ISACA Expert

CDPSE

Certified Data Privacy Solutions Engineer

The CDPSE (Certified Data Privacy Solutions Engineer) certification validates the technical knowledge and skills needed to assess, build, and operationalize privacy-by-design solutions. Launched by ISACA in 2021, CDPSE is the first certification to combine privacy practices with technology and engineering principles.

The exam covers five domains: Privacy Governance (25%), Privacy Architecture (21%), Data Lifecycle Management (21%), Privacy Protection of Personal Data (18%), and Privacy Compliance and Audit (15%). Candidates must demonstrate expertise in privacy program governance, privacy-enhancing technologies, data classification and retention, encryption and de-identification techniques, and privacy compliance frameworks including GDPR, CCPA, and LGPD.

CDPSE is ideal for privacy engineers, data protection officers, security architects, software developers, and IT professionals responsible for implementing privacy solutions. The exam features 120 multiple-choice questions administered over 4 hours, with a scaled passing score of 450 out of 800 (approximately 56%). CDPSE requires a minimum of three years of cumulative experience in two or more of the five domains.

Updated 2024 Cybersecurity

120

Questions

Practice Tests

56%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CDPSE Practice Exam 1

Comprehensive 50-question practice exam covering all five CDPSE domains: Privacy Governance, Privacy Architecture, Data Lifecycle Management, Privacy Protection of Personal Data, and Privacy Compliance and Audit.

50 Q 120 minutes 70%

Test Drive

€5.00

CDPSE Practice Exam 2

50 Q 120 minutes 70%

Test Drive

€5.00

CDPSE Practice Exam 3

50 Q 120 minutes 70%

Test Drive

€5.00

CDPSE Practice Exam 4

Comprehensive 50-question practice exam covering all five CDPSE domains.

50 Q 120 minutes 70%

Test Drive

€5.00

CDPSE Practice Exam 5

Comprehensive 50-question practice exam covering all five CDPSE domains including privacy governance, privacy architecture, data lifecycle management, privacy protection of personal data, and privacy compliance and audit.

50 Q 120 minutes 70%

Test Drive

€5.00

CDPSE Practice Exam 6

Comprehensive 50-question practice exam covering all five CDPSE domains: privacy governance, privacy architecture, data lifecycle management, privacy protection of personal data, and privacy compliance and audit.

50 Q 60 minutes 70%

Test Drive

Unlock All Content for CDPSE

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

CDPSE Cheat Sheet

Quick reference guide - 6 sections

Free Access

CDPSE Exam Details

Detail	Value
Exam Code	CDPSE
Full Name	Certified Data Privacy Solutions Engineer
Issuing Body	ISACA
Duration	3.5 hours (210 minutes)
Number of Questions	120 multiple-choice questions
Passing Score	450 out of 800
Question Format	Multiple choice (single best answer)
Exam Fee	$575 USD (ISACA members) / $760 USD (non-members)
Delivery	PSI testing centers or remote proctored
Experience Requirement	Minimum 3 years in privacy governance OR technology-related privacy implementation
CPE Requirement	20 CPE hours/year, minimum 120 CPE hours over 3-year cycle

Domain Weight Breakdown

Domain	Weight
Domain 1: Privacy Governance	34%
Domain 2: Privacy Architecture	36%
Domain 3: Data Lifecycle	30%

Who Should Take This Exam

Privacy engineers and architects who design and implement technical privacy controls in systems and applications
Software developers and DevOps engineers who need to embed privacy-by-design principles into the development lifecycle
Data protection officers (DPOs) who want to bridge the gap between legal privacy requirements and technical implementation
Security professionals transitioning into privacy-focused roles who need to demonstrate technical privacy engineering competency
IT auditors and compliance analysts who evaluate the effectiveness of privacy controls in enterprise systems

Tip: The CDPSE is unique among privacy certifications because it focuses specifically on the technical implementation of privacy controls rather than the legal or regulatory aspects. Expect questions that test your ability to translate privacy requirements into concrete technical solutions, not just identify regulations.

Privacy Governance Framework

Privacy governance establishes the organizational structure, policies, and processes needed to ensure that personal data is handled responsibly and in compliance with applicable laws and regulations. A privacy governance framework defines accountability, outlines roles and responsibilities, sets the strategic direction for privacy management, and ensures that privacy objectives are aligned with business goals. The framework must be endorsed by senior leadership and communicated across the organization to be effective.

Component	Description	Responsibility
Privacy Policy	High-level statement of organizational commitment to data privacy	Board / Senior Management
Privacy Standards	Specific mandatory requirements for handling personal data	Privacy Office / CISO
Privacy Procedures	Step-by-step instructions for implementing privacy controls	IT / Engineering Teams
Privacy Guidelines	Recommended practices for privacy-related decisions	All Employees
Data Protection Impact Assessment (DPIA)	Systematic assessment of privacy risks in new projects or systems	Privacy Engineer / DPO

Key Privacy Regulations and Frameworks

Regulation / Framework	Jurisdiction	Key Requirements
GDPR	European Union	Lawful basis for processing, data subject rights, 72-hour breach notification, DPO requirement, privacy by design
CCPA / CPRA	California, USA	Right to know, right to delete, right to opt-out of sale, data minimization
LGPD	Brazil	Similar to GDPR with 10 legal bases for processing, DPO requirement
PIPEDA	Canada	10 fair information principles including consent, accountability, and safeguards
NIST Privacy Framework	Global (voluntary)	Identify, Govern, Control, Communicate, Protect functions
ISO/IEC 27701	Global (certifiable)	Privacy extension to ISO 27001/27002 for PIMS

Privacy Principles

Lawfulness, Fairness & Transparency: Personal data must be processed lawfully and transparently with clear notice to data subjects about how their data is used
Purpose Limitation: Data must be collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those purposes
Data Minimization: Only collect and process data that is adequate, relevant, and necessary for the intended purpose
Accuracy: Personal data must be kept accurate and up to date with reasonable steps taken to correct or erase inaccurate data
Storage Limitation: Data should be retained only for as long as necessary for the stated purpose and then securely disposed of
Integrity & Confidentiality: Appropriate technical and organizational measures must protect data against unauthorized access, loss, or destruction
Accountability: The data controller must demonstrate compliance with all principles through documentation, audits, and governance structures

Tip: The CDPSE exam heavily tests your ability to map privacy principles to technical controls. For example, “data minimization” translates to techniques like field-level encryption, data masking, pseudonymization, and designing systems to collect only required fields.

Privacy Roles and Responsibilities

Role	Responsibility
Data Controller	Determines the purposes and means of processing personal data. Legally accountable for compliance
Data Processor	Processes personal data on behalf of the controller. Must follow controller instructions and maintain security
Data Protection Officer (DPO)	Independent advisor on privacy compliance. Required under GDPR for certain organizations
Data Subject	The individual whose personal data is being processed. Has rights under privacy regulations
Privacy Engineer	Designs and implements technical privacy controls in systems and applications

Privacy by Design (PbD) Principles

Privacy by Design is a framework developed by Ann Cavoukian that requires privacy to be embedded into the design and architecture of IT systems and business practices from the outset, rather than being added as an afterthought. PbD is codified in GDPR Article 25 and is a core concept tested on the CDPSE exam.

Principle	Description	Technical Example
1. Proactive, Not Reactive	Anticipate and prevent privacy risks before they materialize	Threat modeling for privacy risks during design phase
2. Privacy as Default	Maximum privacy protection without user intervention	Opt-in consent models, minimal data collection by default
3. Privacy Embedded in Design	Privacy controls are integral to the system architecture	Data flow diagrams with privacy annotations, encryption at rest
4. Full Functionality (Positive-Sum)	Privacy and functionality are not trade-offs	Differential privacy for analytics without exposing individual data
5. End-to-End Security	Lifecycle protection from collection through deletion	TLS in transit, AES-256 at rest, secure deletion procedures
6. Visibility and Transparency	Operations are open and verifiable	Audit logging, privacy dashboards, published privacy notices
7. Respect for User Privacy	User-centric design with granular controls	Preference centers, consent management platforms, portability APIs

Privacy-Enhancing Technologies (PETs)

Technology	Description	Use Case
Pseudonymization	Replace identifiers with pseudonyms; reversible with a key	Research datasets, analytics environments
Anonymization	Irreversibly remove all identifying information from data	Public datasets, aggregate statistics
Tokenization	Replace sensitive data with non-sensitive tokens stored in a vault	Payment card data (PCI DSS), healthcare records
Data Masking	Obscure portions of data (e.g., showing only last 4 digits)	Customer-facing displays, non-production environments
Differential Privacy	Add mathematical noise to query results to prevent re-identification	Census data, machine learning training datasets
Homomorphic Encryption	Perform computations on encrypted data without decrypting it	Cloud computing on sensitive data, secure multiparty computation
Secure Multi-Party Computation	Multiple parties compute a function over inputs without revealing them	Collaborative analytics, joint fraud detection

Tip: Understand the key difference between pseudonymization and anonymization. Pseudonymized data is still personal data under GDPR because it can be re-identified with a key. Anonymized data is not personal data and falls outside GDPR scope entirely.

Consent Management Architecture

Consent Collection: Implement granular consent mechanisms that allow users to opt in or out of specific data processing activities. Consent must be freely given, specific, informed, and unambiguous
Consent Storage: Maintain an immutable audit trail of consent records including timestamp, version of privacy notice, specific purposes consented to, and method of consent
Consent Propagation: Distribute consent preferences to all downstream systems and third-party processors in real time. Use event-driven architectures or API-based consent signals
Consent Withdrawal: Provide simple mechanisms for users to withdraw consent at any time. Withdrawal must be as easy as giving consent and must trigger downstream processing cessation
Consent Management Platforms (CMPs): Centralized tools that handle cookie banners, preference centers, and consent record management across web and mobile channels

Data Protection Impact Assessment (DPIA)

When Required: Processing likely to result in high risk to data subjects (profiling, large-scale processing of sensitive data, systematic monitoring of public areas)
Process: Describe processing operations → assess necessity and proportionality → identify risks → determine mitigation measures → document and review
Technical Inputs: Data flow diagrams, system architecture documents, threat models, access control matrices, encryption specifications
Outcome: Either risks are mitigated to acceptable levels, or the supervisory authority must be consulted before processing begins

Tip: A DPIA is not a one-time activity. It must be reviewed and updated whenever there are significant changes to the processing activity, the technology used, or the risk landscape.

Data Lifecycle Stages

Stage	Privacy Controls	Technical Implementation
Collection	Purpose specification, consent, data minimization, notice	Consent APIs, form validation, required-field limits, privacy notices
Storage	Encryption, access control, data classification, retention policies	AES-256 encryption at rest, RBAC, data tagging, automated retention
Use / Processing	Purpose limitation, accuracy, lawful processing basis	Data access logging, purpose-bound processing rules, data quality checks
Sharing / Transfer	Third-party agreements, cross-border transfer mechanisms, data minimization	TLS encryption, API gateways, data masking for third parties, SCCs
Archival	Continued protection, limited access, retention period enforcement	Cold storage encryption, read-only access, automated expiry alerts
Destruction	Secure deletion, certificate of destruction, verification	Crypto-shredding, NIST 800-88 media sanitization, deletion logs

Data Classification for Privacy

Category	Examples	Protection Level
Sensitive Personal Data	Health records, biometric data, racial/ethnic origin, political opinions, sexual orientation	Highest — explicit consent required, additional safeguards
Personal Data (PII)	Name, email, phone number, IP address, location data, employee ID	High — lawful basis required, encryption recommended
Pseudonymized Data	Data with identifiers replaced by tokens (re-identification possible with key)	Medium — still personal data under GDPR, key must be secured separately
Anonymized Data	Aggregate statistics, fully de-identified datasets	Low — not personal data, outside regulatory scope

Data Subject Rights Implementation

Right	Description	Technical Solution
Right of Access (SAR)	Obtain copy of all personal data held	Data discovery APIs, automated SAR workflows, data inventory tools
Right to Rectification	Correct inaccurate personal data	Self-service profile editing, data quality validation, propagation to backups
Right to Erasure	Delete personal data (right to be forgotten)	Cascading delete APIs, crypto-shredding, backup purging procedures
Right to Portability	Receive data in machine-readable format	JSON/CSV export APIs, standardized data schemas
Right to Restrict Processing	Limit processing while disputes are resolved	Processing flags in database, conditional workflow logic
Right to Object	Object to processing for direct marketing or profiling	Opt-out mechanisms, suppression lists, preference management APIs

Tip: The right to erasure is not absolute. Organizations can refuse erasure when data is needed for legal compliance, public interest, or exercising legal claims. Know the exceptions and how to implement partial erasure where applicable.

Data Retention and Disposal

Retention Schedule: Define retention periods for each data category based on legal requirements, business needs, and privacy regulations. Automate enforcement through policy engines
Crypto-Shredding: Destroy the encryption key to render encrypted data permanently unreadable. Effective for cloud environments and backup tapes where physical destruction is impractical
NIST 800-88 Media Sanitization: Clear (overwrite), Purge (degauss or cryptographic erase), or Destroy (physical destruction) based on media type and data sensitivity
Backup Considerations: Deletion requests must eventually propagate to backups. Document backup retention cycles and set maximum time for backup purging

Cross-Border Transfer Mechanisms

Transferring personal data across international borders is one of the most complex aspects of privacy engineering. Different jurisdictions impose varying requirements, and the CDPSE exam tests your understanding of the legal mechanisms and technical safeguards needed to enable lawful cross-border data flows. Organizations must evaluate the adequacy of privacy protections in the destination country and implement appropriate transfer mechanisms where adequacy decisions do not exist.

Mechanism	Description	When Used
Adequacy Decision	EU Commission determines a country provides adequate data protection	Transfers to approved countries (e.g., Japan, UK, South Korea)
Standard Contractual Clauses (SCCs)	Pre-approved contract templates between data exporter and importer	Most common mechanism for EU-to-third-country transfers
Binding Corporate Rules (BCRs)	Internal privacy policies approved by supervisory authorities for intra-group transfers	Multinational corporations transferring data between subsidiaries
EU-US Data Privacy Framework	Self-certification mechanism replacing Privacy Shield	US companies receiving EU personal data
Derogations	Exceptions for specific situations (explicit consent, contract necessity, public interest)	One-off or occasional transfers when no other mechanism applies

Transfer Impact Assessments (TIAs)

Purpose: Evaluate whether the destination country's legal framework provides adequate protection for transferred personal data, especially considering government surveillance powers
Assessment Factors: Local surveillance laws, data protection authority effectiveness, rule of law, independent judiciary, data subject redress mechanisms
Supplementary Measures: When the assessment reveals gaps, implement additional technical (encryption, pseudonymization), contractual (enhanced audit rights), or organizational (strict access controls) measures
Documentation: Maintain records of all TIAs, supplementary measures applied, and periodic reassessments as laws change

Tip: After the Schrems II decision, simply relying on SCCs is not sufficient. You must conduct a TIA for every transfer to a non-adequate country and implement supplementary measures if the local laws undermine the effectiveness of the SCCs.

Privacy Compliance Monitoring

Activity	Frequency	Technical Tools
Data mapping and inventory	Continuous with quarterly reviews	Automated data discovery, classification tools, ROPA generators
Privacy audit	Annually or after major changes	Compliance checklists, control testing tools, evidence repositories
Consent compliance	Continuous monitoring	CMP dashboards, consent rate analytics, automated scanning
Third-party assessments	Before onboarding and annually	Vendor risk questionnaires, SOC 2 report reviews, contract audits
Breach readiness testing	Semi-annually	Tabletop exercises, incident simulation platforms, playbook reviews

Privacy Breach Response

Detection: Implement automated monitoring for unauthorized access, unusual data exports, and anomalous processing patterns using SIEM and DLP tools
Assessment: Determine the scope, severity, and categories of data affected. Assess the risk to data subjects' rights and freedoms
Notification (GDPR): Notify supervisory authority within 72 hours of becoming aware. Notify affected data subjects without undue delay if high risk exists
Notification (CCPA): Notify affected consumers if unencrypted personal information is breached. No specific timeline but “expeditious” notification required
Remediation: Contain the breach, eradicate the root cause, recover systems, and implement measures to prevent recurrence
Documentation: Maintain a breach register with details of all incidents, even those not requiring notification, as evidence of accountability

Pseudonymization vs Anonymization vs Tokenization

Feature	Pseudonymization	Anonymization	Tokenization
Reversibility	Reversible with a key	Irreversible	Reversible via token vault
GDPR Scope	Still personal data	Not personal data	Still personal data (original in vault)
Technique	Key-based substitution, hashing	Aggregation, k-anonymity, noise	Random token mapped to vault entry
Best For	Internal analytics, research	Public datasets, open data	Payment data, PCI compliance
Data Utility	High (can re-link)	Low (no re-linking)	Low (random tokens)

Controller vs Processor Obligations

Obligation	Controller	Processor
Purpose determination	Determines why and how data is processed	Processes only as instructed by controller
Legal basis	Must establish lawful basis for processing	Relies on controller's legal basis
Data subject requests	Primary responsibility to respond	Must assist controller in fulfilling requests
Breach notification	Notify authority within 72 hours	Notify controller without undue delay
Sub-processing	Must authorize sub-processors	Cannot engage sub-processor without authorization

GDPR Legal Bases for Processing

Legal Basis	Description	Example
Consent	Freely given, specific, informed, unambiguous	Marketing email opt-in, cookie consent
Contract	Necessary for performance of a contract	Processing shipping address to deliver goods
Legal Obligation	Required by law	Tax record retention, regulatory reporting
Vital Interest	Protect life of data subject or another person	Emergency medical data sharing
Public Interest	Necessary for a task in the public interest	Government health surveillance during pandemic
Legitimate Interest	Necessary for legitimate interests (requires balancing test)	Fraud prevention, network security monitoring

Privacy by Design vs Privacy by Default

Aspect	Privacy by Design	Privacy by Default
Focus	Embed privacy into system architecture	Maximum privacy without user action
Timing	During system design and development	At point of deployment and operation
Example	Building data minimization into the database schema	Social media profiles set to private by default
GDPR Article	Article 25(1)	Article 25(2)

Tip: On the CDPSE exam, remember that technical implementation is key. When a question asks about the BEST approach to privacy, look for answers that embed controls into the system design (proactive) rather than relying on policies or user behavior (reactive). The exam rewards engineering-minded solutions over procedural ones.

Exam Day Strategy

Focus on technical implementation: CDPSE is an engineering certification. Answers should emphasize technical controls (encryption, masking, APIs) over purely procedural or legal solutions
Know your PETs: Be able to select the right privacy-enhancing technology for a given scenario (pseudonymization vs anonymization vs tokenization)
Map principles to controls: Every privacy principle should connect to a concrete technical implementation in your mind
Understand data flows: Many questions present scenarios requiring you to trace data through systems and identify where privacy controls are needed
Read carefully: ISACA questions often contain qualifiers like “MOST important,” “BEST,” or “FIRST.” These words determine the correct answer when multiple options seem valid

CDPSE

Certified Data Privacy Solutions Engineer

CDPSE Practice Exam 1

CDPSE Practice Exam 2

CDPSE Practice Exam 3

CDPSE Practice Exam 4

CDPSE Practice Exam 5

CDPSE Practice Exam 6

Unlock All Content for CDPSE

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

CDPSE Cheat Sheet

CDPSE Exam Details

Domain Weight Breakdown

Who Should Take This Exam

Privacy Governance Framework

Key Privacy Regulations and Frameworks

Privacy Principles

Privacy Roles and Responsibilities

Privacy by Design (PbD) Principles

Privacy-Enhancing Technologies (PETs)

Consent Management Architecture

Data Protection Impact Assessment (DPIA)

Data Lifecycle Stages

Data Classification for Privacy

Data Subject Rights Implementation

Data Retention and Disposal

Cross-Border Transfer Mechanisms

Transfer Impact Assessments (TIAs)

Privacy Compliance Monitoring

Privacy Breach Response

Pseudonymization vs Anonymization vs Tokenization

Controller vs Processor Obligations

GDPR Legal Bases for Processing

Privacy by Design vs Privacy by Default

Exam Day Strategy