Study guide
4.3 Privacy Program Development and Workforce Training
IAPP Certified Information Privacy Professional/United States CIPP/US
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 BoK 2.6.1, Scoring, Activation, CPE, and 2026 Updates
2 Domain I: The U.S. Legal Framework
2.1 Branches of Government and Their Privacy Roles 2.2 Sources of U.S. Privacy Law 2.3 Scope, Jurisdiction, Preemption, and Private Rights of Action 2.4 Major Regulatory Authorities
3 Domain I: Self-Regulation, Liability, and Enforcement
3.1 Self-Regulatory Models 3.2 Contract, Tort, Fiduciary Duty, Negligence, and UDAP 3.3 Federal and State Enforcement Authorities 3.4 Cross-Border Enforcement, GPEN, PCI, and Trust Marks
4 Domain I: Information Management Foundations
4.1 Data Inventory, Classification, and Records of Processing 4.2 Data-Flow Mapping, Sharing, and Transfers 4.3 Privacy Program Development and Workforce Training 4.4 Vendors, Cloud, DPAs, and Third-Party Sharing
5 Domain I: Accountability, Notices, and Online Privacy
5.1 Accountability, Incident Response, and Due Diligence 5.2 User Preferences, Retention, Disposal, and Privacy Notices 5.3 Online Tracking, Profiling, and Digital Advertising Basics
6 Domain I: International Transfers and Multinational Compliance
6.1 Schrems Decisions and Transfer Requirements 6.2 SCCs and the EU-U.S. Data Privacy Framework 6.3 GDPR Requirements and Multinational Conflicts 6.4 FADP and Other Non-U.S. Intersections
7 Domain II: FTC Consumer Privacy
7.1 FTC Act and COPPA 7.2 FTC Privacy and Security Enforcement 7.3 Future Enforcement Priorities: Brokers, IoT, AI, Biometrics
8 Domain II: Healthcare and Medical Privacy
8.1 HIPAA Privacy and Security Rules 8.2 HITECH and Breach Notification 8.3 Part 2 and the 21st Century Cures Act
9 Domain II: Financial Sector Privacy
9.1 FCRA and FACTA 9.2 GLBA Privacy Rule, Safeguards Rule, and State Exemptions 9.3 Red Flags Rule, Dodd-Frank, and the CFPB 9.4 Online Banking Privacy and M&A Diligence
10 Domain II: Education, Telecom, and Marketing
10.1 FERPA and Education-Technology Risk 10.2 TCPA, TSR, CAN-SPAM, JFPA, Cable Act, VPPA, DPPA 10.3 Do-Not-Call and the Wireless Domain Registry 10.4 Digital Advertising, Web Scraping, and Data Ethics
11 Domain III: Government and Court Access
11.1 RFPA, BSA, ECPA, and CALEA 11.2 FISA 702, PATRIOT, USA Freedom, and CISA 11.3 Privacy Protection Act and E-Discovery
12 Domain IV: Workplace Privacy Foundations
12.1 Notice, AEP, CRA, ADA, and GINA 12.2 FTC, DOL, EEOC, NLRB, and OSHA 12.3 AEDTs, Background Checks, Testing, and Social Media
13 Domain IV: Monitoring, Investigations, and Post-Employment
13.1 Employee Monitoring and Employer ECPA Duties 13.2 Internal Investigations and Post-Employment Records
14 Domain V: Authority and Common State Framework
14.1 Federal/State Authority, AGs, and the CPPA 14.2 Applicability Thresholds, Exemptions, and Consumer Rights 14.3 State Privacy Notices 14.4 Assessments, Retention, Sale/Sharing, and DPAs
15 Domain V: Sectoral Rules and Enforcement
15.1 Common State Data-Security Requirements 15.2 MHMD, Nevada CHD, GIPA, and Geofencing Bans 15.3 Cure Periods and Penalties 15.4 State Cookie and Online-Tracking Rules
16 Domain V: Biometrics, AI Bias, and California
16.1 Illinois, Washington, Texas, and Facial-Recognition Limits 16.2 NAIC AIS, NYC AEDT, CA/CO ADMT, Colorado Insurance 16.3 CCPA/CPRA, CAADCA, and the Delete Act
17 Domain V: Other State Laws and Breach Notification
17.1 Other Major Comprehensive State Privacy Laws 17.2 Common Breach-Notification Elements 17.3 State Differences, PA SB 696, and Utah S.B. 127
4.3 Privacy Program Development and Workforce Training
Key Takeaways Explain This Topic AI
I.C PI2 tests the basics of privacy-program development: leadership, policies, training, assessments, incident response, and vendor management working as one system.
Workforce training must be role-based, delivered at onboarding and on a cycle, and must cover privacy incidents and phishing — not a single all-hands slide deck.
The United States has no general GDPR Article 37 DPO mandate; HIPAA requires a privacy official and a security official, and the GLBA Safeguards Rule requires a Qualified Individual.
FTC Section 5 reasonableness, illustrated in Start with Security, asks whether the program as a whole is appropriate to the data, size, and risk — not whether a European title appears on the org chart.
State comprehensive laws and CPPA regulations effective 1 January 2026 add documented risk-assessment duties for high-risk processing; those assessments are how U.S. accountability is evidenced.
Last updated: August 2026
4.3 Privacy Program Development and Workforce Training
I.C's second performance indicator shifts from maps to management: know the basics of privacy program development , and understand the role of workforce training (vendor management, cloud, and incidents are the next section). CIPP/US is not CIPM, but the legal exam still expects you to recognize a functioning U.S. program when a fact pattern describes one — and to spot the hollow program that exists only as a binder.
Program elements the exam expects to see together
A U.S. privacy program is a system, not a title. The pieces that I.C treats as the basics are:
Element What "done" looks like What failure looks like
Leadership A named executive owner, a reporting line to the board or CEO, and budget Privacy "owned" by an unpaid committee that never meets
Policies A notice to consumers, internal standards for collection/use/retention/sharing, and procedures for rights and incidents A public notice that contradicts internal practice
Training Role-based, onboarding plus refreshers, incident and phishing content, attendance records A 2019 all-hands slide with no quiz and no engineers in the room
Assessments Thresholding for high-risk processing, written risk assessments / DPIAs, and a cadence to revisit them Launching targeted ads or ADMT with no written analysis
Incident response A playbook that covers cyber events, misdirected email, insider loss, ransomware, and vendor incidents A security runbook that never calls privacy or legal
Vendor management Inventory of recipients, diligence, contracts, and monitoring Procurement clicking through a vendor's online terms
Those six pieces implement accountability : the organization can explain what it does with PI, show that someone is responsible, and produce artifacts when the FTC, a state attorney general, or the CPPA asks. National Institute of Standards and Technology (NIST) Privacy Framework functions (Identify, Govern, Control, Communicate, Protect) are a voluntary way to organize the same work. Citing NIST does not replace a statute, but it is a recognized U.S. method for demonstrating a reasonable program.
Workforce training: role-based, onboarding, incidents, phishing
Training is the control that turns policy into behavior. I.C expects three design choices.
Role-based. Engineers need data-minimization, logging, and "do not train models on customer exports." Marketers need sale/share, opt-out honors, and dark-pattern limits. HR needs employee-file and background-check rules. Customer support needs identity verification before disclosing an account. A single generic module cannot cover those jobs.
Onboarding and cycle. New hires who can touch PI should not receive production access before a baseline module. Existing staff need a refresh when the law, the product, or their role changes, and at least on a regular cycle so the control is demonstrable. Attendance and comprehension records are how you prove the program to an examiner.
Incidents and phishing. BoK 2.6.1 expressly pairs program development with incident response for cyber threats. Workforce training is the front line: phishing that yields credentials, a well-meaning analyst emailing a spreadsheet to a personal account, a support agent skipping verification, or an employee plugging in a found USB drive. Privacy incidents are not only ransomware. They include unauthorized internal access and disclosure. Tabletop exercises that mix a phishing lure, a vendor outage, and a consumer-rights surge are how mature programs test the playbook.
Worked training failure. A hospital trains clinicians on HIPAA every year but never trains the billing vendor-management team. A clerk uploads a claims file to a personal file-share to "work from home." OCR and state attorneys general will not accept "we trained the doctors." The workforce that actually moved the PI was untrained, and the program was not role-based.
Accountability without a GDPR-style DPO mandate
GDPR Articles 37–39 require a data protection officer for public authorities, large-scale regular and systematic monitoring, or large-scale special-category processing, with independence and a direct line to the highest management. The United States has no general analog . A U.S. retailer is not violating federal law merely because no one holds the title "DPO."
Sectoral and contractual titles still exist, and the exam likes to mix them:
HIPAA requires a covered entity to designate a privacy official responsible for the Privacy Rule policies and a security official responsible for the Security Rule (45 C.F.R. §§ 164.530(a)(1), 164.308(a)(2)). Many organizations use one person; the duties are still distinct.
The FTC's GLBA Safeguards Rule (16 C.F.R. § 314.4(a)) requires a Qualified Individual to oversee the information-security program. The person may be an employee, an affiliate, or a service provider, but the financial institution remains responsible and must designate a senior employee to supervise an outsourced Qualified Individual.
COPPA operators need a capable program and, in practice, a named owner for parental consent and deletion, but the statute does not create an Article 37 DPO.
Multinationals often appoint a chief privacy officer (CPO) or even a DPO for GDPR establishments. That is allowed and often wise. It is not a hidden federal mandate for a U.S.-only shop.
U.S. accountability is demonstrated by the program artifacts : inventory, maps, policies, training records, assessment reports, vendor contracts, incident tickets, and board reporting. A laminated DPO certificate with no artifacts loses to a CPO-less company that can produce those artifacts.
FTC reasonableness and state assessment duties
Section 5 of the FTC Act is the federal backstop. The Commission evaluates whether privacy and security practices are unfair or deceptive . Deceptive is a broken promise — a notice that says "we do not sell" while an ad-tech pixel runs. Unfair is a practice that causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits (15 U.S.C. § 45(n)). Start with Security: A Guide for Business translates decades of settlements into practical lessons: collect less, lock down access, require vendor security in writing, and monitor those vendors. Reasonableness is scaled to the sensitivity of the data, the size of the business, and the available tools. It is not a checklist that every bakery must match a hospital, and it is not a defense that "no statute named this exact control."
State comprehensive privacy laws add a documented assessment duty that looks more like a DPIA than like an FTC complaint. Colorado, Virginia, Connecticut, Texas, and others require a data protection assessment before processing that presents a heightened risk — typically targeted advertising, sale, sensitive data, or certain profiling. California's CPPA regulations on risk assessments, cybersecurity audits, and ADMT were approved 22 September 2025 and are effective 1 January 2026 . Covered businesses must begin performing required risk assessments for in-scope processing on that effective date. Assessments conducted in 2026 and 2027 are first submitted to the CPPA by 1 April 2028 . ADMT consumer-right compliance is widely described as running to 1 January 2027 . Cybersecurity-audit certifications are staggered by revenue into 2028–2030. The exam-safe point is not to memorize every staggered date for every revenue band; it is that as of 2026, California risk assessments are a live program duty , not a future rumor, and that the inventory and flow map are the inputs.
Worked scenario. A mid-size retailer with California and Colorado customers appoints no DPO. It does name a CPO who reports to the general counsel, trains new marketers before they receive the customer file, runs a written risk assessment before launching a lookalike-ad campaign, and tabletop-tests a ransomware-plus-phishing script twice a year. An FTC inquiry after a vendor incident will still be painful, but the company can produce the program. A competitor that printed "GDPR DPO" on a business card, skipped role-based training, and launched the same campaign with no assessment has the European title and none of the U.S. accountability evidence. CIPP/US scores the second company as the failure.