What is covered on the CDPSE exam?
The Certified Data Privacy Solutions Engineer® (CDPSE®) exam consists of 120 questions covering 4 job practice domains, all testing your knowledge and ability on real-life job practices leveraged by expert professionals.
Below are the key domains, subtopics and tasks candidates will be tested on:
ISACA’S commitment
Since its inception in 2020, more than 16,000 people have obtained ISACA’s CDPSE certification of the expertise needed to assess, build and implement comprehensive privacy solutions. The domains, subtopics and tasks are the results of extensive research, feedback and validation from subject matter experts and prominent industry leaders from around the world.
Updated job practice areas tested for and validated by a CDPSE certification
20% DOMAIN 1 – PRIVACY GOVERNANCE
A—PRIVACY GOVERNANCE
- Personal Information
- Privacy Principles (e.g., Privacy by Design, Consent, Transparency)
- Privacy Laws and Regulations
- Privacy Documentation (e.g., Policies, Guidelines)
B—PRIVACY OPERATIONS
- Organizational Culture, Structure, and Responsibilities
- Vendor and Supply Chain Management
- Incident Management
- Data Subject Rights, Requests, and Notification
18% DOMAIN 2 – PRIVACY RISK MANAGEMENT AND COMPLIANCE
A—RISK MANAGEMENT
- Risk Management Process and Policies
- Privacy-Focused Assessment (e.g., Privacy Impact Assessment (PIA))
- Privacy Training and Awareness
- Threats and Vulnerabilities
- Risk Response
B—COMPLIANCE
- Privacy Frameworks
- Evidence and Artifacts
- Program Monitoring and Metrics
23% DOMAIN 3 – DATA LIFE CYCLE MANAGEMENT
A—DATA COLLECTION AND PROCESSING
- Data Inventory, Dataflow Diagram, and Classification
- Data Quality (e.g. Accuracy)
- Data Use Limitation
- Data Analytics (e.g., Aggregation, AI, Data Warehouse)
B—DATA PERSISTENCE AND DESTRUCTION
- Data Minimization
- Data Disclosure and Transfer
- Data Storage, Retention, and Archiving
- Data Destruction
39% DOMAIN 4 – PRIVACY ENGINEERING
A—TECHNOLOGY STACKS
- Infrastructure and Platform Technology (e.g., legacy, cloud computing)
- Devices and Endpoints
- Connectivity
- Secure Development Life Cycle
- APIs and Cloud-Native Services
B—PRIVACY RELATED SECURITY CONTROLS
- Asset Management
- Identity and Access Management
- Patch Management and Hardening
- Communication and Transport Protocols
- Encryption and Hashing
- Monitoring and Logging
C—PRIVACY CONTROLS
- Consent Tagging
- Tracking Technologies (e.g., cookie management)
- Anonymization and Pseudonymization
- Privacy Enhancing Technologies (PETs)
- AI/Machine Learning (ML) Considerations
SUPPORTING TASKS
- Identify internal and external requirements to develop and maintain the organization’s privacy programs.
- Review organizational programs to align with privacy related legal and regulatory requirements, industry best practices (e.g., privacy by design), and data subject’s expectations.
- Advise on data life cycle policies and practices to ensure privacy considerations for data governance.
- Design and evaluate the implementation of technical and operational controls for data classifications and data life cycle requirements.
- Perform privacy impact assessments (PIAs) and other privacy-focused assessments.
- Contribute to the integration of privacy principles (e.g., privacy by design) in the development of procedures and operational manuals for organizational needs.
- Collaborate with stakeholders to promote privacy principles (e.g., privacy by design) are followed during the design, development, and implementation of systems, applications, and infrastructure.
- Identify and assess privacy related threats and vulnerabilities.
- Contribute to the evaluation of contracts, service level agreements (SLAs), and privacy practices of vendors and other parties and subsequently monitor for compliance.
- Participate in the incident management process to address privacy impacts and support remediation.
- Collaborate with relevant stakeholders to address privacy compliance and risk response.
- Contribute to the evaluation of information architecture to support privacy by design principles and data considerations.
- Evaluate changes in regulatory landscape, emerging threats to privacy, and privacy enhancing technologies (PETs).
- Design, implement, and monitor processes and procedures to keep personal information inventory and dataflow records current and accurate.
- Advise on data classification for personal information to enable risk assessment and implementation of controls.
- Develop and monitor metrics to report on privacy program performance to relevant stakeholders.
- Advocate for advancing privacy posture and maturity as it aligns to the organizational objectives.
- Contribute to the development of educational content and conduct privacy training to promote a privacy aware culture.
- Promote accountability, fairness, and transparency throughout the data life cycle.
Getting ready for the exam
ISACA offers a variety of exam preparation resources including group training, self-paced training and study resources in various languages to help you prepare for your certification exam. Choose what works for your schedule and your studying needs.
ISACA glossary and CDPSE translations
Some CDPSE terms can be lost in translation. That is why ISACA has translated our CDPSE Terminology List into numerous languages, ensuring learners fully understand the materials. Please see the list of translations below. To learn more about key industry terms, please explore the ISACA glossary here.