# data[].attributes.body
https://iapp.org/certify/get-certified/cipm/

# data[].attributes.attachment_link.readable_text
NEW! The CIPM is now available in Chinese.

CIPM

The IAPP offers computer-based certification exams at over 6,000 testing centers worldwide.

Simply log on to the IAPP website and purchase your exam in the IAPP storefront. Once you have purchased an exam, you can decide if you would like to take your exam in person or through our remote online proctoring platform with PearsonVue. You'll get an email with step-by-step instructions telling you how. Testing is available year-round. Exam appointments must be scheduled at least 24 hours in advance.

Candidates for certification must understand that no published text can keep pace with the rapidly-changing privacy landscape. We continuously adjust our exam content to represent the latest regulatory and technological changes, and we expect candidates for IAPP certification to know about the important developments in their sector that may modify or supplant information in the authoritative texts.

# data[].attributes.attachment_link.description
NEW! The CIPM is now available in Chinese. CIPM The IAPP offers computer-based certification exams at over 6,000 testing centers worldwide. Simply log on to the IAPP website and purchase your exam in the IAPP storefront. Once you have purchased an exam, you can decide if you would like to ...

# data[].attributes.headline
(1) What are the core components under the GDPR accountability principle? 

# data[].attributes.subject
(1) What are the core components under the GDPR accountability principle? 

# data[].attributes.body
(Slide 43 / Ebook 31)

# data[].attributes.headline
(1) What is the difference between Privacy and Data Protection? 

# data[].attributes.subject
(1) What is the difference between Privacy and Data Protection? 

# data[].attributes.body
(Slide 21 / Ebook 15)

# data[].attributes.body
(Slide 292 / Ebook 260)

# data[].attributes.headline
(1) When designing privacy notice, what are the different approaches to address different challenges? 

# data[].attributes.subject
(1) When designing privacy notice, what are the different approaches to address different challenges? 

# data[].attributes.body
(Slide 346 / Ebook 314)

# data[].attributes.headline
(1) Describe the 5 Maturity levels in the AICPA/CICA Privacy Maturity Model (ARDMO). Give examples. 

# data[].attributes.subject
(1) Describe the 5 Maturity levels in the AICPA/CICA Privacy Maturity Model (ARDMO). Give examples. 

# data[].attributes.body
(Slide 173 / Ebook 154)

# data[].attributes.headline
(1) What are the 3 objectives of information security? (CIA) 

# data[].attributes.subject
(1) What are the 3 objectives of information security? (CIA) 

# data[].attributes.body
(Slide 224 / Ebook 201)

# data[].attributes.body
https://iapp.org/media/pdf/resource_center/aicpa_cica_privacy_maturity_model_final-2011.pdf

# data[].attributes.headline
(2) Under legal and compliance, what are the two types of due diligence that can be performed? 

# data[].attributes.subject
(2) Under legal and compliance, what are the two types of due diligence that can be performed? 

# data[].attributes.body
(Slide 53 / Ebook 41)

# data[].attributes.headline
(2) Name the four privacy classes and give examples for each. 

# data[].attributes.subject
(2) Name the four privacy classes and give examples for each. 

# data[].attributes.body
(Slide 22 / Ebook 16)

# data[].attributes.headline
(2) What are the 5 phases of metrics life cycle? 

# data[].attributes.subject
(2) What are the 5 phases of metrics life cycle? 

# data[].attributes.body
(Slide 295 / Ebook 263)

# data[].attributes.headline
(2) When will active delivery of privacy notice be required? 

# data[].attributes.subject
(2) When will active delivery of privacy notice be required? 

# data[].attributes.body
(Slide 348  / Ebook 316)

# data[].attributes.headline
(2) What are the key activities for assessing an organisation? 

# data[].attributes.subject
(2) What are the key activities for assessing an organisation? 

# data[].attributes.body
(Slide 175 / Ebook 156)

# data[].attributes.headline
(2) What are the different types and functions of controls to be considered when mitigating information security risks? 

# data[].attributes.subject
(2) What are the different types and functions of controls to be considered when mitigating information security risks? 

# data[].attributes.body
(Slide 227, 235  / Ebook 202, 210)

# data[].attributes.attachment_link.title
Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01)

# data[].attributes.headline
(3) Who are the stakeholders of privacy program who will hold a company accountable? 

# data[].attributes.subject
(3) Who are the stakeholders of privacy program who will hold a company accountable? 

# data[].attributes.body
(Slide 57/ Ebook 45)

# data[].attributes.headline
(3) What are considered as sensitive personal information under US jurisdiction? 

# data[].attributes.subject
(3) What are considered as sensitive personal information under US jurisdiction? 

# data[].attributes.body
(Slide 29 / Ebook 19)

# data[].attributes.headline
(3) What are the 3 types of audience for metrics? How do they differs? 

# data[].attributes.subject
(3) What are the 3 types of audience for metrics? How do they differs? 

# data[].attributes.body
(Slide 297  / Ebook 265)

# data[].attributes.headline
(3) What is the difference between privacy notice and consent? 

# data[].attributes.subject
(3) What is the difference between privacy notice and consent? 

# data[].attributes.body
(Slide 349  / Ebook 317)

# data[].attributes.headline
(3) Under GDPR, organisations are required to maintain detailed records of processing activities which is derived from data inventory and data mapping. What are the information captured by data inventory and data mapping that will contribute to the records? 

# data[].attributes.subject
(3) Under GDPR, organisations are required to maintain detailed records of processing activities which is derived from data inventory and data mapping. What are the information captured by data inventory and data mapping that will contribute to the records? 

# data[].attributes.body
(Slide 180 / Ebook 161)

# data[].attributes.headline
(3) What are the core principles in Role-based access controls? 

# data[].attributes.subject
(3) What are the core principles in Role-based access controls? 

# data[].attributes.body
(Slide 237 / Ebook 212)

# data[].attributes.body
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/

# data[].attributes.attachment_link.description
The Brexit transition period ended on 31 December 2020. The GDPR has been retained in UK law as the UK GDPR, and will continue to be read alongside the Data Protection Act 2018, with technical amendments to ensure it can function in UK law. If you transfer or receive data from overseas please visit…

# data[].attributes.headline
(4) What are the common elements in privacy vision and mission? 

# data[].attributes.subject
(4) What are the common elements in privacy vision and mission? 

# data[].attributes.body
(Slide 68 / Ebook 55)

# data[].attributes.headline
(4) What are considered as special categories of personal under European jurisdiction (GDPR)? 

# data[].attributes.subject
(4) What are considered as special categories of personal under European jurisdiction (GDPR)? 

# data[].attributes.body
(Slide 29 / Ebook 19)

# data[].attributes.headline
(4) What are the metrics that can be collected for employee's privacy training? Who is the owner of these metrics? Who collects the data? 

# data[].attributes.subject
(4) What are the metrics that can be collected for employee's privacy training? Who is the owner of these metrics? Who collects the data? 

# data[].attributes.body
(Slide 295, 298 / Ebook 263, 266)

# data[].attributes.headline
(4) What is the difference between an event, a security incident and a data breach? 

# data[].attributes.subject
(4) What is the difference between an event, a security incident and a data breach? 

# data[].attributes.body
(Slide 379 / Ebook 347)

# data[].attributes.body
(Slide 185 / Ebook 166)

# data[].attributes.headline
(4) What are the best practices in User Access Management? 

# data[].attributes.subject
(4) What are the best practices in User Access Management? 

# data[].attributes.body
(Slide 238 / Ebook 213)

# data[].attributes.body
https://www.it.northwestern.edu/policies/dataaccess.html

# data[].attributes.attachment_link.title
IT Policies, Standards, and Guidelines: Information Technology - Northwestern University

# data[].attributes.attachment_link.description
Office of the Vice President for Information Technology and Chief Information Officer Overview

# data[].attributes.headline
(5) What is the purpose of having a privacy strategy? 

# data[].attributes.subject
(5) What is the purpose of having a privacy strategy? 

# data[].attributes.body
(Slide 69 / Ebook 56)

# data[].attributes.headline
(5) What are the data protection roles? 

# data[].attributes.subject
(5) What are the data protection roles? 

# data[].attributes.body
(Slide 30 / Ebook 20)

# data[].attributes.headline
(5) What are the different types of trend analysis that can be performed on metrics such as number of access request made by customers? 

# data[].attributes.subject
(5) What are the different types of trend analysis that can be performed on metrics such as number of access request made by customers? 

# data[].attributes.body
(Slide 303 / Ebook 271)

# data[].attributes.headline
(5) When developing an incident response plan, what needs to be included? 

# data[].attributes.subject
(5) When developing an incident response plan, what needs to be included? 

# data[].attributes.body
(Slide 386 / Ebook 354)

# data[].attributes.headline
(5) During risk identification and assessment, what are the risk  factors to consider? (VET=R) 

# data[].attributes.subject
(5) During risk identification and assessment, what are the risk  factors to consider? (VET=R) 

# data[].attributes.body
(Slide 188-190 / Ebook 169-170)

# data[].attributes.headline
(5) What are the 7 core principles under Privacy By Design? (PD FEVER) 

# data[].attributes.subject
(5) What are the 7 core principles under Privacy By Design? (PD FEVER) 

# data[].attributes.body
(Slide 248 / Ebook 220)

# data[].attributes.body
https://iapp.org/media/pdf/resource_center/AWPHD-ISaccess.pdf

# data[].attributes.headline
(6) What does an organisation need to consider to determine the SCOPE of privacy program? 

# data[].attributes.subject
(6) What does an organisation need to consider to determine the SCOPE of privacy program? 

# data[].attributes.body
(Slide 69 / Ebook 56)

# data[].attributes.headline
(6) Define the role of a data controller 

# data[].attributes.subject
(6) Define the role of a data controller 

# data[].attributes.body
(Slide 30 / Ebook 20)

# data[].attributes.headline
(6) How is ROI for privacy program computed? 

# data[].attributes.subject
(6) How is ROI for privacy program computed? 

# data[].attributes.body
(Slide 304,306 / Ebook 272,274)

# data[].attributes.headline
(6) During breach response, what needs to be done to notify the appropriate parties? Who is responsible for each task? 

# data[].attributes.subject
(6) During breach response, what needs to be done to notify the appropriate parties? Who is responsible for each task? 

# data[].attributes.body
(Slide 387,388,392,393 / Ebook 355,356,360,361)

# data[].attributes.headline
(6) What are the considerations when an organisation assess vendor risks? 

# data[].attributes.subject
(6) What are the considerations when an organisation assess vendor risks? 

# data[].attributes.body
(Slide 197 / Ebook 178)

# data[].attributes.headline
(6) What are the privacy risk models and frameworks that organisation can use to identify privacy risks? 

# data[].attributes.subject
(6) What are the privacy risk models and frameworks that organisation can use to identify privacy risks? 

# data[].attributes.body
(Slide 250 / Ebook 222)

# data[].attributes.headline
IMDA Guide to Data Valuation for Data Sharing

# data[].attributes.subject
IMDA Guide to Data Valuation for Data Sharing

# data[].attributes.headline
(7) In the development of Privacy STRATEGY, how could business alignment be achieved? 

# data[].attributes.subject
(7) In the development of Privacy STRATEGY, how could business alignment be achieved? 

# data[].attributes.body
(Slide 72 / Ebook 58)

# data[].attributes.headline
(7) Define the role of a data processor 

# data[].attributes.subject
(7) Define the role of a data processor 

# data[].attributes.body
(Slide 30 / Ebook 20)

# data[].attributes.headline
(7) What are the different types of monitoring to be in place for privacy program? 

# data[].attributes.subject
(7) What are the different types of monitoring to be in place for privacy program? 

# data[].attributes.body
(Slide 307 / Ebook 275)

# data[].attributes.headline
(7) What needs to be considered for breach notification? 

# data[].attributes.subject
(7) What needs to be considered for breach notification? 

# data[].attributes.body
(Slide 394-400 / Ebook 362-368)

# data[].attributes.headline
(7) In the event of Merger, Acquisition or Divestitures, what are the privacy related considerations? 

# data[].attributes.subject
(7) In the event of Merger, Acquisition or Divestitures, what are the privacy related considerations? 

# data[].attributes.body
(Slide 200 / Ebook 181)

# data[].attributes.headline
(7) What privacy risks are covered in Solove's Taxonomy of Privacy? 

# data[].attributes.subject
(7) What privacy risks are covered in Solove's Taxonomy of Privacy? 

# data[].attributes.body
(Slide 251, 252 / Ebook 223, 224)

# data[].attributes.body
https://www.ibm.com/security/data-breach

# data[].attributes.attachment_link.readable_text
Cost of a Data Breach Report 2023 Download the report Register for the webinar

Fight back against data breaches

Be better prepared for breaches by understanding their causes and the factors that increase or reduce costs. Explore the comprehensive findings from the Cost of a Data Breach Report 2023. Learn from the experiences of more than 550 organizations that were hit by a data breach.

This report provides valuable insights into the threats that you face, along with practical recommendations to upgrade your cybersecurity and minimize losses. Take a deep dive into the report and find out what your organization is up against and how to mitigate the risks.
Schedule a session with IBM X-Force® to discuss the findings of the report

Investing now can save millions USD 4.45 million
The global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years.
51%
51% of organizations are planning to increase security investments as a result of a breach, including incident response (IR) planning and testing, employee training, and threat detection and response tools.
USD 1.76 million
The average savings for organizations that use security AI and automation extensively is USD 1.76 million compared to organizations that don't.

Gain insights from IBM X-Force experts

Get the most up-to-date information on the financial implications of data breaches. Learn how to safeguard your organization's reputation and bottom line.

Webinar The Cost of a Data Breach: Insights, Mitigators and Best Practices

Take action to help prevent breaches

Check out the recommendations based on the findings of the Cost of a Data Breach Report and learn how to better secure your organization.

Save money and time with AI and automation

Only 28% of organizations used security AI extensively, which reduces costs and speeds up containment.

Innovative technologies such as IBM Security® QRadar® SIEM use AI to rapidly investigate and prioritize high-fidelity alerts based on credibility, relevance and severity of the risk. IBM Security® Guardium® features built-in AI outlier detection that enables organizations to quickly identify abnormalities in data access.

If you need to strengthen your defenses, IBM Security® Managed Detection and Response (MDR) Services use automated and human-initiated actions to provide visibility and stop threats across networks and endpoints. With a unified, AI-powered approach, threat hunters can take decisive actions and respond to threats faster.

Protect data in the hybrid cloud

82% of breaches involved data stored in the cloud. Organizations must look for solutions that provide visibility across hybrid environments and protect data as it moves across clouds, databases, apps and services.

IBM Security Guardium helps you uncover, encrypt, monitor and protect sensitive data across more than 19 hybrid cloud environments to give you a better security posture.

IBM data security services provide you with advisory, planning and execution capabilities to secure your data, whether you're migrating to the cloud or need to secure data already in the cloud. Services include data discovery and classification, data loss prevention, data-centric threat monitoring, encryption services and more.

Uncover risky vulnerabilities

Build security into every stage of software and hardware development. Employing a DevSecOps approach and conducting penetration and application testing are top cost-saving factors in the report.

X-Force® Red is a global team of hackers hired to break into organizations and uncover risky vulnerabilities that attackers may use for personal gain. The team's offensive security services-including penetration testing, application testing, vulnerability management and adversary simulation-can help identify, prioritize and remediate security flaws covering your digital and physical ecosystem.

Know your attack surface and how to protect it

Knowing your attack surface isn't enough. You also need an incident response (IR) plan to protect it.

The IBM Security® Randori platform uses a continuous, accurate discovery process to uncover known and unknown IT assets, getting you on target quickly with correlated, factual findings based on adversarial temptation.

With X-Force® IR emergency support and proactive services, teams can test your cyberattack readiness plan and minimize the impact of a breach by preparing your IR teams, processes and controls.

Learn about security products and services

IBM Security helps protect enterprises with an integrated portfolio of products and services, infused with security AI and automation capabilities. The portfolio enables organizations to predict threats, protect data as it moves, and respond with speed and precision while allowing for innovation.

Need more details? Explore IBM Security products Learn about IBM Security services Schedule a consultation with an expert

# data[].attributes.attachment_link.description
Get the Cost of a Data Breach Report 2023 for the most up-to-date insights into the evolving cybersecurity threat landscape

# data[].attributes.headline
(8) In the development of Privacy STRATEGY, what needs to be considered for data governance of personal information ? 

# data[].attributes.subject
(8) In the development of Privacy STRATEGY, what needs to be considered for data governance of personal information ? 

# data[].attributes.body
(Slide 75 / Ebook 61)

# data[].attributes.body
(Slide 317 / Ebook 285)

# data[].attributes.headline
(8) What steps are taken when investigating a breach? 

# data[].attributes.subject
(8) What steps are taken when investigating a breach? 

# data[].attributes.body
(Slide 401 / Ebook 369)

# data[].attributes.headline
(8) What is Privacy Threshold Analysis (PTA)? 

# data[].attributes.subject
(8) What is Privacy Threshold Analysis (PTA)? 

# data[].attributes.body
(Slide 201 / Ebook 182)

# data[].attributes.headline
(8) What are the 2 privacy design strategies? 

# data[].attributes.subject
(8) What are the 2 privacy design strategies? 

# data[].attributes.body
(Slide 254 / Ebook 226)

# data[].attributes.headline
Loyola University Cloud Computing Policy

# data[].attributes.subject
Loyola University Cloud Computing Policy

# data[].attributes.body
https://www.luc.edu/its/aboutits/itspoliciesguidelines/cloud_computing_policy.shtml

# data[].attributes.attachment_link.provider_name
Loyola University Chicago - Information Technology Services (ITS)

# data[].attributes.attachment_link.readable_text
Scope

This policy applies to all persons accessing and using 3 rd party services capable of storing or transmitting protected or sensitive electronic data that are owned or leased by Loyola University Chicago, all consultants or agents of Loyola University Chicago and any parties who are contractually bound to handle data produced by Loyola, and in accordance with University contractual agreements and obligations.

Purpose

The purpose of this policy is to ensure that Loyola Protected or Loyola Sensitive data is not inappropriately stored or shared using public cloud computing and/or file sharing services. Cloud computing and file sharing, for this purpose, is defined as the utilization of servers or information technology hosting of any type that is not controlled by, or associated with, Loyola University Chicago for services such as, but not limited to, social networking applications (i.e. all social media, blogs and wikis), file storage (See Listing of Cloud Storage Services in Appendix), and content hosting (publishers text book add-ons). Acceptable and unacceptable cloud storage services are listed in the appendix. All other cloud services are approved on a case by case basis.

Reason for Policy

This policy endorses the use of cloud services for file storing and sharing 1) with vendors who can provide appropriate levels of protection and recovery for University information, and 2) with explicit restrictions on storage of University Protected Information. While cloud storage of files can expedite collaboration, and sharing of information anytime, anywhere, and with anyone, there are some guidelines that should be in place for the kind and type of university information that is appropriate for storing and sharing using these services. Even with personal use, one should be aware of the level of protection available for your data using such a cloud service.

Federal and State laws and regulations place a premium on institutions' ability to understand the risks of IT services and systems and make appropriate determinations about risk tolerance. Some cloud providers, for instance, might mine data for marketing purposes. Covered laws and regulations are listed in the Loyola University Data Classification Policy.

There are a number of information security and data privacy concerns about use of cloud computing services at the University. They include:

University no longer protects or controls its data, leading to a loss of security, lessened security, or inability to comply with various regulations and data protection laws Loss of privacy of data, potentially due to aggregation with data from other cloud consumers.

University dependency on a third party for critical infrastructure and data handling processes

Potential security and technological defects in the infrastructure provided by a cloud vendor.

University has limited-service level agreements for a vendor's services and the third parties that a cloud vendor might contract with

University is reliant on vendor's services for the security of some academic and administrative computing infrastructure.

Policy

The following table outlines the data classification and proper handling of Loyola data.

Data Classification

Cloud Storage

(See appendix for approved services)

Network Drive
(LUC ID and Password Required)

Local Storage

Loyola Protected

Not Allowed

Loyola Sensitive

Loyola Public

Use of central and departmental servers, where UVID authentication is required, is the best place to store all categories of Loyola data, particularly Loyola Protected data. Loyola Protected Data can be stored on the Loyola University Chicago instance of OneDrive provided access to the data is protected by Multi-Factor Authentication and sharing is set for "People in Loyola University Chicago with the link". It is never acceptable to store Loyola Protected data on any other cloud service. This includes data such as grades, social security numbers, private correspondence, classified research, etc.

Definitions

Loyola Protected Data - Any data that contains personally identifiable information concerning any individual and is regulated by local, state, or Federal privacy regulations.

Loyola Sensitive Data - Any data that is not classified as Loyola Protected Data, but which is information that Loyola would not distribute to the general public.

Loyola Public Data - Any data that Loyola is comfortable distributing to the general public.

General Data Protection Terms

The University must specify particular data protection terms in a contract with a cloud-computing vendor. In this way, the University creates a minimum level of security for University data. A minimum level of security ensures that the University data is kept confidential, is not changed inappropriately, and is available to the University as needed.

The University should consider the following contract terms to ensure a minimum level of information security protection:

Data transmission and encryption requirements

Authentication and authorization mechanisms

Intrusion detection and prevention mechanisms

Logging and log review requirements

Security scan and audit requirements

Security training and awareness requirements

Compliance with Legal and Regulatory Requirements

The University has many federal laws that it must follow, these include the Family Educational Rights and Privacy Act of 1974 (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), and the Gramm-Leach-Bliley Act (GLBA).

State laws may also affect a relationship with a cloud-computing vendor. For instance, the Illinois Personal Information Protection Act (IPIPA) requires that the University must follow rules about disclosing Social Security Numbers as well as specific security breach notification procedures.

NOTE: A relationship with a cloud-computing vendor may also be impacted by private industry regulations. For example, departments at the University that accept credit cards also must follow the Payment Card Industry (PCI) Data Security Standard (DSS) issued by the major credit card companies. Finally, cloud-computing services that use, store, or process University data must also follow applicable University policies. Such policies may include Information Technology Services policies and the University's data handling requirements.

Exit Strategy

Cloud services should not be engaged without developing an exit strategy for disengaging from the vendor or service and integrating the service into business continuity and disaster recovery plans. The University must determine how data would be recovered from the vendor.

Policy Adherence

Failure to follow this policy can result in disciplinary action as provided in the Staff Handbook, Studen t Worker Employment Guide, and Faculty Handbook. Disciplinary action for not following this policy may include termination, as provided in the applicable handbook or employment guide.

Related Documents

Questions about this policy

If you have questions about this policy, please contact the University Information Security Office at DataSecurity@luc.edu.

Appendix

Listing of Cloud Storage Services

This listing is meant to serve only as a partial list of cloud storage services. Any cloud storage service not explicitly listed as approved should be assumed to be not approved.

Services Approved for University Use

Services Not Approved for University Use

Individuals who use enterprise OneDrive accounts for university work are responsible for ensuring that Loyola Sensitive information is not placed or stored in unapproved or inappropriate locations. When using OneDrive for institutional information, use it only for institutional information classified as Loyola Public or Loyola Sensitive. Pay special attention to access levels when sharing files and folders with other collaborators to ensure that data is not inappropriately shared. You should not use your enterprise OneDrive account to collect, process, or store data covered by laws such as HIPAA, FERPA, FISMA, IPIPA, and GLBA. This does not include limited research datasets or fully de-identified information as related to the HIPAA Privacy Rule.

Contractual Expectations

The University will seek and endorse vendors who deliver solutions that meet the following requirements.

Both the University and cloud-computing vendor must declare the type of data that they might transfer back and forth because of their relationship. A contract must have clear terms that define the data owned by each party. The parties also must clearly define data that must be protected.

The contract must specifically state what data the University owns. It must also classify the type of data shared in the contract according to the University's classification schema: Public, Sensitive, or Protected. Departments must exercise caution when sharing University-classified sensitive or protected data within a cloud computing service.

The contract must specify how the cloud-computing vendor can use University data. Vendors cannot use University data in any way that violates the law or University policies.

Any contractual agreement for cloud services should specify that the data store must be located in onshore locations that are within the boundaries of the United States.

References

This policy is a production of individual thought and a collaboration of multiple public works including portions of policies and guidelines from: Western Michigan University, EDUCAUSE, and Internet2 Consortium.

History

August 31, 2012: V 1.0, Initial Policy Created

September 13, 2012: V 1.0, Policy Approved

June 22, 2015: V 1.0, Annual review for PCI Compliance.

July 13, 2017: V 1.1, Changed supported storage to OneDrive, Annual review for PCI Compliance.

Sep 7, 2018: Annual Review for PCI Compliance

Sep 30, 2019: Annual Review for PCI Compliance

Oct 12, 2020: Annual Review for PCI Compliance

Feb 22, 2021: Corrected approved storage for protected information

Scope

This policy applies to all persons accessing and using 3 rd party services capable of storing or transmitting protected or sensitive electronic data that are owned or leased by Loyola University Chicago, all consultants or agents of Loyola University Chicago and any parties who are contractually bound to handle data produced by Loyola, and in accordance with University contractual agreements and obligations.

Purpose

The purpose of this policy is to ensure that Loyola Protected or Loyola Sensitive data is not inappropriately stored or shared using public cloud computing and/or file sharing services. Cloud computing and file sharing, for this purpose, is defined as the utilization of servers or information technology hosting of any type that is not controlled by, or associated with, Loyola University Chicago for services such as, but not limited to, social networking applications (i.e. all social media, blogs and wikis), file storage (See Listing of Cloud Storage Services in Appendix), and content hosting (publishers text book add-ons). Acceptable and unacceptable cloud storage services are listed in the appendix. All other cloud services are approved on a case by case basis.

Reason for Policy

This policy endorses the use of cloud services for file storing and sharing 1) with vendors who can provide appropriate levels of protection and recovery for University information, and 2) with explicit restrictions on storage of University Protected Information. While cloud storage of files can expedite collaboration, and sharing of information anytime, anywhere, and with anyone, there are some guidelines that should be in place for the kind and type of university information that is appropriate for storing and sharing using these services. Even with personal use, one should be aware of the level of protection available for your data using such a cloud service.

Federal and State laws and regulations place a premium on institutions' ability to understand the risks of IT services and systems and make appropriate determinations about risk tolerance. Some cloud providers, for instance, might mine data for marketing purposes. Covered laws and regulations are listed in the Loyola University Data Classification Policy.

There are a number of information security and data privacy concerns about use of cloud computing services at the University. They include:

University no longer protects or controls its data, leading to a loss of security, lessened security, or inability to comply with various regulations and data protection laws Loss of privacy of data, potentially due to aggregation with data from other cloud consumers.

University dependency on a third party for critical infrastructure and data handling processes

Potential security and technological defects in the infrastructure provided by a cloud vendor.

University has limited-service level agreements for a vendor's services and the third parties that a cloud vendor might contract with

University is reliant on vendor's services for the security of some academic and administrative computing infrastructure.

Policy

The following table outlines the data classification and proper handling of Loyola data.

Data Classification

Cloud Storage

(See appendix for approved services)

Network Drive
(LUC ID and Password Required)

Local Storage

Loyola Protected

Not Allowed

Loyola Sensitive

Loyola Public

Use of central and departmental servers, where UVID authentication is required, is the best place to store all categories of Loyola data, particularly Loyola Protected data. Loyola Protected Data can be stored on the Loyola University Chicago instance of OneDrive provided access to the data is protected by Multi-Factor Authentication and sharing is set for "People in Loyola University Chicago with the link". It is never acceptable to store Loyola Protected data on any other cloud service. This includes data such as grades, social security numbers, private correspondence, classified research, etc.

Definitions

Loyola Protected Data - Any data that contains personally identifiable information concerning any individual and is regulated by local, state, or Federal privacy regulations.

Loyola Sensitive Data - Any data that is not classified as Loyola Protected Data, but which is information that Loyola would not distribute to the general public.

Loyola Public Data - Any data that Loyola is comfortable distributing to the general public.

General Data Protection Terms

The University must specify particular data protection terms in a contract with a cloud-computing vendor. In this way, the University creates a minimum level of security for University data. A minimum level of security ensures that the University data is kept confidential, is not changed inappropriately, and is available to the University as needed.

The University should consider the following contract terms to ensure a minimum level of information security protection:

Data transmission and encryption requirements

Authentication and authorization mechanisms

Intrusion detection and prevention mechanisms

Logging and log review requirements

Security scan and audit requirements

Security training and awareness requirements

Compliance with Legal and Regulatory Requirements

The University has many federal laws that it must follow, these include the Family Educational Rights and Privacy Act of 1974 (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), and the Gramm-Leach-Bliley Act (GLBA).

State laws may also affect a relationship with a cloud-computing vendor. For instance, the Illinois Personal Information Protection Act (IPIPA) requires that the University must follow rules about disclosing Social Security Numbers as well as specific security breach notification procedures.

NOTE: A relationship with a cloud-computing vendor may also be impacted by private industry regulations. For example, departments at the University that accept credit cards also must follow the Payment Card Industry (PCI) Data Security Standard (DSS) issued by the major credit card companies. Finally, cloud-computing services that use, store, or process University data must also follow applicable University policies. Such policies may include Information Technology Services policies and the University's data handling requirements.

Exit Strategy

Cloud services should not be engaged without developing an exit strategy for disengaging from the vendor or service and integrating the service into business continuity and disaster recovery plans. The University must determine how data would be recovered from the vendor.

Policy Adherence

Failure to follow this policy can result in disciplinary action as provided in the Staff Handbook, Studen t Worker Employment Guide, and Faculty Handbook. Disciplinary action for not following this policy may include termination, as provided in the applicable handbook or employment guide.

Related Documents

Questions about this policy

If you have questions about this policy, please contact the University Information Security Office at DataSecurity@luc.edu.

Appendix

Listing of Cloud Storage Services

This listing is meant to serve only as a partial list of cloud storage services. Any cloud storage service not explicitly listed as approved should be assumed to be not approved.

Services Approved for University Use

Services Not Approved for University Use

Individuals who use enterprise OneDrive accounts for university work are responsible for ensuring that Loyola Sensitive information is not placed or stored in unapproved or inappropriate locations. When using OneDrive for institutional information, use it only for institutional information classified as Loyola Public or Loyola Sensitive. Pay special attention to access levels when sharing files and folders with other collaborators to ensure that data is not inappropriately shared. You should not use your enterprise OneDrive account to collect, process, or store data covered by laws such as HIPAA, FERPA, FISMA, IPIPA, and GLBA. This does not include limited research datasets or fully de-identified information as related to the HIPAA Privacy Rule.

Contractual Expectations

The University will seek and endorse vendors who deliver solutions that meet the following requirements.

Both the University and cloud-computing vendor must declare the type of data that they might transfer back and forth because of their relationship. A contract must have clear terms that define the data owned by each party. The parties also must clearly define data that must be protected.

The contract must specifically state what data the University owns. It must also classify the type of data shared in the contract according to the University's classification schema: Public, Sensitive, or Protected. Departments must exercise caution when sharing University-classified sensitive or protected data within a cloud computing service.

The contract must specify how the cloud-computing vendor can use University data. Vendors cannot use University data in any way that violates the law or University policies.

Any contractual agreement for cloud services should specify that the data store must be located in onshore locations that are within the boundaries of the United States.

References

This policy is a production of individual thought and a collaboration of multiple public works including portions of policies and guidelines from: Western Michigan University, EDUCAUSE, and Internet2 Consortium.

History

August 31, 2012: V 1.0, Initial Policy Created

September 13, 2012: V 1.0, Policy Approved

June 22, 2015: V 1.0, Annual review for PCI Compliance.

July 13, 2017: V 1.1, Changed supported storage to OneDrive, Annual review for PCI Compliance.

Sep 7, 2018: Annual Review for PCI Compliance

Sep 30, 2019: Annual Review for PCI Compliance

Oct 12, 2020: Annual Review for PCI Compliance

Feb 22, 2021: Corrected approved storage for protected information

EthicsLine

Loyola has a Reporting Hotline to provide you with an automated and anonymous way to report activities that may involve misconduct and violations of Loyola policy.

# data[].attributes.attachment_link.description
This policy applies to all persons accessing and using 3 rd party services capable of storing or transmitting protected or sensitive electronic data that are owned or leased by Loyola University Chicago, all consultants or agents of Loyola University Chicago and any parties who are contractually bound to handle data produced by Loyola, and in accordance with University contractual agreements and obligations.

# data[].attributes.headline
(9) What are the 3 types of Governance strategies? How are they different? 

# data[].attributes.subject
(9) What are the 3 types of Governance strategies? How are they different? 

# data[].attributes.body
(Slide 80 / Ebook 66)

# data[].attributes.headline
(9) Give examples of circumstances that would trigger an audit. 

# data[].attributes.subject
(9) Give examples of circumstances that would trigger an audit. 

# data[].attributes.body
(Slide 318  / Ebook 286)

# data[].attributes.headline
(9) What is a Privacy Impact Assessment (PIA)? How is it different from Privacy Assessment? 

# data[].attributes.subject
(9) What is a Privacy Impact Assessment (PIA)? How is it different from Privacy Assessment? 

# data[].attributes.body
(Slide 185, 205 / Ebook 166, 184)

# data[].attributes.headline
(9) What is the difference between Information Security and Privacy? 

# data[].attributes.subject
(9) What is the difference between Information Security and Privacy? 

# data[].attributes.body
(Slide 257-259 / Ebook 228-230)

# data[].attributes.headline
Verizon Data Breach Investigation Report

# data[].attributes.subject
Verizon Data Breach Investigation Report

# data[].attributes.body
https://www.verizon.com/business/resources/reports/dbir/

# data[].attributes.attachment_link.description
Read the official 2023 Data Breach Investigations Report (DBIR) today.

# data[].attributes.headline
(10) When operationalizing DPO responsibilities, what are the important considerations under GDPR? 

# data[].attributes.subject
(10) When operationalizing DPO responsibilities, what are the important considerations under GDPR? 

# data[].attributes.body
(Slide 88 / Ebook 74)

# data[].attributes.headline
(10) What are the typical education and awareness mistakes? 

# data[].attributes.subject
(10) What are the typical education and awareness mistakes? 

# data[].attributes.body
(Slide 324 / Ebook 292)

# data[].attributes.body
(Slide 206 / Ebook 185)

# data[].attributes.headline
(10) What is the difference between Privacy Notice and Privacy Policy? 

# data[].attributes.subject
(10) What is the difference between Privacy Notice and Privacy Policy? 

# data[].attributes.body
(Slide 269, 344 / Ebook 237, 312)

# data[].attributes.headline
FTC Children's Online Privacy Protection Act (COPPA)

# data[].attributes.subject
FTC Children's Online Privacy Protection Act (COPPA)

# data[].attributes.body
https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

# data[].attributes.attachment_link.readable_text
COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

# data[].attributes.attachment_link.title
Children's Online Privacy Protection Rule ("COPPA")

# data[].attributes.attachment_link.description
COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

# data[].attributes.headline
(11) What is a privacy program framework? 

# data[].attributes.subject
(11) What is a privacy program framework? 

# data[].attributes.body
(Slide 94  / Ebook 80)

# data[].attributes.headline
(11) As defined by EU Law, when is a DPIA required? When must the supervisory authority (SA) be contacted? 

# data[].attributes.subject
(11) As defined by EU Law, when is a DPIA required? When must the supervisory authority (SA) be contacted? 

# data[].attributes.body
(Slide 208 / Ebook 187)

# data[].attributes.headline
(11) What are the important qualities of an effective policy? 

# data[].attributes.subject
(11) What are the important qualities of an effective policy? 

# data[].attributes.body
(Slide 270 / Ebook 238)

# data[].attributes.body
https://support.google.com/legal/answer/10769224?hl=en#zippy=

# data[].attributes.attachment_link.readable_text
I. What is the Right to be Forgotten?

The "right to be forgotten" is a common name for a right that was first established in May 2014 in the European Union as the result of a ruling by the European Court of Justice. The Court found that European data protection law gives individuals the right to ask search engines like Google to delist certain results for queries related to a person's name. In deciding what to delist, search engines must consider if the information in question is "inaccurate, inadequate, irrelevant or excessive," and whether there is a public interest in the information remaining available in search results.

In 2018, the EU adopted the General Data Protection Regulation (the GDPR). Article 17 of the GDPR sets out a 'right to erasure' similar to the right the European Court of Justice had recognized under the older law that the GDPR replaced. Some countries outside the European Union have adopted similar laws as well. To give a few examples, in July 2015, Russia passed a law that allows citizens to delist a link from Russian search engines if it "violates Russian laws or if the information is false or has become obsolete" [26], and Turkey and Serbia have also established their versions of right to be forgotten since.

II. Who can make a request to delist content under data protection laws?

In general, data protection rules only apply to the processing of personal data relating to individuals. Corporations and other legal entities usually don't have rights to delist content for queries based on their corporate name.

Most requests come directly from the person affected, but you can make a request on someone else's behalf, as long as you can confirm that you're legally authorized to do so. Please check your local laws to find out more about your legal rights and if you are eligible.

III. What you can check before submitting a request

If you published the content yourself, you may be able to remove the material from the Web, or stop it from appearing in search results. Many social networks provide privacy controls to protect content you've created, as well as ways to take down abusive content posted by others.

View a list of some common tools

Removing material from the Web can be more effective than removing it only from Google on searches for your name.

If you can remove the content from the Web, Google's results will update after our search crawlers next access the page. If Google's search result preview (or 'snippet') doesn't show the current version of the page, you can request a temporary block of the snippet via this tool.

IV. How do I submit a request?

Fill out this webform to submit a request. Please make sure you include these things:

The specific URL(s) for the content that you want delisted. You can learn how to find the correct URL here.

A description of how the content is related to you, and why we should delist it from Google search results.

The search query for which you'd like us to delist the content, i.e., your full name. You may also be able to ask us to delist content for a different name, for example a nickname. In this case, please also tell us how this name is linked to your identity.

An email address where you can be reached.

It's always helpful to provide as much background information as is necessary for us to effectively evaluate your request by looking at all information available. Sometimes we need more information to decide on your request. If we do, we'll write you an email and request more information, and wait for you to respond before we proceed.

V. What is Google's decision process?

Right to be forgotten interactive video game: Round 1 - Peter Right to be forgotten interactive video game: Round 2 - Dr. Hall and Tina

Our professional reviewers will manually review your request. Broadly, the reviewer will consider whether and how the information may be in the public interest, and weigh this against your rights under the applicable data protection law.

There are several reasons why information may be in the public interest. As part of the balancing exercise, Google looks to a number of different sources, such as the guidelines developed by European data protection regulators, including the Article 29 Working Party's guidelines on the implementation of the European court's ruling and the guidelines by the European Data Protection Board, and the case law of the European Court of Justice clarifying common understanding of EU data protection laws.

Our reviewers look at factors like these:

Your role in public life

Public figures are people such as politicians, celebrities, business or religious leaders, who have a certain social position because of their job, function or commitments, which results in influence on society through that position.

We look at whether and how the information relates to your public role. The less the information relates directly to the way in which you're known publicly, the more likely it is we'll act to delist.
For instance, information about your personal life may not be relevant to your public role as an architect. But if the content contained criticism about the performance in your role as an architect, we are less likely to delist. Our approach here is to assess whether access to the information would protect the public against improper public or professional conduct, or otherwise inform the public about your overall record as a professional or otherwise your public role.

We also look at the significance of your public role. For instance, candidates who stand for election to political office are asking the voting public to judge their fitness for office based on many factors. We are less likely to delist information about political candidates, senior officials of the state, and the like.

After someone has left a particular public role, the ongoing public interest in that role depends on how senior their past role was, the role they are in now, and how much time has passed. If someone is for example likely to stand for election into public office again, or this person is still in the public eye in a different position and still has public influence, we'll often keep information about them available for historical purposes. For instance, it will be extremely rare for us to delist any information about a head of government.

Where the information comes from

If the page is on a government site, we consider the fact that the government has decided to publish the information in question and make it available to search engines, on an ongoing basis. We defer strongly to such a decision. Government records play a vital role in keeping society informed of matters of public interest, and the government's decision to keep publishing it is a strong indication that it considers the public interest to still exist.

If the information is on a news site and authored as part of journalistic activity, journalists have decided that the content is in the public's interest. We take into account the media's journalistic judgements in determining which information is relevant and in the public interest, especially for more recently-published materials.

How old the content is

The effect on Google's users

Truth or falsehood

Sensitive data

None of these factors are absolute and the above list is not exhaustive. Frequently, a case presents considerations that point in different directions, and we carefully consider those before making a decision. If we don't have all the information we need, we may ask you for more information. That information helps us understand how the various factors might affect your request.

VI. What is theeffect of a removal under data protection law?

We'll only delist content from search results for queries related to your name. Content that we delist for your name may remain in our results for other queries.

We respect the territorial scope of the relevant laws in your location. For example, in the European Union we delist URLs from versions of Google's search results for countries applying European data protection law. We'll also use geolocation signals (like IP addresses) to restrict access to the delisted URL on all Google Search services for users we think are in the requester's country. Consistent with a 2019 decision of the European Court of Justice, we don't apply these delistings to services for countries outside the EU.

If you would like to delist a page from another country's search results, you can file a request here and explain why that country's law requires delisting.

VII. Where can I find more information?

Check out European privacy requests Search removals FAQs for more information. For more in-depth information, you can read " Five Years of the Right to be Forgotten ".

In our Transparency report you can find a lot of information about data, and anonymised examples of requests we've received. Please note these are real requests, so we need to protect the privacy of the requestors. This means we can't share any more information about individual cases or the decision process.

# data[].attributes.attachment_link.description
I. What is the Right to be Forgotten? The "right to be forgotten" is a common name for a right that was first established in May 2

# data[].attributes.headline
(12) List the 8 privacy principles under the OECD guidelines (CUPID ASO). 

# data[].attributes.subject
(12) List the 8 privacy principles under the OECD guidelines (CUPID ASO). 

# data[].attributes.body
(Slide 99 / Ebook 85)

# data[].attributes.headline
(12) Give examples of different types of policies as part of the privacy program. 

# data[].attributes.subject
(12) Give examples of different types of policies as part of the privacy program. 

# data[].attributes.body
(Slide 272-280 / Ebook 240-248)

# data[].attributes.body
https://dataprotection.education/freebies/child-friendly-privacy-notices

# data[].attributes.attachment_link.readable_text
At Data Protection Education we support hundreds of schools as Data Protection Officer. Many of those schools have children whose rights as data subjects are often looked after by those with parental responsibility.

And whilst it is important to have full privacy notices for older children and adults who can understand those rights, what about younger or those with lower-level literacy or learning difficulties?

As the ICO says:

"In practice, this means that you need to give both the holder of parental responsibility and the child clear and accessible privacy information... you could achieve this by developing different versions for these different audiences, or by producing a child-friendly version that can also be understood by parents.

This gives the consenting parent the information they need, and also help to inform and educate young children for the future and enable them to exercise their rights on their own behalf in line with their evolving capacity to do so."

Our answer has been to produce some graphical child-friendly privacy notices as well as an animated version.

These are provided free for your to use and distribute for non-commercial use, as long as the Data Protection Education logo is not removed or replaced ( Creative Commons Attribution Non-Commercial licence)

If you have any questions or comments, please let us know!

Our comic-strip privacy notice is fun, engaging and informative. We user-tested three variations of this version, and two variations were equally popular, so we've published both. Firstly, a variation utilising a comic-strip style font in the captions. The second variation uses an easy-read font in the captions.

Lastly, we have a version of the notice as a linear info-graphic style, using an easy-read font. This might be suitable for younger children and due to its size for use on the web.

As with all these downloads, they are provided free for your to use and distribute for non-commercial use, as long as the Data Protection Education logo is not removed or replaced ( Creative Commons Attribution Non-Commercial licence).

Click the images to view and download it as a pdf file.

Contact us today with any questions or for a

# data[].attributes.attachment_link.description
Child-friendly privacy notices as animations and graphics by the leading school DPO and school GDPR data protection officer.

# data[].attributes.headline
(13) What is the life cycle in development of privacy policies? 

# data[].attributes.subject
(13) What is the life cycle in development of privacy policies? 

# data[].attributes.body
(Slide 112 / Ebook 93)

# data[].attributes.headline
(13) What are the important considerations when Implementing policies? 

# data[].attributes.subject
(13) What are the important considerations when Implementing policies? 

# data[].attributes.body
(Slide 284-285 / Ebook 252-253)

# data[].attributes.body
https://iapp.org/certify/prepare/

# data[].attributes.attachment_link.readable_text
How to Prepare

Earning widely respected credentials requires a rigorous certification process that includes passing demanding exams. We strongly recommend careful preparation, even for degreed professionals who have passed other certification tests.

Preparation makes all the difference. In general, we recommend that you train and study for a minimum of 30 hours. We want you to succeed.

Tips for effective studying

Consider enrolling in an IAPP training class. With multiple in-person, live online and online options, IAPP trainings are created from the same topic outline from which exam questions are drawn. Instructor-led trainings come with detailed participant guides. Online trainings include transcripts, resource lists and review questions to bolster your study efforts.

PLEASE NOTE that completing a training course does not guarantee passing an exam. Additional preparation is essential. Use this video and the tips below to help plan your studying strategy. They cover how much time to spend based on your level of training and education, how to use the exam blueprint and body of knowledge, and more.

Self-assess - Each IAPP exam comes with two tools for determining how ready you are:

1. The body of knowledge is an outline of the information covered in the exam and represents the breadth of knowledge qualified candidates should possess on the topic. Use it to identify subjects you know well and those you should study more deeply.

2. The exam blueprint tells you how many questions to expect on each topic. Use it to map out a study strategy-allowing more time for topics with many questions, for example.

Use your textbook properly - Textbooks are available for purchase through the IAPP store. Start by reading the table of contents. Note which topics are new to you. That will give you a feel for how much study and review time you need. When you start reading the chapters:

1. Highlight important points in each.

2. Copy out key passages; it will help you remember them.

3. Review each chapter to make sure you capture the key points before moving on.

Create flash cards - As you read your textbook, articles, web pages, etc., copy new terms onto flash cards. Write their definitions on the other side. Quiz yourself. Use the IAPP's glossary of privacy terms to look up unfamiliar terms.

Form a study group - Discussing the material with your coworkers and colleagues is a great way to remember material and understand it more deeply.

Ready to purchase an exam? This video explains the process. It covers exam scheduling, cost, and maintaining your certification.

Can we help you prepare? Contact an IAPP training consultant with any questions. Good luck!

# data[].attributes.attachment_link.description
How to Prepare Earning widely respected credentials requires a rigorous certification process that includes passing demanding exams. We strongly recommend careful preparation, even for degreed professionals who have passed other certification tests. Preparation makes all the difference. In gene...

# data[].attributes.headline
(14) What are the four common categories that one can find across multiple jurisdictions? (CRIM) 

# data[].attributes.subject
(14) What are the four common categories that one can find across multiple jurisdictions? (CRIM) 

# data[].attributes.body
(Slide 142 - 154 / Ebook 123-135)

# data[].attributes.headline
(15) Generally, there are two approaches to data protection: sectoral vs comprehensive. What is the difference? Give example for each. 

# data[].attributes.subject
(15) Generally, there are two approaches to data protection: sectoral vs comprehensive. What is the difference? Give example for each. 

# data[].attributes.body
(Slide 155-156 / Ebook 136-137)

# data[].attributes.body
These are the resources including worksheets coming from NIST Privacy Framework.

# data[].attributes.attachment_link.readable_text
Guidelines, tools, and best practices can provide implementation support for the Privacy Framework or specific Subcategories.

Contribute

Have guidelines or tools? Share them with the community.
Contribute
Identify-P

Inventory and Mapping

Business Environment

Risk Assessment

Data Processing Ecosystem Risk Management

Govern-P

Governance Policies, Processes, and Procedures

Risk Management Strategy

Awareness and Training

Monitoring and Review

Control-P

Data Processing Policies, Processes, and Procedures

Data Processing Management

Communicate-P

Communication Policies, Processes, and Procedures

Data Processing Awareness

Protect-P

Data Protection Policies, Processes, and Procedures

Identity Management, Authentication, and Access Control

Data Security

Maintenance

# data[].attributes.attachment_link.description
Guidelines, tools, and best practices can provide implementation support for the Privacy Framework or specific Subcategories. Have guidelines or tools? Share them with the community. Contribute

# data[].attributes.headline
(16) Under GDPR, what are the appropriate safeguards for international data transfers? Which is a suitable choice for transfer of PD between subsidiaries of an MNC in Europe and Singapore? 

# data[].attributes.subject
(16) Under GDPR, what are the appropriate safeguards for international data transfers? Which is a suitable choice for transfer of PD between subsidiaries of an MNC in Europe and Singapore? 

# data[].attributes.body
(Slide 160 / Ebook 141)

# data[].attributes.headline
(17) Name the GDPR Principles. (Hint:APSIDAL)

# data[].attributes.subject
(17) Name the GDPR Principles. (Hint:APSIDAL)

# data[].attributes.body
(Slide 133 / E-book 114)

# data[].attributes.attachment_link.description
The International Association of Privacy Professionals: Policy neutral, we are the world’s largest information privacy organization.

# data[].attributes.headline
PDPC Resources to develop data protection management program

# data[].attributes.subject
PDPC Resources to develop data protection management program

# data[].attributes.body
Breach Incident Record Log

Sample Personal Data Inventory Map Template

Data Flow Illustration (pdf)

Data Flow Illustration (vsd)

Sample Consent Registry

Develop a Process for Dispute Resolution

# data[].attributes.headline
Reviewer-  any available reviewers or practice question set that we can get for the certification exam? 

# data[].attributes.subject
Reviewer-  any available reviewers or practice question set that we can get for the certification exam? 