
The course introduction video with downloadable handout, the reference list for the course and Section 1.
The outline is updated from time-to-time, so feel free to check back and see the file revision date.
My main CIPP/US landing page, https://johnbandler.com/cippus/
My section 1 landing page, https://johnbandler.com/cippus/part1/
Also see:
FAQ page at https://johnbandler.com/cipp-us-frequently-asked-questions/
Updates page at https://johnbandler.com/cippus/updates/
Some more details about this course to learn US privacy law and privacy practice and prepare for the Certified Information Privacy Professional (CIPP/US) certification exam, from the IAPP. Quick intros to some important concepts.
Remember these main pages
My main CIPP/US landing page, https://johnbandler.com/cippus/
My section 1 landing page, https://johnbandler.com/cippus/part1/
Some tips on learning, studying, preparing for and taking an exam. For many, this is a refresher, but we can all use a reminder from time to time. This draws from these articles:
•How to Learn and Study, https://johnbandler.com/how-to-learn-and-study/
•How to Take an Exam, https://johnbandler.com/how-to-take-an-exam/
•Scaffolding, Layering, and Learning, https://johnbandler.com/scaffolding-layering-learning/
Just like the title says, an introduction to law and regulation. Non-lawyers, this helps get you up to speed. Lawyers, this might be a new way of looking at things, or you might find some new nuggets of information. More intro to law in BoK Domain I and in my handout and resources.
We talk about privacy, you, and your organization. Sort of like an Introduction to Privacy 101.
We talk about the CIPP/US certification and body of knowledge (BoK). Don't miss this video if you are studying for the CIPP/US exam. Last video of the section, let's put check marks to show everything we have covered.
We introduce Part 2, which covers Body of Knowledge (BoK) Domain 1. Download the Part Handout also.
Basics of U.S. law introduced, some terms. Important information on law everyone should know, a refresher for lawyers and law students.
Some basics of regulators (state and federal) who enforce U.S. privacy laws and regulations, and discuss self-regulatory frameworks (and why I put that in air quotes). We build our scaffold diagram up to level 3.
For Part 2, remember to check out the part handout and https://johnbandler.com/cippus/part2/
U.S. enforcement of privacy and cybersecurity laws 1, CIPP/US BoK I B (1 of 2)
Covering: Theories and concepts of liability, Criminal versus civil law and legal liability, Contracts, Negligence torts, Intentional torts, Fiduciary duty and ethics, Laws relating to unfair or deceptive acts and practices (UDAP) also known as unfair or deceptive trade practices (UDTP)
U.S. enforcement of privacy and cybersecurity laws 2, CIPP/US BoK I B (2 of 2) (Purposes, cross border, self-regulatory).
The purpose and theory of enforcement actions, Federal enforcement, State enforcement (state attorneys general [AGs], etc.), Cross-border enforcement issues (Global Privacy Enforcement Network (GPEN), APEC), Self-regulatory enforcement (PCI, trust marks).
Practices and controls, privacy programs, policies, and notices (preview), incidents (preview), training, accountability. Covering CIPP/US Bok 1 (C)(1-3). Where it's a preview, we dive deeper in a later video in this part.
Cover the basics before you go down any rabbit holes, but if you are ready, remember my handout to dive even deeper, and Part 2 references at https://johnbandler.com/cippus/part2/.
Information management 2: Data management. CIPP/US BoK I C (2 of 6)
Managing user preferences, data retention and disposal, FACTA mention, preview on privacy notices, privacy issues and the online environment
International stuff. Watch me bring me forth the longest list of initialisms you have ever seen, and then amaze yourself as you realize it's not all that bad. There are privacy provisions for transferring data between countries, we look at it from the U.S. perspective.
This lecture is just a placeholder as I update this entire course. Before this lecture are my 2026 updates as I update each section and video in the entire course. After this lecture are my older materials, which are still solid and valid. Thanks for your patience as I completely update this course with new videos. Feel free to continue on past this video. For more on CIPP/US updates, see https://johnbandler.com/cippus/updates/
My editing skills are a little improved with this update (from none to a little) and I am taking the extra time to edit my lecture and remove my longer pauses and the worst of my misspeaks and mistakes. It also triples the time it takes to make these videos.
Discover the FTC's cross-sector privacy protection under the FTC Act, section five, covering unfair or deceptive practices, COPPA, and enforcement on data brokers, big data, IoT, and AI.
Explore health sector privacy under HIPAA and HITECH, including privacy and security rules and breach notification. Identify covered entities and business associates, and the role of HHS OCR.
Explore how FCRA, FACTA, and GLBA shape financial sector privacy, safeguards, and consumer rights, including identity theft protections, AML/CTF, and regulatory oversight.
Explore FERPA's protections for students, education records, and rights of students or parents in K-12 and postsecondary settings, plus HIPAA, PRA, and COPPA implications for education technology.
Examine telecommunications and marketing privacy rules, including the telemarketing sales rule, TCPA, do-not-call registry, can-spam, wireless domain and CPNI protections. Identify regulators, enforcement, and evolving data ethics in digital advertising.
Examines national security and privacy, detailing FISA, Patriot Act, USA Freedom Act, and Cybersecurity Information Sharing Act, with national security letters, Section 702, Prism, Snowden disclosures, and encryption debates.
Explore the workplace privacy domain, covering before, during, and after employment, including automated decision tools, background screening, and the employer-employee privacy dynamics.
Learn the introduction to workplace privacy, including concepts, privacy basics, and regulators like eeoc, dol, ftc, nlrb, and osha, plus Ada and Gina.
Explore workplace privacy before, during, and after employment, covering background screening, monitoring, investigations, and termination, with emphasis on Fair Credit Reporting Act compliance and data protection.
Examine federal versus state authority in privacy and cybersecurity law, including potential preemption, the California privacy protection agency, and implications for a national standard.
Explore state data privacy and security laws, including CCPA/CPRA, Virginia CDPA, Colorado Privacy Act, Utah CPA, biometric privacy regulations, facial recognition restrictions, data destruction, breach reporting, and cookie regulations.
Examine state breach notification laws across 50 states, including definitions, triggers, notice requirements, and private rights of action. Learn to tailor privacy and incident response programs to state standards.
Prioritize studying by focusing on the body of knowledge and high-priority details across privacy domains, and set your exam date to guide steady learning and exam readiness.
This course is to help you prepare for the CIPP/US privacy certification exam and be a privacy professional and understand the materials.
This course was originally geared for lawyers and law students, assuming good legal knowledge and study skills, walking quickly through the CIPP/US body of knowledge.
Now this course is for more people, as I update the course, we expand some of the coverage of introductory law, and the modules are longer.
Many non-lawyers and non-law students have taken the course and found it helpful and excellent value. If you need extra help with basic law or basic study skills, please see my references, resources, or contact me. As I update the course, I am building more intro to law materials into it.
CIPP/US is the Certified Information Privacy Professional (United States) certification administered by the International Association of Privacy Professionals (IAPP). It covers a wide area of knowledge, with a heavy focus on privacy and cybersecurity law.
The CIPP/US body of knowledge is good to know, and IAPP (a non-profit) is an organization that provides solid information about privacy.
If you are a law student or a lawyer looking to advance your career and opportunities in data privacy and related areas, CIPP/US is a way to start and give you a boost. Learn and demonstrate your knowledge of privacy law and information governance.
For non-lawyers, learning about privacy and law is also important.
** Construction notice ** Starting August 23, 2026 I am updating the entire course, it will take me several weeks to complete if all goes well (and longer if it doesn't). The older lectures remain solid (priority basics of CIPP/US remain consistent), my handouts and website have updated resources. There will be minor disruption during this update process, as I record each module new, and replace the old, I appreciate your patience. ** As of 9/27/2026 I have fully updated the first 14 videos (through 2.8 in Section 2).**
I originally tried to keep this course as short and brief as possible (7+ hours) while still covering the body of knowledge and preparing you with high priority information. As I update it, the length will be considerably longer with expanded coverage. Still, this is a start, the rest is up to you.
This course is not for everyone but is right for some. It is lecture format, PowerPoint slides with main points in bullets, and I lecture as we go through the slides. I don't show my face much (since that makes recording easier and many learners don't have a preference anyway). I am not a professional entertainer nor comedian, and arguably this proves it. Neither am I an AI tool or AI generated slop. So take the course for the knowledge and information -- not for the entertainment. Take your personal preferences into consideration and see a few sample videos before you decide if this is right for you. If you have a problem or need something, message me.
Videos run up to 20 minutes, even 30 minutes. That's longer than what is recommended for average Udemy learners, and is a problem for some but not all. You decide what is right for you.
Previously, I prepared a full length CIPP/US prep course geared for information security professionals at a subscription based infosec online learning platform. That course is still live, and this Udemy course does not compete with that, but provides CIPP/US knowledge in an abbreviated format for a different audience and to help my students.
Building these courses is a hobby for me, I do not have significant video recording skills, nor hardly any video editing skills (it's getting a little better), and there is no production team, and I don't use AI tools, no AI generated graphics. It's my slides and my lectures. This original course had almost no editing, so you will hear my pauses and misspeaks, warts and all. The 2026 updates now have minor editing -- I remove some of those longer pauses and misspeaks. Rest assured my mistakes still happen, I just can edit them now so you don't hear them all.
Course topic note about Udemy topic categories: This course primarily teaches "privacy", "U.S. privacy", "privacy law" "CIPP/US", "IAPP CIPP/US", "privacy and cybersecurity law", and with a US focus.
When this course was first built, Udemy did not have a "privacy" category or a "CIPP/US" category nor a "privacy law" category. So the initial Udemy category wis simply "law". Just remember that "privacy" is an important professional career now, and is not just for lawyers and is not just about law (though law is important for privacy and is also everywhere around us).
Description updated 9/27/2026