Skip to content
CertGPS

Certified Data Privacy Solutions Engineer

Tests whether you can build privacy into systems and data flows, with privacy engineering making up 39% of the exam

AdvancedISACA

The exam

Exam cost
$760
Study time
4-6 months
Passing score
450 (scaled 200–800)
Valid for
3-year CPE cycle, renewed annually

Before you book

  • Required: three years of privacy governance, risk and compliance, engineering or data life cycle experience in at least two CDPSE domains, within the 10 years before applying
  • No experience waivers or substitutions

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

CDPSE Study Guide: The Four-Domain Outline, Privacy Engineering and a Plan

CDPSE is ISACA's privacy credential for engineers and architects. It tests whether you can carry privacy requirements into data flows, controls and code: consent tagging, pseudonymization, retention and deletion, privacy impact assessments. Since 2 June 2025 the exam has followed a four-domain outline in which Privacy Engineering alone is 39%. It's also the shortest of ISACA's core exams, at 120 questions in three and a half hours.

Who CDPSE suits

It fits privacy engineers, security and solution architects who handle personal data, data engineers and platform owners in regulated sectors, and privacy analysts moving toward technical work. ISACA asks for three years of experience in data privacy governance, privacy risk management and compliance, privacy engineering or data life cycle work, covering at least two of the four exam domains and gained within the ten years before you apply. There are no waivers or substitutions.

If your privacy work is legal and policy-led, look at the IAPP's certifications instead; its Certified Information Privacy Technologist (CIPT) is the closest technical alternative from a privacy association. Security staff who want management breadth should look at CISM, and CISSP covers security across eight domains with privacy as one topic among many.

CDPSE exam basics

CDPSE
Format120 multiple-choice questions, one best answer each
Time3.5 hours (210 minutes)
Passing score450 on a scaled range of 200 to 800
PriceUS$575 for ISACA members, US$760 for non-members; US$50 application fee after passing
DeliveryPSI test centers or remote proctoring; English only
ExperienceThree years of privacy work in at least two exam domains; no waivers
OutlineEffective 2 June 2025
RenewalAnnual fee of US$45 (members) or US$85; 20 CPE hours a year, 120 over three years

Four domains, one dominant

  • Privacy Governance: 20%
  • Privacy Risk Management and Compliance: 18%
  • Data Life Cycle Management: 23%
  • Privacy Engineering: 39%

The 2025 outline replaced three domains (governance, architecture and data life cycle) with these four and added risk management and compliance as its own area. Privacy Engineering is the one to plan around. It has three parts: technology stacks (legacy and cloud platforms, endpoints, connectivity, the secure development life cycle, APIs and cloud-native services), privacy-related security controls (asset management, identity and access management, patching and hardening, transport protocols, encryption and hashing, monitoring and logging), and privacy controls proper. That last group is where the exam is most distinctive: consent tagging, cookies and other tracking technologies, anonymization and pseudonymization, privacy-enhancing technologies, and AI and machine learning considerations.

Data Life Cycle Management follows personal data from collection to destruction. It starts with data inventories, dataflow diagrams and classification, then moves through data quality, use limitation and analytics, including aggregation and AI. Minimization, disclosure and transfer, retention and archiving, and destruction close it out. The governance domain is broader than its name and includes vendor management, incident management and data subject requests.

Law takes up less room than you might expect. Privacy laws and regulations are a single subtopic in Domain 1, and the outline names no statute, so you need to know what regulations generally require (consent, transparency, data subject rights, notification) rather than article numbers. Privacy impact assessments sit in Domain 2.

A preparation plan

ISACA's materials for the 2025 outline are the CDPSE Official Review Manual, 3rd edition, a Questions, Answers and Explanations database and an online review course, which gives 12 CPE hours on completion. The free 10-question quiz on the CDPSE page shows the style. For a second text, Peter H. Gregory's CDPSE Study Guide from Sybex came out in 2026 and covers the four-domain outline. The NIST Privacy Framework is a free, well-organized way to see how governance, risk and engineering controls fit together.

Put about 40% of your hours into Privacy Engineering, and make much of it hands-on. Draw a dataflow diagram for a real application, marking every place personal data enters, is stored, is copied and leaves. Take a test dataset and pseudonymize it with a keyed hash, then think through what an attacker holding the key, or a second dataset, could recover. Set a retention rule on a storage bucket or table and check that deletion really happens. Open a site you work on and compare what its cookie banner says with the cookies it actually sets. Each exercise lines up with a named subtopic.

Spend the remaining time across data life cycle, governance and risk, in that order of weight. Run a privacy impact assessment on one feature using your organization's template, or a public one if you have none.

You'll have about one minute and 45 seconds per question, slightly more than on CISA or CISM. If you're paying yourself, ISACA membership (US$145 a year plus chapter dues) saves US$185 on the exam.

Renewal and next credentials

Apply within five years of passing; a supervisor, manager, colleague or client verifies your experience. Each year you report at least 20 CPE hours and pay US$45 as a member or US$85 as a non-member, falling to US$25 or US$50 once you hold more than two ISACA certifications. Over each three-year cycle you need 120 hours, at least 90 of them tied to the CDPSE outline.

Possible next steps:

  • CISM, to add security program management to privacy engineering.
  • CISSP, for broad security depth.
  • AAIR, ISACA's AI risk credential, which lists CDPSE among its qualifying certifications (US$459 for members, US$599 for non-members).

Our view

CDPSE fills a gap for engineers. It asks how you'd build privacy into a system, and the 2025 outline pushed it further that way by giving engineering 39% of the marks. It's young (launched in 2020, with more than 16,000 holders by ISACA's count) and is offered only in English. ISACA's candidate guide also leaves it out of the four certifications accredited under ISO/IEC 17024, which matters where an employer or contract asks for accredited credentials. We'd recommend it to engineers and architects whose job includes privacy design, and to ISACA-certified staff adding privacy. Privacy professionals on the legal side should compare the IAPP's credentials first.

Sources