Privacy credentials mostly test law and programme management, which leaves engineers and architects who actually build consent, retention and de-identification into systems without a credential that matches their work. ISACA's Certified Data Privacy Solutions Engineer (CDPSE) aims at that gap, and its exam changed on 2 June 2025 from three domains to four, with Privacy Engineering now 39% of the 120 questions. This guide sets out what ISACA publishes about the exam, the domains, the three-year experience rule, fees, the application window and the CPE cycle, then adds a preparation plan and career context. It is for security and data engineers, architects and privacy practitioners deciding whether to sit the exam, and for managers who fund it. Facts are from isaca.org pages checked on 24 October 2026; confirm fees and policies on the linked ISACA pages before you book, as a new ISACA CPE policy takes effect on 1 January 2027.
Key takeaways
- It is an engineering privacy credential. ISACA describes CDPSE for technical data privacy experts and security professionals supporting privacy initiatives, and the largest domain, Privacy Engineering, covers consent tagging, tracking technologies, anonymisation, PETs and AI or machine learning considerations.
- The current outline has four domains. Since 2 June 2025 the exam covers Privacy Governance (20%), Privacy Risk Management and Compliance (18%), Data Life Cycle Management (23%) and Privacy Engineering (39%); material written for the old three-domain exam is out of date.
- Experience is required for certification, not for the exam. You need three or more years of CDPSE work experience across the domains, within the ten years before you apply, verified by a supervisor or manager; ISACA's pages list no waivers.
- Costs are the same as other ISACA management credentials. The exam costs US$575 for members and US$760 for non-members, plus a US$50 application fee after passing.
- CPE must be privacy related. Holders report at least 20 CDPSE-related CPE hours a year and 120 over three years, and pay US$45 (members) or US$85 (non-members) a year; non-compliance leads to revocation.
Who the certification is for
ISACA states that CDPSE holders work across functions to deliver privacy solutions, and reports that more than 19,000 professionals have earned it since launch (April 2025 announcement). The outline content makes the target roles clear.
- Good fit: privacy engineers, data and solution architects, security engineers who own encryption, IAM or logging for personal data, and developers or platform engineers responsible for consent, retention and deletion in products. See the Privacy by Design Guide for Engineering Teams.
- Good fit for security teams taking on privacy: security professionals asked to support a privacy programme who need the governance and risk vocabulary as well as the controls. See the Privacy Programme Guide for Security Teams.
- Weaker fit: privacy lawyers and DPO-track professionals whose work is mainly legal interpretation; a law-focused credential suits them better. See the CIPP/E and CIPP/US Certification Guide.
- Identity teams: Domain 4B lists Identity and Access Management among privacy-related security controls, and Domain 4A covers APIs and cloud-native services. Access to personal data by service accounts, API keys and AI agents is in scope as a control question. See the Identity Data Privacy and Consent Guide.
Exam format and domains
Format and logistics
| Item | What ISACA publishes | ISACA page |
|---|---|---|
| Number of questions | 120 | CDPSE exam content outline |
| Delivery | Computer-based, at PSI test centres worldwide or remotely proctored | CDPSE certification page |
| Registration | Continuous; eligibility is set at registration and lasts six months | CDPSE certification page |
| Scheduling | From 48 hours after payment; appointments open up to 90 days ahead; free rescheduling within eligibility if done at least 48 hours before the appointment | CDPSE certification page |
| Current outline | Updated exam available from 2 June 2025 (prep materials from 2 April 2025); moved from three domains (governance, architecture, data life cycle) to four | ISACA press release, April 2025 |
| Duration and passing score | Not stated on the ISACA pages checked; take them from the current ISACA Exam Candidate Guide | Check ISACA |
The four domains (outline effective 2 June 2025)
| Domain | Weight | Subdomains and main topics (ISACA outline) |
|---|---|---|
| 1. Privacy Governance | 20% | 1A Privacy Governance: personal information, privacy principles (privacy by design, consent, transparency), privacy laws and regulations, policies and guidelines. 1B Privacy Operations: culture, structure and responsibilities, vendor and supply chain management, incident management, data subject rights, requests and notification |
| 2. Privacy Risk Management and Compliance | 18% | 2A Risk Management: process and policies, privacy-focused assessment (for example PIA), training and awareness, threats and vulnerabilities, risk response. 2B Compliance: privacy frameworks, evidence and artefacts, programme monitoring and metrics |
| 3. Data Life Cycle Management | 23% | 3A Data Collection and Processing: data inventory, dataflow diagrams and classification, data quality, use limitation, analytics including aggregation, AI and data warehouses. 3B Data Persistence and Destruction: minimisation, disclosure and transfer, storage, retention and archiving, destruction |
| 4. Privacy Engineering | 39% | 4A Technology Stacks: infrastructure and platform (legacy, cloud), devices and endpoints, connectivity, secure development life cycle, APIs and cloud-native services. 4B Privacy Related Security Controls: asset management, IAM, patching and hardening, communication and transport protocols, encryption and hashing, monitoring and logging. 4C Privacy Controls: consent tagging, tracking technologies such as cookie management, anonymisation and pseudonymisation, PETs, AI and machine learning considerations |
The outline is jurisdiction neutral: it names privacy laws as a topic but the exam does not centre on one law. Expect scenario questions that ask which control, design choice or process best protects personal data across its lifecycle.
Prerequisites and experience
You can sit the exam before you meet the experience requirement. ISACA's "Get CDPSE certified" page lists the following for certification.
- Pass the exam: within the last five years when you apply.
- Experience: three or more years of CDPSE professional work experience across the CDPSE domains (the page's detailed section describes a minimum of three years of cumulative work performing CDPSE tasks), gained within the ten years before your application date.
- Verification: by your supervisor or manager.
- Application: within five years of passing, with a one-time US$50 processing fee paid through MyISACA once official scores are released.
- Ethics and CPE: agree to the ISACA Code of Professional Ethics and the CPE policy.
The ISACA pages checked describe no experience waivers or substitutions, including for holders of other ISACA or privacy credentials. If you have seen waivers described elsewhere, confirm with ISACA before relying on them.
- Describe tasks, not job titles: "designed retention and deletion for customer data", "implemented pseudonymisation in the analytics pipeline" and "ran PIAs for new products" map cleanly to Domains 2 to 4.
- Count security work that protected personal data: encryption, IAM, logging and hardening are listed in Domain 4B, so relevant security engineering experience can count when it supported privacy outcomes.
Preparation plan
ISACA's official resources are the CDPSE Review Manual (3rd edition), a Questions, Answers and Explanations database (six-month subscription), an online review course covering all four domains (one year of access, 12 CPE on completion), a free ten-question quiz and Engage study groups for members. The timings below are our guidance, not ISACA's.
- Week 1, baseline: read the current outline, confirm materials are for the four-domain exam (the Review Manual 3rd edition is the edition ISACA lists now), and take the free quiz.
- Weeks 2 to 5, Privacy Engineering (39%): anonymisation versus pseudonymisation, PETs, consent tagging and cookie management, encryption and hashing choices, IAM for personal data, logging without over-collection, privacy in APIs and AI pipelines. See the Privacy-Enhancing Technologies Guide and the AI and Privacy Guide.
- Weeks 6 to 7, Data Life Cycle Management (23%): data inventory and flow diagrams, classification, minimisation, use limitation, transfers, retention and destruction.
- Week 8, Governance (20%): privacy principles, documentation, data subject rights, incident handling and vendor management. See the ISO/IEC 27701 Privacy Information Management Guide.
- Week 9, Risk and Compliance (18%): PIAs, risk response, privacy frameworks, evidence and programme metrics. See the DPIA Guide.
- Weeks 10 to 11, practice: domain sets, then mixed sets; note why each wrong answer was the weaker privacy decision.
- Final week: revise the weakest domain, check ID and proctoring rules, and sit within your six-month eligibility.
| Readiness signal | What to look for |
|---|---|
| Engineering depth | You can choose between anonymisation, pseudonymisation, tokenisation and encryption for a given use case and explain the residual risk |
| Lifecycle coverage | You can trace a data element from collection to destruction and name the control at each step |
| Practice scores by domain | No domain trailing; Privacy Engineering strongest, since it carries most weight |
| Governance vocabulary | Comfortable with PIA, data subject requests, notification and vendor obligations |
| Admin | Eligibility window, appointment and ID confirmed |
Cost, renewal and continuing education
| Cost or rule | ISACA member | Non-member |
|---|---|---|
| Exam registration | US$575 | US$760 |
| Application processing fee (one-time, after passing) | US$50 | US$50 |
| Annual maintenance fee | US$45 (US$25 for a third or later ISACA certification) | US$85 (US$50 for a third or later) |
| Reinstatement, if an appeal to the CDPSE Working Group is approved | Outstanding fees plus US$50 per certification | |
- CPE hours: at least 20 each year and 120 over a three-year period, which must advance your knowledge or ability to perform CDPSE-related tasks. Hours may also count towards other ISACA certifications you hold.
- Fee timing: due by 1 January for the coming calendar year.
- Audit: randomly selected holders document all activities for a specified year; keep records for 12 months after each three-year cycle. Failing an audit leads to revocation.
- Revocation: revoked holders must stop presenting themselves as certified; if an appeal is refused, they must pass the exam again and reapply with the required experience.
- Use of the designation: holders may use "CDPSE" after their name but not the logo.
- Policy change: ISACA's new CPE policy takes effect on 1 January 2027; read it on isaca.org before planning your next cycle.
Where it fits on the career path
| Credential | Issuer | Focus | Choose it when |
|---|---|---|---|
| CDPSE | ISACA | Privacy engineering, data lifecycle, privacy controls | You design or build systems that handle personal data |
| CIPP/E or CIPP/US | IAPP | Privacy law in a given jurisdiction | Your work is legal interpretation and compliance |
| CIPM and CIPT | IAPP | Privacy programme management; privacy in technology | You run a privacy programme or want an IAPP technology credential |
| CRISC | ISACA | IT risk and control | Privacy is one part of a wider technology risk role |
| CISM | ISACA | Security programme management | You lead the security function that supports privacy |
- Before CDPSE: hands-on engineering or security experience with real personal data. See the Cybersecurity Careers Guide.
- Pairings: a law-focused IAPP credential plus CDPSE covers both the legal and engineering sides. See the CIPM and CIPT Certification Guide.
- Next steps: CRISC or CISM for broader risk or leadership roles, or ISACA's AI credentials where AI governance overlaps privacy. See the CRISC Certification Guide and the ISACA AAISM and AAIA AI Certifications Guide.
Common failure patterns
- Studying the three-domain exam: using pre-June 2025 material and under-preparing Privacy Engineering, now 39%.
- Treating it as a law exam: memorising regulation articles instead of control and design choices.
- Confusing de-identification techniques: treating pseudonymised data as anonymous is a common wrong answer and a common real-world error.
- Weak experience mapping: listing security work with no link to personal data outcomes.
- Generic CPE: reporting hours that do not relate to CDPSE tasks, which an audit can reject.
Practitioner checklist
- Read the current CDPSE exam content outline and confirm all material covers the four-domain exam used since 2 June 2025.
- Map three or more years of work from the last ten years to the CDPSE domains, with task-level descriptions.
- Confirm a supervisor or manager who can verify the experience.
- Check fees, duration and ID and proctoring rules in ISACA's current Exam Candidate Guide before registering.
- Book within the six-month eligibility window.
- Spend the largest block of study time on Privacy Engineering.
- Apply within five years of passing and pay the US$50 processing fee.
- Log at least 20 CDPSE-related CPE hours each year, keep evidence, and pay the maintenance fee by 1 January.
- Read ISACA's 2027 CPE policy before your next cycle.
Standards and references
- ISACA: CDPSE Exam Content Outline
- ISACA: CDPSE Certification
- ISACA: Get CDPSE Certified
- ISACA: How Do I Maintain My CDPSE?
- ISACA: ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities
- ISACA: How to Earn CPE
- ISACA: Code of Professional Ethics
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CRISC Certification Guide · CIPP/E and CIPP/US Certification Guide · ISACA AAISM and AAIA AI Certifications Guide · Privacy by Design Guide for Engineering Teams