3.1 Privacy Policies & Life-Cycle Processes

Establishing the Organizational Model and Reporting Structure

Governance is the system by which an organization's privacy program is directed, controlled, and held accountable. Before a single policy is written, the CIPM candidate must understand that the organizational model itself is a governance decision tested on the exam.

Three Common Models

• Centralized model — a single privacy office, typically led by a Chief Privacy Officer (CPO) or DPO, owns all privacy decisions, policies, and reporting. Best for smaller organizations or those operating in one jurisdiction.
• Decentralized model — privacy responsibilities are distributed across business units, each with its own privacy lead. Best for large, diversified organizations but risks inconsistency.
• Hybrid (federated) model — a central privacy office sets standards and policies, while business units implement and execute. Most common in mature enterprises; balances consistency with operational flexibility.

Reporting Line and Authority

The IAPP emphasizes that the privacy function must have adequate authority and independence. In practice this means the privacy leader reports to the board, the CEO, the General Counsel, or the Chief Risk Officer — not buried under a line-of-business head whose revenue targets may conflict with privacy obligations. The reporting line signals to regulators, employees, and data subjects how seriously the organization treats privacy.

Sizing the Team

A 50-person startup does not need a 20-person privacy office. The IAPP Body of Knowledge (BoK) expects you to size the team, the budget, and the controls to the volume and sensitivity of data processed and the number of jurisdictions in which the organization operates — not to headcount alone.

Defining Policies Appropriate to the Data

A privacy policy is not a single document. The exam expects you to understand a policy hierarchy:

1. Governing privacy policy — the overarching statement of the organization's commitment to privacy, approved by the board or executive leadership. Short, principles-based.
2. Domain-specific policies — retention, breach notification, data sharing, vendor management, data subject rights, international transfers.
3. Standards and procedures — operational step-by-step documents that implement each policy.
4. Records of processing — inventories (Article 30 records under GDPR, or equivalent) that show where policies meet reality.

Legal AND Ethical Requirements

This is a frequently tested distinction. A policy that satisfies the letter of the law but ignores the reasonable expectations of data subjects fails the ethical test the IAPP builds into the CIPM. Examples the exam rewards:

• Collecting location data technically permitted by a broad consent banner, but using it to infer health conditions — legal, arguably unethical.
• Retaining data for the maximum legally allowed period when users reasonably expect deletion after service completion — legal, unethical.
• Sharing data with an affiliate the user would not reasonably expect to be part of the same household of companies — legal in some jurisdictions, unethical by most fairness standards.

Identifying Collection Points

A collection point is any system, form, sensor, API, vendor feed, or human interaction through which personal data enters the organization. The exam expects you to inventory every collection point and, for each, verify:

• Transparency — Is there a notice at or before the point of collection? Is it layered (short + full)?
• Lawful basis — Consent, contract, legitimate interest, legal obligation, vital interest, public task (GDPR terms) or the applicable jurisdiction's equivalents.
• Data quality and integrity — Is the data accurate, complete, and collected from the data subject directly rather than inferred?
• Purpose specification — Is the purpose for each data element stated and limited?
• Minimization — Is each element necessary for the stated purpose?

Life-Cycle Stage to Policy Mapping

The privacy life cycle the IAPP teaches has five core stages. Each maps to specific policies and processes:

Worked Scenario: Collection-Point Transparency

A regional health-insurance company launches a mobile app that lets members upload photos of their driver's license to verify identity. The app's first screen shows a 4,000-word privacy policy link. The app then also reads the device's GPS coordinates on every launch, though location is not visibly used in the app.

What is wrong at the governance level?

1. The notice is not layered — a data subject clicking 'upload license' should see a short, just-in-time explanation of what ID data is collected and why, before the long policy.
2. The GPS collection has no corresponding notice at the point of collection — burying it in a 4,000-word document does not satisfy transparency.
3. The purpose for GPS data is unspecified, which means it cannot be minimization-tested.
4. The lawful basis for GPS is unclear — if the justification is 'legitimate interest,' no legitimate-interest assessment (LIA) exists in the records.

The governance fix is not to rewrite the app code (that is Domain III) but to require a collection-point inventory and a transparency gate before any new collection channel ships. That gate is a policy and a process, owned by the privacy office, that product teams must pass.