and infrastructure.
• Evaluate the enterprise architecture and information architecture to ensure it supports privacy by design principles and data lifecycle considerations.
• Identify, validate and/or implement appropriate privacy and security controls according to data classification procedures.
• Design, implement and/or monitor processes and procedures to keep the inventory and dataflow records current.

The course content above may change at any time without notice in order to better reflect the content of the examination.

1 Privacy governance (governance, management & risk management)
1.1 Governance
1.1.1 Personal Data and Information
1.1.1.1 Defining Personal Data and Personal Information
1.1.1.1.1 Personal data
1.1.1.1.2 Personal information
1.1.1.1.3 Personal datum
1.1.1.1.4 Data subject
1.1.1.1.5 Sensitive personal data or sensitive data
1.1.1.1.6 Personally identifiable information (PII)
1.1.2 Privacy Laws and Standards Across Jurisdictions
1.1.2.1 Privacy Protection Legal Models
1.1.2.1.1 Comprehensive model
1.1.2.1.2 Sectoral model
1.1.2.1.3 Co-regulatory model
1.1.2.1.4 Self-regulatory model
1.1.2.2 Privacy Laws and Regulations
1.1.2.3 Privacy Standards
1.1.2.4 Privacy Principles and Frameworks
1.1.2.5 Privacy Self-Regulation Standards
1.1.3 Privacy Documentation
1.1.3.1 Types of Documentation
1.1.3.1.1 Privacy Notice
1.1.3.1.2 Consent Form
1.1.3.1.3 Privacy Policies
1.1.3.1.4 Privacy Procedures
1.1.3.1.5 Corrective Action Plan (CAP)
1.1.3.1.6 System of Record Notice (SORN)
1.1.3.1.7 Personal Information Inventory
1.1.4 Legal Purpose, Consent and Legitimate Interest
1.1.4.1 Legal Purpose
1.1.4.2 Consent
1.1.4.3 Legitimate Interest
1.1.5 Data Subject Rights (with Control-P and Communicate-P)
1.2 Management
1.2.1 Roles and Responsibilities Related to Data
1.2.2 Privacy Training and Awareness
1.2.2.1 Content and Delivery
1.2.2.2 Training Frequency
1.2.2.3 Measuring Training and Awareness
1.2.3 Vendor and Third-Party Management
1.2.3.1 Legal Requirements
1.2.3.2 Management Procedures
1.2.4 Audit Process
1.2.5 Privacy Incident Management
1.3 Risk Management
1.3.1 Risk Management Process
1.3.2 Problematic Data Actions Affecting Privacy
1.3.2.1 Vulnerabilities
1.3.2.2 Problematic Data Actions
1.3.2.3 Privacy Harms and Problems
1.3.3 Privacy Impact Assessment (PIA)
1.3.3.1 Established PIA Methodologies
1.4 Conclusion of this chapter

2 Privacy architecture
2.1 Infrastructure
2.1.1 Self-managed and cloud-based Infrastructure
2.1.1.1 Non-Cloud Alternatives to On-premises Centers
2.1.1.2 Key Privacy Concerns
2.1.2 Cloud Computing
2.1.2.1 Cloud Data Centers / Cloud Types
2.1.2.2 Five Essential Characteristics of Cloud Computing
2.1.2.3 Cloud Service Models
2.1.2.4 Shared Responsibility Model
2.1.2.5 Advantages of Cloud Computing
2.1.2.6 Limitation/concerns of Cloud Computing
2.1.3 Endpoints
2.1.3.1 Approaches to Endpoint Security
2.1.4 Remote Access
2.1.4.1 Virtual Private Networks (VPN)
2.1.4.1.1 Issues
2.1.4.1.2 Risks
2.1.4.2 Desktop Sharing
2.1.4.2.1 Issues and Risks
2.1.4.3 Privileged Access Management (PAM)
2.1.5 System Hardening
2.2 Applications and Software
2.2.1 Secure Development Life Cycle
2.2.1.1 Privacy and the Phases of the Secure Development Life Cycle
2.2.1.2 Privacy By Design
2.2.2 Application and Software Hardening
2.2.2.1 Best Practices for Hardening
2.2.3 APIs and Services
2.2.3.1 APIs
2.2.3.2 Web Service
2.2.4 Tracking Technologies
2.2.4.1 Types of Tracking Technologies
2.2.4.1.1 Cookies
2.2.4.2 Tracking Pixels
2.2.4.3 Digital Fingerprinting/Browser Fingerprinting
2.2.4.4 GPS Tracking
2.2.4.5 Radio Frequency Identification (RFID)
2.3 Technical Privacy Controls
2.3.1 Communication and Transport Protocols
2.3.2 Types of Communication Protocols
2.3.2.1 Types of Communication Protocols
2.3.2.2 Local Area Network (LAN)
2.3.2.2.1 LAN Topologies and Protocols
2.3.2.2.2 LAN Components
2.3.2.3 TCP/IP Internet World Wide Web Services
2.3.2.3.1 Port number
2.3.2.3.2 DNS and DNS poisoning (DNS Spoofing)
2.3.2.3.3 Sender Policy Framework (SPF)
2.3.2.3.4 Wireless Local Area Networks
2.3.2.4 Transport Layer Security
2.3.2.5 Secure Shell (SSH)
2.3.3 Encryption, Hashing and De-identification
2.3.3.1 Encryption
2.3.3.1.1 Symmetric Algorithms
2.3.3.1.2 Asymmetric Algorithms
2.3.3.1.2.1 Asymmetric encryption algorithm in SSH
2.3.3.1.3 Quantum Cryptography
2.3.3.2 De-identification (Pseudonymization, k-anonymization)
2.3.3.3 Hashing
2.3.3.3.1 Message Integrity and Hashing Algorithms
2.3.3.3.2 Digital Signatures and nonrepudiation
2.3.3.3.3 Digital Envelope
2.3.3.4 Applications of Cryptographic Systems
2.3.3.4.1 IP Security (IPSec)
2.3.3.4.2 Secure Multipurpose Internet Mail Extensions (S/MIME)
2.3.4 Key Management
2.3.4.1 Certificates
2.3.4.2 Public Key Infrastructure (PKI)
2.3.5 Monitoring and Logging
2.3.5.1 Monitoring
2.3.5.2 Logging
2.3.5.3 Privacy and Security Logging
2.3.6 Identity and Access Management
2.3.6.1 System Access Permission
2.3.6.2 Mandatory and Discretionary Access Controls (MAC and DAC)
2.3.6.3 Information Security and External Parties
2.3.6.3.1 Identification of Risk Related to External Parties
2.3.6.4 Human Resources Security and Third Parties
2.3.6.4.1 Screening
2.3.6.4.2 Removal of Access Rights
2.4 Conclusion of this chapter

3 Data lifecycle
3.1 Data Purpose and Data Management Maturity Model
3.1.1 Data Inventory and Classification
3.1.1.1 Data Inventory
3.1.1.1.1 Creating a Data Inventory
3.1.1.1.1.1 Plan
3.1.1.1.1.2 Decide
3.1.1.1.1.3 Populate
3.1.1.1.1.4 Publish
3.1.1.2 Data Classification
3.1.2 Data Quality
3.1.2.1 Data Quality Dimensions
3.1.3 Data Flow and Usage Diagrams
3.1.3.1 Data Flow Diagram
3.1.3.2 Usage Diagrams/Activity diagram
3.1.3.2.1 Introduction
3.1.3.2.2 Key features
3.1.3.2.3 Benefits of Usage or Activity Diagrams
3.1.3.2.4 Common symbol and nodes
3.1.3.2.5 Integrated example of Usage or activity diagrams
3.1.3.3 Data Flow Diagram vs Usage Diagrams
3.1.3.4 Data Lineage
3.1.4 Data Use Limitation
3.1.5 Data Analytics
3.1.5.1 User Behavior Analytics (UBA), SQL injection
3.2 Data Persistence and data modeling
3.2.1 Data Persistence and Data Retention
3.2.2 Data modeling
3.2.3 Data Minimization
3.2.4 Data Migration
3.2.4.1 Data Conversion
3.2.4.2 Refining the Migration Scenario
3.2.4.2.1 Fallback (Rollback) Scenario
3.2.4.3 Post-Data Migration
3.2.5 Data Storage and Tokenization
3.2.6 Data Warehousing
3.2.6.1 Extract, Transform, Load (ETL)
3.2.6.1.1 Staging Layer
3.2.6.1.2 Presentation Layer
3.2.6.2 Additional Considerations
3.2.7 Data Retention and Archiving
3.2.8 Data Destruction
3.2.8.1 Data Anonymization
3.2.8.2 Deletion
3.2.8.3 Crypt-shredding
3.2.8.4 Degaussing
3.2.8.5 Destruction
3.3 Conclusion of this chapter

4 Further readings
4.1 Key points of GDPR
4.2 ISO/IEC 27000 series standards
4.3 Data normalization
4.4 Development, test, staging, and production environments (DTSP)
4.5 Federated Identity Management (FIM)
4.6 OWASP Top Ten
4.7 CSRF (Cross-Site Request Forgery)