Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

IAPP · Free, ad-free audio course

IAPP CIPP

A structured, audio-first learning route for IAPP CIPP, designed for focused review and practical understanding.

Listen to the complete course Browse 97 lessons

Hear the course trailer →

Every Bare Metal Cyber audio course is free and 100% ad-free.

Companion Books

Study with the audio course, then reinforce it in print.

The study guide helps you organize and revisit the material. The flashcards book adds active recall and rapid review across the course objectives.

PUT IT INTO PRACTICE

Practice IAPP CIPP/US concepts

Try 50 original BMC questions, review every explanation, and return to the lessons behind the answer. No login is required. Earn Challenge achievements and share your progress as you go.

50 original questionsExplanation after every answerAchievements and sharing
Open IAPP CIPP/US PracticeSee Challenge achievements

Independent BMC learning practice—not official exam items, a full mock exam, or an exam-readiness score.

Certification practice in the BMC Cyber Challenge

Complete Lesson Directory

Choose the exact subject you want to study.

Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.

97 lessons available

S01E01Transcript

Getting Started and Review

Exam Orientation: Purpose of the CIPP/US Credential

This opening episode introduces you to the Certified Information Privacy Professional/United States credential and why it has become the gold standard for privacy expertise in the U.S.…

Transcript availableSeptember 8, 2025
→
S01E02Transcript

Getting Started and Review

Study Strategy: Building a Prep Timeline and Pacing Plan

Preparation is as much about organization as it is about knowledge. This episode walks you through how to create a structured study timeline that balances your daily commitments with the demands of the CIPP/US Body of Knowledge.…

Transcript availableSeptember 8, 2025
→
S01E03Transcript

Getting Started and Review

Exam Format & Test Taking Skills: Question Types, Scoring, and Breaks Explained

Knowing what to expect on exam day is half the battle. In this episode, we break down the structure of the CIPP/US exam, including the multiple-choice question types, how scenario-based items are framed, and the scoring model used by the IAPP.…

Transcript availableSeptember 8, 2025
→
S01E04Transcript

Getting Started and Review

Exam Mindset & Retention Strategy: Flashcards, Audio Learning, and Note Cycles

Memorization alone won’t get you through the CIPP/US exam—you need a strategy for long-term retention. This episode explores proven study methods such as spaced repetition with flashcards, active recall exercises, and audio reinforcement.…

Transcript availableSeptember 8, 2025
→
S01E05Transcript

Getting Started and Review

Glossary Deep Dive: Domains I–II Terms

The glossary is more than a list of definitions—it’s a map of the exam’s language. In this first glossary deep dive, we focus on terms from Domains I and II, which cover the U.S.…

Transcript availableSeptember 8, 2025
→
S01E06Transcript

Getting Started and Review

Glossary Deep Dive: Domains III–IV Terms

Our second glossary session turns to Domains III and IV, covering government access to private-sector information and workplace privacy. These domains introduce terminology around subpoenas, national security powers, and workplace monitoring practices.…

Transcript availableSeptember 8, 2025
→
S01E07Transcript

Getting Started and Review

Glossary Deep Dive: Domain V and Cross-Cutting Terms

The third glossary episode covers Domain V and other cross-cutting terms that frequently surface across multiple sections of the exam.…

Transcript availableSeptember 8, 2025
→
S01E08Transcript

Domain I · The U.S. Privacy Environment

Domain I Overview: Scope, Structure, and Enforcement Themes

Domain I introduces the U.S. privacy environment at its broadest level. In this episode, we review how the branches of government shape privacy law, the sources of law that contribute to the framework, and the roles of regulatory authorities such as the FTC, FCC, and HHS.…

Transcript availableSeptember 8, 2025
→
S01E09Transcript

Domain I · The U.S. Privacy Environment

U.S. Legal Framework: Branches of Government and Privacy Roles

This episode examines how the structure of U.S. government influences the development and enforcement of privacy law. We look at the distinct roles of the legislative, executive, and judicial branches, and how statutes, regulations, and case law interact to shape privacy obligations.…

Transcript availableSeptember 8, 2025
→
S01E10Transcript

Domain I · The U.S. Privacy Environment

Sources of Law: Constitutions, Statutes, Case Law, and Contracts

Understanding sources of law is critical to mastering the CIPP/US. In this episode, we unpack the U.S. Constitution’s role in privacy, including federal preemption, the Bill of Rights, and state constitutional guarantees.…

Transcript availableSeptember 8, 2025
→
S01E13Transcript

Domain I · The U.S. Privacy Environment

State Oversight: Attorneys General and Insurance Departments

While federal agencies are powerful, state-level enforcement often drives privacy practice in the U.S. This episode highlights the role of state attorneys general, who bring enforcement actions under state privacy laws, consumer protection statutes, and data breach notification acts.…

Transcript availableSeptember 8, 2025
→
S01E14Transcript

Domain I · The U.S. Privacy Environment

Self-Regulatory Models: Industry Codes and Voluntary Frameworks

Not all privacy enforcement comes from government. This episode introduces self-regulatory models such as industry codes of conduct, seal programs, and voluntary frameworks.…

Transcript availableSeptember 8, 2025
→
S01E15Transcript

Domain I · The U.S. Privacy Environment

Enforcement Framework: Civil vs. Criminal Liability in Privacy Law

Liability is the heart of enforcement. In this episode, we distinguish between civil liability, such as damages from consumer lawsuits or regulatory penalties, and criminal liability, which may arise from intentional misconduct like fraud or unauthorized access.…

Transcript availableSeptember 8, 2025
→
S01E17Transcript

Domain I · The U.S. Privacy Environment

Negligence and UDAP: Unfair and Deceptive Acts in Enforcement

Negligence and unfair or deceptive acts and practices (UDAP) are core theories of liability in privacy enforcement. This episode explains how negligence involves failure to meet a standard of reasonable care, such as not securing personal data.…

Transcript availableSeptember 8, 2025
→
S01E18Transcript

Domain I · The U.S. Privacy Environment

Federal and State Enforcement: DOJ, CPPA, and State AGs

This episode focuses on the interplay of federal and state enforcement bodies. We begin with the Department of Justice, which prosecutes criminal violations and litigates civil cases on behalf of federal agencies.…

Transcript availableSeptember 8, 2025
→
S01E19Transcript

Domain I · The U.S. Privacy Environment

Cross-Border Enforcement: GPEN and International Cooperation

Privacy enforcement is increasingly global. This episode introduces the Global Privacy Enforcement Network (GPEN), a collaboration of regulators worldwide who share information and coordinate investigations.…

Transcript availableSeptember 8, 2025
→
S01E21Transcript

Domain I · The U.S. Privacy Environment

Information Management: Data Inventory and Classification Practices

Strong privacy programs begin with knowing what data you have. This episode covers how organizations build and maintain a data inventory, cataloging personal information across systems, applications, and vendors.…

Transcript availableSeptember 8, 2025
→
S01E22Transcript

Domain I · The U.S. Privacy Environment

Data Flow Mapping: Transfers, Sharing, and Accountability Controls

Data doesn’t stay put—it flows across systems, organizations, and borders. This episode explains how to map those flows, identify points of transfer, and implement controls that ensure compliance.…

Transcript availableSeptember 8, 2025
→
S01E23Transcript

Domain I · The U.S. Privacy Environment

Privacy Program Development: Workforce Training and Vendor Management

Building a privacy program is more than drafting policies—it requires embedding privacy into operations. In this episode, we cover workforce training, including how to tailor content for different roles and ensure employees understand their responsibilities.…

Transcript availableSeptember 8, 2025
→
S01E24Transcript

Domain I · The U.S. Privacy Environment

Cloud and Third-Party Sharing: Processing Agreements and Due Diligence

Cloud services and third-party vendors introduce unique privacy challenges. This episode examines how processing agreements define roles and responsibilities between controllers and processors, including clauses on security, breach notification, and sub-processing.…

Transcript availableSeptember 8, 2025
→
S01E25Transcript

Domain I · The U.S. Privacy Environment

Incident Response Programs: Ransomware and Vendor Incidents

Privacy law intersects with cybersecurity when incidents occur. This episode explains how organizations build incident response programs to address threats like ransomware, data breaches, and vendor security failures.…

Transcript availableSeptember 8, 2025
→
S01E26Transcript

Domain I · The U.S. Privacy Environment

Accountability Models: Demonstrating Compliance and Due Diligence

Accountability is the thread connecting all privacy obligations. In this episode, we define accountability models as frameworks for demonstrating compliance through documentation, assessments, and governance structures.…

Transcript availableSeptember 8, 2025
→
S01E27Transcript

Domain I · The U.S. Privacy Environment

Data Retention and Disposal: Lifecycle, Archiving, and Legal Holds

Data has a lifecycle, and managing it responsibly is critical for privacy compliance. This episode covers retention schedules that specify how long data must be kept, archival practices for historical or legal purposes, and secure disposal methods to prevent unauthorized access.…

Transcript availableSeptember 8, 2025
→
S01E28Transcript

Domain I · The U.S. Privacy Environment

Online Privacy: Tracking, Profiling, and Consumer Expectations

The online environment presents unique privacy risks. This episode examines how tracking technologies, behavioral profiling, and targeted advertising shape consumer experiences and regulatory responses.…

Transcript availableSeptember 8, 2025
→
S01E29Transcript

Domain I · The U.S. Privacy Environment

International Transfers: Schrems, SCCs, and Data Privacy Framework

U.S. companies regularly transfer data across borders, triggering international privacy obligations. This episode introduces the Schrems cases, which invalidated earlier EU-U.S.…

Transcript availableSeptember 8, 2025
→
S01E30Transcript

Domain I · The U.S. Privacy Environment

Multinational Conflicts: E-Discovery vs. EU Data Protection

Privacy law collides with other legal obligations when organizations face multinational conflicts. This episode highlights the tension between U.S. e-discovery requirements in litigation and EU data protection laws that restrict data transfers.…

Transcript availableSeptember 8, 2025
→
S01E31Transcript

Domain I · The U.S. Privacy Environment

Comparative Analysis: U.S. Privacy vs. GDPR and FADP

This episode explores how U.S. privacy frameworks compare to the European Union’s General Data Protection Regulation (GDPR) and Switzerland’s Federal Act on Data Protection (FADP).…

Transcript availableSeptember 8, 2025
→
S01E32Transcript

Domain II · Limits on Private-Sector Collection and Use

Domain II Overview: Federal vs. State Sector-Specific Frameworks

Domain II focuses on federal and state laws governing specific sectors such as health, finance, education, and telecommunications. This episode introduces the federal “sectoral” approach, where distinct statutes regulate different industries rather than one overarching law.…

Transcript availableSeptember 8, 2025
→
S01E33Transcript

Domain II · Limits on Private-Sector Collection and Use

FTC Authority: Section 5 and Consumer Protection in Privacy

The Federal Trade Commission is often described as the nation’s top privacy cop. This episode dives into Section 5 of the FTC Act, which prohibits unfair and deceptive acts or practices.…

Transcript availableSeptember 8, 2025
→
S01E34Transcript

Domain II · Limits on Private-Sector Collection and Use

COPPA: Children’s Online Privacy Protections in Services

Children’s privacy carries heightened protections in U.S. law. This episode introduces the Children’s Online Privacy Protection Act (COPPA), which governs the collection of personal information from children under 13.…

Transcript availableSeptember 8, 2025
→
S01E35Transcript

Domain II · Limits on Private-Sector Collection and Use

FTC Enforcement: Case Studies and Settlement Patterns

Enforcement brings theory into practice. In this episode, we review major FTC privacy and data security cases, highlighting recurring themes such as inadequate security, deceptive disclosures, and failure to honor stated practices.…

Transcript availableSeptember 8, 2025
→
S01E37Transcript

Domain II · Limits on Private-Sector Collection and Use

HIPAA Foundations: Privacy Rule Overview

The Health Insurance Portability and Accountability Act (HIPAA) remains one of the most significant federal privacy statutes. This episode explains the Privacy Rule, which establishes protections for protected health information (PHI).…

Transcript availableSeptember 8, 2025
→
S01E38Transcript

Domain II · Limits on Private-Sector Collection and Use

HIPAA Security Rule: Administrative, Physical, Technical Safeguards

Complementing the Privacy Rule, the HIPAA Security Rule sets standards for protecting electronic protected health information (ePHI). This episode breaks down its three safeguard categories: administrative, physical, and technical.…

Transcript availableSeptember 8, 2025
→
S01E39Transcript

Domain II · Limits on Private-Sector Collection and Use

HITECH: Enforcement and Breach Notification Enhancements

The Health Information Technology for Economic and Clinical Health Act (HITECH) strengthened HIPAA enforcement and introduced federal breach notification requirements.…

Transcript availableSeptember 8, 2025
→
S01E40Transcript

Domain II · Limits on Private-Sector Collection and Use

21st Century Cures: Interoperability and Data Sharing

The 21st Century Cures Act sought to promote innovation by improving interoperability and data sharing in healthcare. This episode explains how the Act prohibits “information blocking,” requiring health IT systems to enable secure, authorized data exchange.…

Transcript availableSeptember 8, 2025
→
S01E41Transcript

Domain II · Limits on Private-Sector Collection and Use

Substance Use Disorder Records: 42 CFR Part 2 Protections

Health information involving substance use disorder patients receives special protections under federal law. This episode explains 42 CFR Part 2, which imposes stricter confidentiality standards than HIPAA.…

Transcript availableSeptember 8, 2025
→
S01E42Transcript

Domain II · Limits on Private-Sector Collection and Use

Financial Privacy: FCRA and FACTA Requirements

Financial data is heavily regulated in the U.S., and two major statutes govern its use: the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA).…

Transcript availableSeptember 8, 2025
→
S01E43Transcript

Domain II · Limits on Private-Sector Collection and Use

GLBA: Privacy Rule, Safeguards Rule, and State Exemptions

The Gramm-Leach-Bliley Act (GLBA) governs privacy in the financial services sector. This episode introduces the GLBA Privacy Rule, which requires clear disclosures about data sharing and provides consumers the right to opt out of certain uses.…

Transcript availableSeptember 8, 2025
→
S01E44Transcript

Domain II · Limits on Private-Sector Collection and Use

Identity Theft Prevention: Red Flags Rule in Practice

The Red Flags Rule is designed to help organizations detect, prevent, and mitigate identity theft. This episode explains how financial institutions and certain creditors must develop programs that identify warning signs—or “red flags”—of potential fraud.…

Transcript availableSeptember 8, 2025
→
S01E45Transcript

Domain II · Limits on Private-Sector Collection and Use

Dodd-Frank: CFPB Oversight of Consumer Financial Privacy

The Dodd-Frank Wall Street Reform and Consumer Protection Act created the Consumer Financial Protection Bureau (CFPB), which plays a central role in financial privacy.…

Transcript availableSeptember 8, 2025
→
S01E46Transcript

Domain II · Limits on Private-Sector Collection and Use

Online Banking: Biometrics, Third-Party Tracking, and Security

Online banking raises unique privacy issues. This episode looks at how institutions use biometrics for authentication, the risks of third-party tracking in financial apps, and the growing security concerns in digital transactions.…

Transcript availableSeptember 8, 2025
→
S01E47Transcript

Domain II · Limits on Private-Sector Collection and Use

Corporate Transactions: Privacy in Mergers, Acquisitions, and Divestitures

Mergers and acquisitions often involve transferring large volumes of personal data. This episode explains the privacy implications of corporate transactions, including how due diligence identifies risks and how contracts manage ongoing obligations.…

Transcript availableSeptember 8, 2025
→
S01E48Transcript

Domain II · Limits on Private-Sector Collection and Use

FERPA: Education Records and Student Rights

The Family Educational Rights and Privacy Act (FERPA) governs the privacy of student education records. This episode explains the rights it grants to parents and students, including access, correction, and consent for disclosure.…

Transcript availableSeptember 8, 2025
→
S01E49Transcript

Domain II · Limits on Private-Sector Collection and Use

EdTech Risks: Privacy and Security in Educational Technologies

As schools adopt digital platforms, new privacy and security risks emerge. This episode explores issues such as online learning platforms collecting student data, targeted advertising in education settings, and cybersecurity vulnerabilities.…

Transcript availableSeptember 8, 2025
→
S01E50Transcript

Domain II · Limits on Private-Sector Collection and Use

Telemarketing Rules: TSR and TCPA

Telemarketing is tightly regulated under the Telemarketing Sales Rule (TSR) and the Telephone Consumer Protection Act (TCPA).…

Transcript availableSeptember 8, 2025
→
S01E51Transcript

Domain II · Limits on Private-Sector Collection and Use

Email and Fax Marketing: CAN-SPAM and JFPA

Electronic communications are major areas of privacy regulation. This episode explores the CAN-SPAM Act, which sets standards for commercial email, including opt-out requirements, truth in subject lines, and identification of advertisements.…

Transcript availableSeptember 8, 2025
→
S01E53Transcript

Domain II · Limits on Private-Sector Collection and Use

Do-Not-Call Registries: DNC and Wireless Domain Registry

Telemarketing restrictions extend beyond the TSR and TCPA through registries that give consumers control. This episode explains the National Do-Not-Call (DNC) Registry, how consumers enroll, and the obligations it imposes on telemarketers.…

Transcript availableSeptember 8, 2025
→
S01E54Transcript

Domain II · Limits on Private-Sector Collection and Use

Digital Advertising: Behavioral Tracking and Privacy Implications

Digital advertising relies heavily on tracking and profiling. This episode covers cookies, pixels, and device identifiers, along with how they enable targeted ads. We’ll examine the privacy implications of these practices, including transparency, consent, and opt-out mechanisms.…

Transcript availableSeptember 8, 2025
→
S01E55Transcript

Domain II · Limits on Private-Sector Collection and Use

Web Scraping: Data Ethics and Legal Risk Considerations

Web scraping raises both ethical and legal challenges. This episode explains how scraping can collect vast amounts of personal information, often without consumer knowledge.…

Transcript availableSeptember 8, 2025
→
S01E56Transcript

Domain III · Government and Court Access to Private-Sector Information

Domain III Overview: Privacy and Government Requests for Data

Domain III introduces the critical issue of government access to private-sector information. This episode provides an overview of how laws regulate subpoenas, warrants, and requests from law enforcement or intelligence agencies.…

Transcript availableSeptember 8, 2025
→
S01E59Transcript

Domain III · Government and Court Access to Private-Sector Information

National Security: FISA and Section 702 Surveillance Authorities

National security laws create unique privacy challenges. This episode introduces the Foreign Intelligence Surveillance Act (FISA) and its Amendments Act, particularly Section 702, which authorizes surveillance of foreign targets.…

Transcript availableSeptember 8, 2025
→
S01E60Transcript

Domain III · Government and Court Access to Private-Sector Information

USA PATRIOT Act: Expanded Authority for Security Investigations

Passed after September 11, the USA PATRIOT Act expanded government surveillance powers. This episode covers how the Act broadened authority for accessing communications, financial records, and other personal data in the name of counterterrorism.…

Transcript availableSeptember 8, 2025
→
S01E61Transcript

Domain III · Government and Court Access to Private-Sector Information

USA Freedom Act: Reforms to Bulk Collection

This episode covers the USA Freedom Act of 2015, which curtailed some of the sweeping surveillance authorities established under the USA PATRIOT Act.…

Transcript availableSeptember 8, 2025
→
S01E63Transcript

Domain III · Government and Court Access to Private-Sector Information

Media Protections: Privacy Protection Act and Compelled Disclosure

Media and journalism face unique privacy issues when government seeks access to information. This episode covers the Privacy Protection Act of 1980, which restricts government searches and seizures of media materials.…

Transcript availableSeptember 8, 2025
→
S01E64Transcript

Domain III · Government and Court Access to Private-Sector Information

E-Discovery: Managing Personal Data in Civil Litigation

Civil litigation often requires the disclosure of large volumes of data, raising significant privacy concerns. This episode explains the role of electronic discovery (e-discovery), including how personal information is identified, reviewed, and produced during legal proceedings.…

Transcript availableSeptember 8, 2025
→
S01E65Transcript

Domain IV · Workplace Privacy

Domain IV Overview: Employment Privacy from Hiring to Termination

Domain IV addresses privacy issues throughout the employment lifecycle. This episode provides an overview of pre-employment screening, workplace monitoring, and post-employment records retention.…

Transcript availableSeptember 8, 2025
→
S01E68Transcript

Domain IV · Workplace Privacy

Pre-Employment Tools: AI Hiring and Bias Mitigation

Employers increasingly use AI-driven tools for hiring, but these technologies raise privacy and fairness concerns. This episode explains how automated decision-making tools are regulated, including requirements for transparency, bias audits, and applicant rights.…

Transcript availableSeptember 8, 2025
→
S01E70Transcript

Domain IV · Workplace Privacy

Social Media Monitoring: Policies and Union Considerations

Employers increasingly monitor social media use, both during hiring and employment. This episode explores the privacy risks, including potential discrimination, reputational harm, and conflicts with labor rights.…

Transcript availableSeptember 8, 2025
→
S01E71Transcript

Domain IV · Workplace Privacy

Employee Monitoring: Computers, Email, Phone, and Video

Employers often monitor employees’ use of technology and communications systems, raising important privacy issues. This episode examines the scope of monitoring activities, including computer usage, email systems, telephone records, and workplace video surveillance.…

Transcript availableSeptember 8, 2025
→
S01E72Transcript

Domain IV · Workplace Privacy

Biometrics and Location: LBS, Wearables, and Wellness Programs

Biometric data and location-based services present unique privacy challenges in the workplace. This episode reviews how employers use tools like fingerprint scanners, facial recognition, GPS tracking, and wearable devices to monitor attendance, productivity, and health.…

Transcript availableSeptember 8, 2025
→
S01E73Transcript

Domain IV · Workplace Privacy

Internal Investigations: Misconduct, Documentation, and Handling

Organizations must often conduct internal investigations into employee misconduct, which involves significant privacy considerations. This episode explores how investigations collect and handle personal information, including interviews, system logs, and third-party services.…

Transcript availableSeptember 8, 2025
→
S01E74Transcript

Domain IV · Workplace Privacy

ECPA at Work: Employer Obligations and Exceptions

The Electronic Communications Privacy Act (ECPA) plays a major role in regulating workplace privacy. This episode explains how the Act governs the interception and access of electronic communications, including email and phone calls, in the employment context.…

Transcript availableSeptember 8, 2025
→
S01E75Transcript

Domain IV · Workplace Privacy

Post-Employment: Records, References, and Retention Duties

Privacy obligations continue even after employment ends. This episode reviews how employers manage personnel records after termination, including requirements for retention and eventual disposal.…

Transcript availableSeptember 8, 2025
→
S01E77Transcript

Domain V · State Privacy Laws

State Authority: Attorneys General and CPPA Oversight

State enforcement has become increasingly influential in privacy regulation. This episode examines the role of state attorneys general, who bring actions under both state privacy laws and general consumer protection statutes.…

Transcript availableSeptember 8, 2025
→
S01E78Transcript

Domain V · State Privacy Laws

Applicability Tests: Resident Thresholds, Revenue, and Exemptions

Comprehensive state privacy laws often hinge on applicability thresholds. This episode explores the criteria that determine whether a business must comply, such as number of state residents, annual revenue, or percentage of revenue from selling personal information.…

Transcript availableSeptember 8, 2025
→
S01E79Transcript

Domain V · State Privacy Laws

Data Subject Rights: Access, Deletion, Portability, and Consent

State laws grant individuals a suite of rights over their personal data. This episode explains the rights to access, correct, delete, and port data, as well as opt-out and consent requirements.…

Transcript availableSeptember 8, 2025
→
S01E80Transcript

Domain V · State Privacy Laws

Privacy Notices: Transparency and Consumer Disclosures

Transparency is a cornerstone of state privacy laws. This episode covers the requirements for privacy notices, including disclosures about data collection, use, sharing, and consumer rights.…

Transcript availableSeptember 8, 2025
→
S01E81Transcript

Domain V · State Privacy Laws

Data Protection Agreements: Contracts and Assessments

Contracts are central to ensuring compliance with state privacy laws. This episode explains how data protection agreements define the obligations between controllers and processors, including rules for data use, security, subcontracting, and breach notification.…

Transcript availableSeptember 8, 2025
→
S01E82Transcript

Domain V · State Privacy Laws

State Security Requirements: Common Controls Across Jurisdictions

Most state privacy laws include explicit security requirements. This episode reviews common obligations such as implementing reasonable safeguards, risk-based controls, encryption, and access restrictions.…

Transcript availableSeptember 8, 2025
→
S01E83Transcript

Domain V · State Privacy Laws

Health Data Rules: WA MHMD, NV Health Data Act, and IL GIPA

Beyond HIPAA, states have introduced new health data privacy statutes. This episode explores Washington’s My Health My Data Act (MHMD), Nevada’s Consumer Health Data Privacy Act, and Illinois’ Genetic Information Privacy Act (GIPA).…

Transcript availableSeptember 8, 2025
→
S01E84Transcript

Domain V · State Privacy Laws

Cookies and Tracking: Online Privacy Regulations

State laws increasingly regulate cookies, pixels, and online tracking. This episode explains how transparency, consent, and opt-out obligations apply to digital advertising technologies.…

Transcript availableSeptember 8, 2025
→
S01E87Transcript

Domain V · State Privacy Laws

California CCPA/CPRA: Comprehensive Consumer Privacy Framework

California remains the leader in state privacy law. This episode reviews the California Consumer Privacy Act (CCPA) and its amendment through the California Privacy Rights Act (CPRA).…

Transcript availableSeptember 8, 2025
→
S01E88Transcript

Domain V · State Privacy Laws

California AADC: Age-Appropriate Design Code Protections

Children’s privacy receives special attention in California’s Age-Appropriate Design Code Act (AADC). This episode explains its requirements for online services likely to be accessed by minors, including risk assessments, high privacy default settings, and restrictions on profiling.…

Transcript availableSeptember 8, 2025
→
S01E89Transcript

Domain V · State Privacy Laws

California Delete Act: Data Broker Registration and Rights

The California Delete Act introduces obligations for data brokers, requiring them to register and enabling consumers to request deletion of their data from all registered brokers at once.…

Transcript availableSeptember 8, 2025
→
S01E90Transcript

Domain V · State Privacy Laws

Virginia CDPA: Consumer Data Protection Act Essentials

Virginia’s Consumer Data Protection Act (CDPA) established one of the first comprehensive state privacy frameworks outside California. This episode reviews its applicability thresholds, consumer rights, and obligations for controllers and processors.…

Transcript availableSeptember 8, 2025
→
S01E91Transcript

Domain V · State Privacy Laws

Colorado Privacy Act: Rights, Duties, and Insurance Bias Provisions

Colorado’s Privacy Act builds on the momentum from California and Virginia, offering a comprehensive framework with unique twists. This episode reviews its applicability standards, consumer rights, and controller/processor obligations, including data protection assessments.…

Transcript availableSeptember 8, 2025
→
S01E92Transcript

Domain V · State Privacy Laws

Other State Acts: Emerging Comprehensive Privacy Laws

Beyond California, Virginia, and Colorado, many states are adopting or considering comprehensive privacy laws. This episode surveys these developments, highlighting features of statutes in states like Connecticut, Utah, and others.…

Transcript availableSeptember 8, 2025
→
S01E93Transcript

Domain V · State Privacy Laws

Enforcement Mechanics: Cure Periods and Penalties

Enforcement provisions determine how state privacy laws are applied in practice. This episode explains cure periods, which give businesses time to fix violations before penalties are imposed, and how these provisions differ across states.…

Transcript availableSeptember 8, 2025
→
S01E94Transcript

Domain V · State Privacy Laws

Breach Notification: Definitions, Triggers, and Scope

State breach notification laws form one of the most uniform yet varied areas of privacy law. This episode reviews the common elements—definitions of personal information, what constitutes a breach, and when notification is required.…

Transcript availableSeptember 8, 2025
→
S01E95Transcript

Domain V · State Privacy Laws

State Variations: Comparing Notification Timelines and Duties

Even within the common framework of breach notification, state differences matter. This episode compares notification timelines, which can range from “without unreasonable delay” to fixed deadlines like 30 or 45 days.…

Transcript availableSeptember 8, 2025
→
S01E96Transcript

Domain V · State Privacy Laws

Recent Changes: Pennsylvania SB 696 and Utah S.B. 127

State privacy laws continue to evolve. This episode reviews recent changes, such as Pennsylvania SB 696, which updated breach notification requirements, and Utah S.B. 127, which amended cybersecurity provisions.…

Transcript availableSeptember 8, 2025
→

A Practical Study Routine

Listen, read, and review in the order that works for you.

01

Listen

Use the free audio course during a commute, walk, workout, or focused study session.

02

Read

Use the study guide to organize the material, annotate key ideas, and build a reference you can return to.

03

Review

Use the flashcards book to practice active recall and quickly revisit weak areas.

Related Magazine Features

Connect the course to current cybersecurity analysis.

Cover art for Regulation Whiplash: Living Between DORA, NIS2, and SEC Disclosures
Issue 32 · August 12, 2026Regulation Whiplash: Living Between DORA, NIS2, and SEC DisclosuresRead the feature →

Related Cyber Wiki

Continue with the concepts behind the course.

Responsible AI

AI Bias and Fairness Assessment

AI bias and fairness assessment evaluates how data, labels, objectives, design choices, and deployment conditions can create uneven errors or harms across groups.

AI privacy governance

AI Data Rights and Deletion

AI data-rights and deletion processes handle access, correction, objection, restriction, portability, and erasure across datasets, models, embeddings, caches, logs, and derived outputs.

AI governance

AI Governance Roles and Accountability

AI governance roles assign decision rights and obligations across executives, business owners, developers, data stewards, security, privacy, legal, risk, and users.

AI transparency

AI Transparency Notices

AI transparency notices tell people when AI is used, what it does, what information it relies on, important limitations, and how to seek review or correction.

Security principle

Accountability

Accountability makes people, roles, services, and organizations answerable for security decisions and actions by assigning ownership and preserving reliable evidence.

Privacy engineering

Anonymization and De-identification

Anonymization and de-identification reduce the ability to associate released or shared data with a specific person, while accounting for linkage and re-identification risk.