IAPP-GDPR Web Banners-300x250-FINAL

By Julie Sartain

On May 7, the IAPP launched its first Certified Information Privacy Manager (CIPM) training at the Convene Center in New York, and according to instructors and attendees, it was an incredible success.

"The response to the CIPM program has been tremendous," says IAPP President and CEO J. Trevor Hughes, CIPP. "We announced the program at our annual IAPP Global Privacy Summit in March and nearly 1,000 people flocked to receive a free copy of the CIPM textbook—enthusiastic to dive into the new content. In May, we launched our first CIPM prep class in New York City with 40 attendees, and we have more than 30 classes scheduled in 2013, with strong interest in each city."

CIPM Training Receives Highest Praise

"Overall I found the training to be most useful in terms of tying organizational objectives for privacy to actual implementation. In my role as advisor to enterprise IT organizations, I find that, too often, IT practitioners do not understand the privacy framework or business drivers or how to get started with a privacy program. This workshop ties the pieces together. In particular, the discussions around privacy metrics and sample scenarios were the most impactful. As a result, I am now better equipped to guide my clients on best practices for implementing a privacy program. Please note that this is my personal opinion and does not represent any official statement or endorsement of the IBM Corporation."
Cindy Compert, executive IT specialist of Big Data governance and data privacy at IBM Software-Information Management

"I thought the training was both practical—providing structured material for the CIPM qualification—and also helpful on a day-to-day basis, identifying effective strategies to start and manage a privacy program. It gave me good insights in planning and implementing a sustainable privacy program. As an insurer of privacy risks, the topics covered provided a great framework, which privacy managers can use to build out their programs and manage their exposures."
Oliver Brew, CIPP/US, vice president of privacy and technology insurance at Liberty International Underwriters

"The CIPM training class was focused on the mechanics and knowledge required to build, run and report on an effective privacy program. The afternoon session contained some very valuable and thought-provoking, team-based scenarios that were purposely designed to stimulate conversation amongst the class. Since the class was composed of varied industries, different departments and skill levels, some of the approaches to solve the scenarios ranged from strategic to robustly detailed and were refreshingly open. This class and the scenarios were about real-world and current-day events, so they were directly applicable to our call-center business, which services millions of consumers for global clients in multiple industries."
Michael Meyer, CIO, CSO of MRS BPO, LLC

"The training was focused on how to effectively implement a privacy program within one’s organization or business entity. The two trainers, Bob Siegel and Paul Gray, are both seasoned privacy professionals and they covered a lot of material pertaining to information governance, risk management, data security, regulatory compliance and Privacy by Design. The second half of the training included group analysis and discussion of hypothetical privacy management scenarios, which I found to be very engaging and useful in putting together the ideas and principles covered during the course of the day. I think the CIPM training and subsequent certification are leading the way for professionals dealing with information privacy and the management thereof. I believe this path leads to—and is part of—so many areas of business, including security, law, ethics, compliance and marketing. I’m glad to be part of it!"
Doug Gregory, information design consultant at

"In the course of a day’s training, participants were taken through the details of each of these two components. The focus throughout the training was on making privacy practical, operational, and 'baked-into' an organization—from establishing the appropriate privacy framework and vision to managing the details of the privacy operational life-cycle…The first half of the training was focused on the principles and foundations while the afternoon was focused on examining case studies in small teams. The teams diagnosed the privacy issues present in various hypotheticals and then communicated their results to the class. The class then discussed and, in some cases, debated the team conclusions that were reached. In my opinion, the afternoon session reviewing the case studies was the most valuable portion. And, because our organization is a ‘hybrid’ privacy model, the training has been valuable in working through how I can approach various privacy situations. It has also led me to think about areas where we need to clarify the privacy strategic vision and framework and local jurisdictional rules and regulations, before trying to impose 'solutions' on the business.”
Tim West, associate general counsel at Apollo Group, Inc.

The IAPP’s first certification program—the Certified Information Privacy Professional (CIPP)—rolled out in 2004 and covered the laws and regulations, or the “what” of privacy. As the privacy landscape evolved, the IAPP recognized a need for privacy professionals to understand how to operationalize privacy in their organizations.

"Fast-forward to 2013," says Hughes. "The profession has matured, and best practices for privacy management have emerged. The IAPP documented these practices and aggregated them into the CIPM. This new credential—the ‘how’ of privacy—is the complement to the CIPP. The CIPM is the global answer for professionals who are responsible for managing governance and operations within their organization."

Certification Director Dick Soule, CIPP/US, CIPP/E, agrees. According to Soule, the CIPM is the “real world” of privacy—that is, how the privacy pro really manages personal information in an organizational setting and where laws and regulations form a backdrop—but it’s mostly about the organization’s goals and strategies. A lot of information privacy is related to compliance, but many organizations are positioning privacy as the foundation of customer trust.

"The CIPM training program is designed to be as interactive as possible," says Soule, “combining some great advice about how to promote privacy in an organization, create a privacy strategy, form a privacy team, enlist sponsors and advocates and develop approaches to maximizing the tools privacy pros use to implement a privacy program with a realistic, extended scenario during which training participants interact with each other and the IAPP Privacy Faculty trainers to analyze the situation, identify issues and devise solutions. The scenario part of the training is like a guided networking activity. With people from many backgrounds and with various privacy-related responsibilities, it’s a great opportunity to view information privacy through multiple lenses. And the training is an excellent lead-in to actually sitting for the exam, because the exam consists of both questions about the course content and a set of scenarios."

Instructor Bob Siegel, founder and CEO of Privacy Ref, explains that this was the first time for this particular class and curriculum.

"We used a half-and-half format; that is, the first half was standup training with slides, and the second half was example scenarios and case studies, plus discussions in small groups of five or six. It was a perfect balance of lecture and dialogue, which breeds a diverse environment for the participants. Plus, it was very effective for the participants to learn from their peers' experiences," says Siegel.

According to Siegel, all classes will have multiple instructors from varied backgrounds, including operations, IT and legal, so a lot of different ideas are expressed and exchanged. This means that, although each class covers the same curriculum, the variety of instructors will bring their own expertise, individually, to each class, which allows the participants to leave with a unique perspective.

Instructor Paul Gray, CIPP/US, CIPM, of information risk management company The Gray Group, adds "this new program is where the rubber hits the road." Gray explains that this class is about how to bring together the basics of the law and security that participants learned and talked about for so many years and actually implement that in a risk-based, professional approach. The content of the morning was conducted in a lecture-type session; however, the afternoon scenarios really encouraged discussion and debate—the sort of discussions that everyone has been a part of but without the concerns about some of the politics that can stifle comments when participants are actually dealing with the issues at their own organizations.

"With respect to the course delivery, I would say it is unique," says Gray. "It allows for interaction and understanding—because you have to apply what you have learned—that people don't seem to get in straight lecture delivery-type classes. You pick up a lot of the 'what' in the morning, then apply it in the afternoon. Given the 'group' participation and interaction that occurs, people can and did talk through scenarios and drew on strengths and experiences that the participants bring to the table. Then, with the faculty walking around and interacting during the scenario discussions, when there are more specific questions, we can dive into those using the scenarios."

Hughes notes that the CIPM is really for anyone who has to operationalize privacy in their organization. When the privacy field first emerged, it was primarily built by professionals who were trying to figure out how to comply with privacy laws and regulations. As the profession has grown, the privacy field has also evolved to include other disciplines such as marketing, HR, compliance and IT—professions and professionals who don’t have privacy in their title but are responsible for protecting data.

"We know that employees who understand privacy risks are the best tool for a company to navigate the ever-changing space," says Hughes. "The CIPM is the answer for them. In fact, 96 percent of the attendees at our first prep class rated the class content as relevant to their needs. The CIPM covers an entirely new body of knowledge, and the format of the prep classes are interactive with group-based exercises to help give attendees a real, hands-on learning experience."

For more information on upcoming CIPM classes, visit the IAPP website.

Julie Sartain, author of Data Networks 101 (Aegis, 2002), has been a freelance journalist for 13 years. She writes for several magazines including Network World, Computerworld, PC World, CIO and The Privacy Advisor.

Read more by Julie Sartain:
Hunters, hackers and safety crackers: One dozen privacy innovations
Analyzing FTC vs. Wyndham
The Masses As Data Controllers: What They Don't Know Could Hurt You
SMB Tips To Consider


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Spots Going Fast

With the top minds in the field leading this exceptional program, it's no wonder it's filling quickly. Register now to secure your spot.

Be Part of Something Big: Join the Summit

Registration is open for the Global Privacy Summit 2016. Discounted early bird rates available for a short time, register today!

Data Protection Intensive Returns to London

Registration is now open for the IAPP Europe Data Protection Intensive in London. Check out the program!

P.S.R. Call for Speakers Open!

P.S.R. is THE privacy + cloud security event of the year, and you can take a leading role. Propose a session for this year's program.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»