Data Protection & Privacy Certificate Program (Self-Paced)
IDCYSE.DPP.SP

Self-paced online training with expert support Certificate with 3 courses

A single email can fall under the Privacy Act, count as CUI, and be a federal record all at once — three sets of rules, each with real consequences for getting it wrong. Learn to identify and safeguard PII and PHI, recognize and mark CUI correctly, and manage federal records from creation through lawful disposition.

$1,639 13 clock hours Live Support Start anytime

This program includes

  • 13 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Verified digital certificate of completion
  • Learn at an accredited institution

This is a self-paced course. For live instruction, take the Data Protection & Privacy Certificate Program.

Sensitive information in federal work is governed by three separate sets of rules, and this program covers all of them. Privacy and PII/PHI Protection Awareness takes on the Privacy Act of 1974, the line between ordinary PII, sensitive PII, and protected health information, and the first hour after a suspected breach. CUI Handling and Data Classification moves to the CUI Registry, CUI Basic versus CUI Specified, assembling and placing markings, and safe storage, transmission, and destruction. Records and Information Governance finishes at the intermediate level with what counts as a federal record, how retention schedules set disposition, why an unscheduled record cannot lawfully be destroyed, and how a litigation hold overrides the schedule.

What makes the three work as a program is that the overlap was cut rather than repeated. The records course does not re-teach privacy, FOIA, or CUI; it shows how one record can carry several obligations at once and has learners practice deciding which one governs. The program also reaches material most compliance training leaves out — protected health information where non-clinical staff actually meet it, in occupational health and workers' compensation files; chat and collaboration platforms as a source of federal records; and current government-wide expectations for using CUI with AI tools. It is written for federal employees, contractors, and detailees who handle sensitive information as part of the job, and assumes no prior background.

Read more

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 3 Hours

Privacy and PII/PHI Protection Awareness Course (Self-Paced)

A foundational, agency-neutral privacy course spanning the Privacy Act, PII and PHI identification, safeguarding requirements, and the federal breach-response lifecycle.

  • The purpose and key requirements of the Privacy Act of 1974 and related federal privacy guidance
  • Defining and identifying PII and PHI across federal work contexts
  • The Fair Information Practice Principles applied to everyday activities
  • Administrative, physical, and technical safeguards for sensitive information
  • The steps to report and respond to a suspected or confirmed privacy incident
  • Individual roles and responsibilities in a culture of privacy protection

Unit 2 4 Hours

CUI Handling and Data Classification Course (Self-Paced)

Agency-neutral awareness training across the CUI lifecycle — recognition, categories, marking, handling, destruction, incident reporting, and CUI with AI tools.

  • CUI defined, and how it differs from classified and from public information
  • The government-wide legal and regulatory framework for CUI
  • CUI Basic versus CUI Specified, and checking a category in the CUI Registry
  • Interpreting and assembling banner markings, and portion marking
  • Need-to-know and safe handling in physical, electronic, and verbal forms
  • Approved storage, transmission, destruction, and sanitization
  • Responding when CUI is lost, mishandled, or improperly disclosed
  • Government-wide expectations for using CUI with AI tools

Unit 3 6 Hours

Records and Information Governance Course (Self-Paced)

Intermediate federal recordkeeping covering what counts as a record, the records lifecycle, retention and disposition scheduling, and electronic records in email, chat and collaboration platforms.

  • A federal record defined and separated from non-record material, convenience copies, drafts and personal papers
  • The legal and policy basis for federal recordkeeping, and who does what up to NARA
  • Each stage of the records lifecycle and individual responsibilities at each
  • Adequate and proper documentation, and common recordkeeping failures
  • Litigation holds and the duty not to alter or delete
  • Why an unscheduled record cannot be destroyed, and how General Records Schedules work
  • Temporary versus permanent records and end-of-retention outcomes
  • Reporting obligations after unauthorized or accidental destruction
  • Email, chat and collaboration messages as federal records
  • Metadata and electronic recordkeeping practice
  • Where records governance meets privacy, FOIA and CUI
  • Recurring compliance activities and escalation paths
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.