CPGA — Certified Privacy Governance Associate
Data Privacy Council (DPCI)
PROPOSED CURRICULUM — IN DEVELOPMENT

1. Privacy foundations and statutory roles
Explain core privacy concepts and distinguish Data Principal, Data Fiduciary, Data Processor, Consent Manager and DPO roles.
Learning task: Map the people and responsibilities involved in a simple customer-data journey.

2. DPDP framework, commencement and applicability
Identify relevant instruments, distinguish present and future requirements, and recognise scope and conditional exemptions.
Learning task: Check the source, applicability and commencement of a requirement before treating it as an operational obligation.

3. Notice, consent and certain legitimate uses
Recognise processing grounds, notice requirements, consent withdrawal and common errors in routine scenarios.
Learning task: Identify the questions a team should resolve before introducing a new data-collection form.

4. Individual rights, duties and grievance redressal
Understand request handling, nomination, grievance routes and Data Principal responsibilities.
Learning task: Outline how a request is received, assigned, tracked and escalated.

5. Organisational obligations and data lifecycle
Understand accountability, accuracy, data inventories, retention, erasure and the purpose of implementation evidence.
Learning task: Connect a data inventory entry to its owner, purpose, retention decision and supporting records.

6. Children, guardians and additional obligations
Recognise child-data and lawful-guardian considerations, conditional exemptions and the additional framework for notified Significant Data Fiduciaries.
Learning task: Recognise when specialist review is needed instead of assuming the standard workflow is sufficient.

7. Security safeguards and breach response
Recognise basic safeguards, incident escalation, notification responsibilities and evidence preservation.
Learning task: Identify the first internal escalation and record-preservation steps in an illustrative incident.

8. Processors, contracts and cross-border processing
Understand processor oversight, contractual controls, data flows and conditional transfer requirements.
Learning task: Identify privacy questions to ask when reviewing a new service provider.

9. Privacy governance and risk management
Understand ownership, policies, risk identification, escalation, management reporting and ethical judgement.
Learning task: Turn an unclear responsibility into an action with an owner, an escalation route and evidence.

10. Compliance monitoring, evidence and audit readiness
Distinguish policies from operating evidence, recognise control gaps and understand remediation tracking and assurance boundaries.
Learning task: Explain why a written procedure alone does not demonstrate that a control operates.

This is a curriculum overview, not the final examination syllabus. Format, eligibility, fees, dates, duration, pass criteria and renewal are not finalised.
https://cpga.in/curriculum/