IAPP Certified Information Privacy Professional/Asia (CIPP-A) Exam Syllabus

• Political structure

- Social attitudes toward privacy and data protection
- Surveillance and identification
- Constitutional protections
- Common law protections
- Sector-specific protections

• PDPA predecessor: National Internet Advisory Committee (NIAC) 2002 Report, Report on a Model Data Protection Code for the Private Sector.
• Extraterritorial reach
• PDPA definitions
  - Personal data
  - ‘Business contact information’
  - ‘Data intermediary’
  - Publicly available
  - Survivorship
• Do Not Call Registry
  - ‘Specified message’
• PDPA in an employment setting
• Exemptions
  - Public-sector
  - Response to emergency
  - National interest
  - Investigations in legal proceedings
  - Evaluative purposes
  - Journalism and media

- Key concepts and practices

• Data protection officer
• Staff training
• Consent and exceptions to consent
• Use
• Disclosure
• Safeguarding/Security
• Accountability and openness
• Access and correction
• Retention and deletion
• Transfer out (e.g. APEC, CBPR and PRP)
• Data breach notification obligation

• Regulations and guidances
• ‘Notices on Prevention of Money Laundering and Countering the Financing of Terrorism’
• Individual’s access and rights
• Protection of customer data
• Outsourcing

- Personal Data Protection Commission (PDPC)
- Decision in appealed commissioner rulings, complaints

• Complaint-based vs. audit-based

- Commissioner guidance and published positions
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Penalties and sanctions
- Policy development and implementation

• Freedom of information legislation
• Data transfers: doctrine of privity of contract for thirdparties

• Meaning under PDPO
  - Personal data
  - Publicly available data
  - Sensitive personal data
  - ‘Prescribed consent’
  - Rights of data subject
• Personal Data (Privacy) (Amendment) Ordinance 2012
  - ‘The New Guidance on Direct Marketing’
• Major Exemptions
  - Staff planning and Employment related (including Personal References)
  - Relevant process (Evaluation)
  - Crime, etc.
  - Legal proceedings, etc.
  - Legal professional Privilege and Self-incrimination
  - Health and Emergency
  - Statistics and Research
  - Journalism and news media

- Key concepts and practices

• Six Data Protection Principles (DPPs) and the Internet Data Guidance
  - DPP1: Data Collections
  - DPP2: Accuracy and retention
  - DDP3: Data Use
  - DPP4: Data security
  - DPP5: Openness
  - DPP6: Data access and correction
• Due diligence exemption and exercise
• Guidance on Personal Data Erasure and Anonymisation
• Guidance on employment matters
• Data Transfer/Export, Ordinance Section 33
  - Data processors
  - Model contracts

• Octopus Rewards Ltd.

- Decisions in appealed commissioner rulings, complaints
- Personal Data (Privacy) Advisory Committee
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Enforcement notice
- Policy development and implementation

• Law reform proposals for third-party benefit exception

- Privacy incidents: trends in commissioner expectations

• Political structure

- Social attitudes toward privacy and data protection
- Surveillance and identification

• Credit Information Companies (Regulation) Act 2005

- Constitutional protections

• Article 21
• The Right to Information Act 2005
• The Protection of Human Rights Act 1993

- Common law protections (e.g. 2017 Supreme Court judgment on the Right to privacy - Puttaswamy judgment)
- Information Technology Act 2000 (IT Act) and Information Technology
Amendment Act 2008 (ITAA)

• Right to access information about personal data
• Right to correction and erasure of personal data
• Right of grievance redressal
• Right to nominate other individuals to act on their behalf
• Right to withdraw consent
• Children’s data
• Exemptions
  - Processing of publicly available personal data
  - Processing of personal data for research/statistical purpose (i.e., training AI)
  - Research, archiving and statistical purposes
  - Judicial, investigation, mergers & acquisitions purposes
  - Non-digital data

- DPDPA Rules

• Privacy notices and consent: Rules 3-4
• Exemptions for state agencies to process personal data: Rule 5
• Security safeguards and notification procedures for data breaches: Rules 6-7
• Retention period and erasure of personal data: Rule 8
• Contact info for Data Protection Officer: Rule 9
• Parent/guardian consent, consent exemptions for children: Rules 10-11
• Annual data protection impact assessments, audits: Rule 12
• Right to access, correct, delete personal data: Rule 13
• Regulating cross-border transfer of personal data: Rule 14
• Exemptions for research purposes: Rule 15
• Data Protection Board setup, Board appeal process: Rules 16-21
• Allows government to request information from Data Fiduciaries for purposes in the Seventh Schedule: Rule 22
• Information Technology (Intermediary Guidelines and DigitalMedia Ethics Code) Rules 2021

- The Ministry of Communication and Information Technology
- The Department of Electronics and Information (DeitY)
- The Telecom Regulatory Authority of India (TRAI) and Do Not Call Registry

• Banning Free Basics and Net Neutrality

- Data Protection Board
- Commissioner rulings, appeals and complaints
- Penalties and sanctions

• DPDPA Chapter VIII

- Commissioner guidance and published positions
- Grievance officers
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Policy development and implementation

• Data transfers: doctrine of privity of contract for third-parties

- Public-sector exemption

• National identity systems
  - SingPass
  - HKID
  - India’s UIDAI
• Legislation
• Hong Kong: PCPD Code of Practice on Identity Card Number and Other Personal Identifiers, 1997

- Data processing and export
- Intermediaries
- Extraterritorial operations

• Hong Kong
  - Chinese central government organisations
  - Media
• Singapore
  - Public-sector
  - Public authorities
  - Publicly available information
  - ‘Public agency’
  - Business contracted by Singapore government
• India
  - Public sector
  - Public authorities
  - Publicly available information
  - Section 17(3): Specific businesses especially exempted by government, such as ‘startups’