Explore the changes to the CDPSE exam and exam prep materials.
The CDPSE exam will undergo a Job Process Update this year to stay current with emerging data privacy threats and technologies. The updated exam will reflect the new Exam Content Outline (ECO) as of 2 June, and the corresponding exam prep materials will be available 2 April.
ISACA’S commitment
Since its inception in 2020, more than 16,000 people have obtained ISACA’s CDPSE certification of the expertise needed to assess, build and implement comprehensive privacy solutions. The domains, subtopics and tasks are the results of extensive research, feedback and validation from subject matter experts and prominent industry leaders from around the world.
Updated job practice areas tested for and validated by a CDPSE certification
20% DOMAIN 1 – PRIVACY GOVERNANCE
A—PRIVACY GOVERNANCE
- Personal Information
- Privacy Principles (e.g., Privacy by Design, Consent, Transparency)
- Privacy Laws and Regulations
- Privacy Documentation (e.g., Policies, Guidelines)
B—PRIVACY OPERATIONS
- Organizational Culture, Structure, and Responsibilities
- Vendor and Supply Chain Management
- Incident Management
- Data Subject Rights, Requests, and Notification
18% DOMAIN 2 – PRIVACY RISK MANAGEMENT AND COMPLIANCE
A—RISK MANAGEMENT
- Risk Management Process and Policies
- Privacy-Focused Assessment (e.g., Privacy Impact Assessment (PIA))
- Privacy Training and Awareness
- Threats and Vulnerabilities
- Risk Response
B—COMPLIANCE
- Privacy Frameworks
- Evidence and Artifacts
- Program Monitoring and Metrics
23% DOMAIN 3 – DATA LIFE CYCLE MANAGEMENT
A—DATA COLLECTION AND PROCESSING
- Data Inventory, Dataflow Diagram, and Classification
- Data Quality (e.g. Accuracy)
- Data Use Limitation
- Data Analytics (e.g., Aggregation, AI, Data Warehouse)
B—DATA PERSISTENCE AND DESTRUCTION
- Data Minimization
- Data Disclosure and Transfer
- Data Storage, Retention, and Archiving
- Data Destruction
30% DOMAIN 4 – PRIVACY ENGINEERING
A—TECHNOLOGY STACKS
- Infrastructure and Platform Technology (e.g., legacy, cloud computing)
- Devices and Endpoints
- Connectivity
- Secure Development Life Cycle
- APIs and Cloud-Native Services
B—PRIVACY RELATED SECURITY CONTROLS
- Asset Management
- Identity and Access Management
- Patch Management and Hardening
- Communication and Transport Protocols
- Encryption and Hashing
- Monitoring and Logging
C—PRIVACY CONTROLS
- Consent Tagging
- Tracking Technologies (e.g., cookie management)
- Anonymization and Pseudonymization
- Privacy Enhancing Technologies (PETs)
- AI/Machine Learning (ML) Considerations
SUPPORTING TASKS
- Identify internal and external requirements to develop and maintain the organization’s privacy programs.
- Review organizational programs to align with privacy related legal and regulatory requirements, industry best practices (e.g., privacy by design), and data subject’s expectations.
- Advise on data life cycle policies and practices to ensure privacy considerations for data governance.
- Design and evaluate the implementation of technical and operational controls for data classifications and data life cycle requirements.
- Perform privacy impact assessments (PIAs) and other privacy-focused assessments.
- Contribute to the integration of privacy principles (e.g., privacy by design) in the development of procedures and operational manuals for organizational needs.
- Collaborate with stakeholders to promote privacy principles (e.g., privacy by design) are followed during the design, development, and implementation of systems, applications, and infrastructure.
- Identify and assess privacy related threats and vulnerabilities.
- Contribute to the evaluation of contracts, service level agreements (SLAs), and privacy practices of vendors and other parties and subsequently monitor for compliance.
- Participate in the incident management process to address privacy impacts and support remediation.
- Collaborate with relevant stakeholders to address privacy compliance and risk response.
- Contribute to the evaluation of information architecture to support privacy by design principles and data considerations.
- Evaluate changes in regulatory landscape, emerging threats to privacy, and privacy enhancing technologies (PETs).
- Design, implement, and monitor processes and procedures to keep personal information inventory and dataflow records current and accurate.
- Advise on data classification for personal information to enable risk assessment and implementation of controls.
- Develop and monitor metrics to report on privacy program performance to relevant stakeholders.
- Advocate for advancing privacy posture and maturity as it aligns to the organizational objectives.
- Contribute to the development of educational content and conduct privacy training to promote a privacy aware culture.
- Promote accountability, fairness, and transparency throughout the data life cycle.
Getting ready for the exam
ISACA offers a variety of exam preparation resources including group training, self-paced training and study resources in various languages to help you prepare for your certification exam. Choose what works for your schedule and your studying needs.
Disclaimer: Please be advised that the CDPSE Exam Content Outline (ECO) will be updated effective 2 June 2025. Starting on 2 June 2025, the CDPSE Exam will reflect the new ECO. Updated preparation material for the new ECO will be available for purchase in April 2025. Purchase of this material will not grant you access to the newer version of the material at a later date. More detail here >
ISACA glossary and CDPSE translations
Some CDPSE terms can be lost in translation. That is why ISACA has translated our CDPSE Terminology List into numerous languages, ensuring learners fully understand the materials. Please see the list of translations below. To learn more about key industry terms, please explore the ISACA glossary here.