Exin Privacy & Data Protection Professional

2.1 Privacy information management system (PIMS) basics
The candidate can…
2.1.1 explain the different terms used in the ISO/IEC 27701 standard (internal and external issues, interested parties).
2.1.2 list which media must be considered when implementing a PIMS.
2.1.3 define what a statement of applicability (SoA) is.
2.1.4 explain the purpose of documentation in a PIMS.
2.1.5 explain the purpose of management reviews in a PIMS.

2.2 Benefits of a privacy information management system (PIMS)
The candidate can…
2.2.1 explain the objective of audits in a PIMS.
2.2.2 explain how to determine the specific requirements of a PIMS in light of the appropriate local rules and contractual requirements.
2.2.3 explain how a PIMS and audits help to show compliance with standards and regulations.
2.2.4 explain how a PIMS can help with supplier selection.

2.3 Privacy information management system (PIMS) relationships
The candidate can…
2.3.1 explain the difference between a privacy information management system (PIMS) and an information security management system (ISMS).
2.3.2 explain the relationship between the data protection principle of appropriate information security arrangements and the ISO/IEC 27701 standard.
2.3.3 explain the usefulness of the ISO/IEC 27002 standard for the implementation of a PIMS.
2.3.4 explain how to apply PIMS controls.

3.1 Roles of the controller and processor
The candidate can…
3.1.1 enact the responsibilities of the controller.
3.1.2 enact the responsibilities of the processor.
3.1.3 explain the relationship between the controller and the processor in a specific situation.

3.2 Role and responsibilities of a data protection officer (DPO)
The candidate can…
3.2.1 explain when appointment of a DPO is mandatory under the GDPR.
3.2.2 enact the role of the DPO.
3.2.3 explain the position of the DPO in relation to the supervisory authority.

4.1 Criteria for a data protection impact assessment (DPIA)
The candidate can…
4.1.1 apply the criteria for conducting a DPIA.
4.1.2 describe the objectives and outcomes of a DPIA.

4.2 Steps of a data protection impact assessment (DPIA)
The candidate can…
4.2.1 describe the steps of a DPIA.
4.2.2 perform a DPIA in specific situations.

5.1 GDPR requirements with regard to personal data breaches
The candidate can…
5.1.1 assess whether a data breach has taken place in terms of the GDPR.

5.2 Requirements for notification
The candidate can…
5.2.1 notify the supervisory authority of a personal data breach.
5.2.2 notify the data subject of the personal data breach.
5.2.3 describe the elements of the GDPR documentation obligation.