ISACA · CDPSE
Validates the technical skills and knowledge to assess, build and implement comprehensive data privacy measures across privacy governance, risk management, data lifecycle, and privacy engineering.
Practice Questions
749
≈ 4 practice exams
Duration
210 minutes
Passing Score
450/800
Difficulty
ProfessionalLast Updated
Jan 2026
Use this CDPSE practice exam to prepare for Certified Data Privacy Solutions Engineer (CDPSE) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 749 questions for ISACA CDPSE, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Privacy Governance, Privacy Risk Management and Compliance, Data Life Cycle Management, and Privacy Engineering. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Certified Data Privacy Solutions Engineer (CDPSE) is a globally recognized, experience-based technical certification awarded by ISACA that validates the skills required to assess, build, and implement comprehensive data privacy measures. Unlike policy-focused privacy credentials, CDPSE is specifically designed for technology professionals who translate privacy requirements into working technical solutions — implementing privacy by design across systems, networks, and applications. The certification covers four core domains: Privacy Governance, Privacy Risk Management and Compliance, Data Life Cycle Management, and Privacy Engineering, with particular emphasis on technical implementation areas such as encryption, anonymization, identity and access management, and privacy-enhancing technologies (PETs).
First introduced by ISACA, the CDPSE has grown to more than 16,000 credential holders worldwide and was updated with a revised Body of Knowledge taking effect in April 2025, reflecting evolving regulations such as GDPR and CCPA, emerging AI/ML privacy challenges, and modern infrastructure requirements. The certification demonstrates that holders can not only understand privacy frameworks but engineer privacy controls into real-world technology platforms and data pipelines.
CDPSE is intended for mid-to-senior level technology professionals who are actively involved in building and implementing privacy solutions rather than defining policy. Relevant job roles include Privacy Engineers, Data Protection Engineers, Security Architects, Cloud Engineers, DevOps professionals with privacy responsibilities, IT Risk Managers, and Compliance Technologists. Professionals working in environments subject to GDPR, CCPA, HIPAA, or other data protection regulations will find particular value in this credential.
Candidates are expected to have a minimum of three years of cumulative work experience performing CDPSE job practice tasks within the ten-year period preceding their application. The exam itself is open to anyone, including those who have not yet met the experience threshold, but full certification requires verified professional experience submitted through an ISACA account within five years of passing the exam.
There are no formal educational prerequisites to sit for the CDPSE exam. However, ISACA recommends that candidates have at least three years of hands-on experience in roles involving privacy technology implementation, data governance, risk management, or security engineering. This experience must be directly tied to the four CDPSE job practice domains and verifiable by a supervisor or manager.
A solid foundational understanding of networking, cloud infrastructure, application development, and information security is strongly recommended before attempting the exam. Familiarity with major privacy regulations (GDPR, CCPA), Privacy Impact Assessments (PIAs), data classification methodologies, encryption standards, and identity and access management concepts will be essential. Professionals who already hold ISACA certifications such as CISA or CISM, or industry credentials such as CISSP or CIPP, will find significant content overlap and may require less preparation time.
The CDPSE exam consists of 120 multiple-choice questions, each with a single best answer, to be completed within 210 minutes (3.5 hours). Questions are scenario-based and assess applied knowledge rather than rote memorization, requiring candidates to evaluate real-world privacy engineering situations. The exam is scored on a scale of 200 to 800, with a passing score of 450. ISACA uses scaled scoring to account for variation in difficulty across exam versions.
The exam is delivered as a computer-based test and is available at authorized PSI testing centers worldwide or via remote proctoring, allowing candidates to test from their own location. Registration is open on a continuous basis, and testing appointments can be scheduled as early as 48 hours after fee payment. The exam is available in English, Chinese Simplified, Spanish, and German. Candidates who do not pass may retake the exam up to four times within a rolling 12-month period, with each attempt requiring full payment of the exam fee ($575 for ISACA members, $760 for non-members).
CDPSE-certified professionals are positioned at the intersection of two high-demand fields — cybersecurity and data privacy — making them highly sought after as organizations scale their compliance programs to meet GDPR, CCPA, and other global regulations. Common roles for credential holders include Privacy Engineer, Data Protection Officer (technical track), Security Architect, Cloud Privacy Specialist, and IT Risk Analyst with privacy focus. ISACA data indicates that the average annual salary for CDPSE holders in the United States exceeds $150,000, ranking it among the top-paid certifications in information security. More than half of credential holders report applying CDPSE skills daily, and 42% report measurable productivity gains attributable to the certification.
Compared to policy-oriented privacy credentials such as the IAPP's CIPP or CIPM, CDPSE occupies a distinct technical niche, making it the preferred credential for engineers and architects rather than privacy counsel or compliance officers. For professionals who already hold CISA, CISM, or CISSP, CDPSE adds a specialized privacy engineering layer that complements broader security governance credentials. With more than 16,000 holders globally and growing regulatory pressure across industries including healthcare, finance, and technology, demand for CDPSE-qualified professionals continues to increase.
5 sample questions with answers and explanations. The full bank has 749 questions, enough for 4 full-length practice exams.
Preview — answers shown1. A financial services company is implementing Global Privacy Control (GPC) compliance for its California customers. The company's web application must detect and honor GPC signals. Which two technical implementations are required to properly detect GPC signals? (Select two!)
Multiple correct answersExplanation
GPC signals are transmitted through two mechanisms: the Sec-GPC HTTP header set to 1 and the navigator.globalPrivacyControl JavaScript property set to true. Both must be checked to properly detect GPC signals across different contexts (server-side vs client-side). The /.well-known/gpc.json resource is used by sites to indicate their support for GPC, not to detect user preferences. DNT (Do Not Track) is a deprecated mechanism that GPC replaces, and is not part of GPC implementation. IAB TCF consent strings are separate from GPC signals and serve different purposes under different legal frameworks (GDPR vs CCPA/CPRA).
2. A privacy engineer is implementing Dr. Ann Cavoukian's Privacy by Design principle of 'Privacy as the Default Setting' for a new mobile health application. The development team proposes collecting user location data, health metrics, and social connections, with users able to disable each data collection type through settings after initial app launch. Does this implementation satisfy the 'Privacy as the Default Setting' principle? (Select one!)
Explanation
Privacy as the Default Setting requires that privacy protection be automatic and built-in without requiring any action from the user. The proposed implementation fails this principle because it collects all data types by default and requires users to actively disable collection. Privacy must be the default state, not an opt-in or user-configured setting. Simply providing settings to disable data collection after the fact does not satisfy the principle. Granular control is valuable for user empowerment but does not fulfill the default privacy requirement if collection occurs automatically until disabled. No exemptions exist for mobile health apps regarding Privacy by Design principles; in fact, health apps processing sensitive data should have heightened privacy protections. GDPR Article 25(2) codifies this principle, requiring that by default, only personal data necessary for each specific purpose is processed.
3. A privacy architect implements Privacy by Design following Dr. Ann Cavoukian's seven foundational principles for a new IoT smart home platform. The system automatically enables the most privacy-protective settings without requiring user configuration, encrypts all data throughout its lifecycle from collection to deletion, and allows users to access privacy settings. However, the system collects extensive sensor data to enable advanced features. Which Privacy by Design principle is violated? (Select one!)
Explanation
Full Functionality (Positive-Sum) principle requires achieving both privacy and functionality without false trade-offs, but collecting extensive sensor data to enable advanced features suggests a trade-off where functionality is prioritized over privacy rather than achieving both objectives. The principle rejects the notion that privacy must be sacrificed for functionality. Proactive not Reactive is not violated if the system was designed with privacy in mind from the start; the scenario does not indicate purely reactive privacy measures. Privacy as Default is actually implemented correctly because the most privacy-protective settings are automatically enabled without user action, which satisfies GDPR Article 25(2). End-to-End Security is satisfied because encryption covers the full lifecycle from collection through disposal, meeting this principle's requirements.
4. A privacy compliance manager compares GDPR pseudonymization with full anonymization for a customer analytics project. The legal team wants to determine whether GDPR data subject rights apply to the processed dataset. What is the critical distinction determining GDPR applicability? (Select one!)
Explanation
Pseudonymization under GDPR Article 4(5) is reversible with additional information kept separately and remains in GDPR scope, requiring data subject rights fulfillment. Anonymization per Recital 26 is irreversible and falls outside GDPR scope. This reversibility distinction is critical for determining legal obligations. Anonymized data is out of scope, not in scope. Pseudonymization does not remove data from GDPR scope because it remains personal data. The relationship between pseudonymization and GDPR scope is exactly opposite to the stated reversal in the fourth option.
5. A global retail company is implementing a Records of Processing Activities (ROPA) system to comply with GDPR Article 30. The company has 180 employees in its European subsidiary, which processes customer orders, employee HR data, and marketing analytics. The subsidiary conducts occasional processing of biometric data for facility access control affecting approximately 45 employees. Which statement accurately describes the ROPA requirements for this subsidiary? (Select one!)
Explanation
GDPR Article 30(5) provides an exemption from ROPA requirements for organizations with fewer than 250 employees, but this exemption does not apply when processing is non-occasional, likely to result in risk to data subjects' rights and freedoms, or includes special categories of data or criminal conviction data. Customer order processing, HR data management, and marketing analytics are all non-occasional processing activities that occur regularly as part of normal business operations, triggering ROPA requirements regardless of employee count. The biometric processing also independently triggers ROPA requirements as special category data, but this is not the only processing requiring documentation. Supervisory authorities can request documentation during investigations, but ROPA maintenance is a continuous compliance obligation, not reactive to requests.
Artificial Intelligence Fundamentals Certificate
AI-Fundamentals · 600 questions
Blockchain Fundamentals Certificate
Blockchain-Fund · 599 questions
Certified Cybersecurity Operations Analyst (CCOA)
CCOA · 593 questions
Certified in Risk and Information Systems Control (CRISC)
CRISC · 761 questions
Certified in the Governance of Enterprise IT (CGEIT)
CGEIT · 598 questions
Certified Information Security Manager (CISM)
CISM · 1196 questions
$17.99
One-time access to this exam