Privacy and DPO Certifications Compared: CIPP to BCS

No law requires a data protection officer to hold a particular certificate, yet privacy certifications are what most hiring managers, tender questionnaires and regulators' expectations of "expert knowledge" are measured against, and the main options test very different things. GDPR Article 37(5) says a DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the Article 39 tasks; it names no qualification. This guide compares the privacy and DPO certifications most often asked for in Europe and the UK: the BCS data protection certificates, ISACA's CDPSE, the IAPP's CIPM, CIPP and CIPT, and the EXIN Data Protection Officer path. It sets out what each one actually tests, how the exams are run, the gaps each leaves, and how to choose by role, jurisdiction and background. It is for aspiring and serving DPOs, privacy managers, privacy engineers and security staff moving into privacy. Certifications are listed alphabetically by awarding route; the order is not a ranking. Exam facts were checked on the awarding bodies' own pages on 13 November 2026 and change often, so confirm before you book.

Key takeaways

Law, programme or engineering. CIPP and the BCS certificates test knowledge of the law, CIPM and the EXIN path test running a privacy programme, and CDPSE and CIPT test building privacy into systems. Pick by the job, not by brand recognition.
Jurisdiction matters for law exams. CIPP is split into regional concentrations, and the BCS certificates are written around UK GDPR, the Data Protection Act 2018 and PECR. A UK DPO and an EU DPO need different law content.
Experience requirements differ. CDPSE needs three years of relevant work experience to be awarded; the IAPP, BCS and EXIN routes do not require prior experience to sit the exams, though EXIN's professional level needs accredited training with practical assignments.
A DPO usually needs two layers. Article 39 combines advising on the law with monitoring compliance, DPIA advice and regulator contact, so most DPOs pair a law credential with a programme credential.
Certificates do not create independence. GDPR Article 38 requires the DPO to report to the highest management level, receive no instructions on their tasks and avoid conflicting duties. No credential fixes a reporting line that breaks those rules.

What a DPO certificate needs to prove

Start from the role, not the syllabus. Article 39(1) GDPR gives the DPO five tasks: inform and advise the controller or processor and its staff of their obligations; monitor compliance, including assignment of responsibilities, awareness raising, training and related audits; advise on data protection impact assessments and monitor their performance under Article 35; cooperate with the supervisory authority; and act as its contact point, including for prior consultation under Article 36. Article 37(6) allows the DPO to be a staff member or to work under a service contract, and the European Commission confirms a DPO may be an individual or an organisation. That last point matters for certification: external DPO services are often bought on the strength of their staff's credentials.

Mapped to those tasks, a certification portfolio for a DPO should evidence four things:

Legal knowledge: the relevant regime (EU GDPR, UK GDPR and the Data Protection Act 2018, or another jurisdiction), lawful bases, rights, transfers and enforcement.
Programme operation: governance, policies, metrics, training, audits, DPIAs and handling requests and breaches.
Technical understanding: enough to challenge engineering and security teams on data flows, retention, pseudonymisation and access control.
Information security basics: Article 32 security of processing and breach handling under Articles 33 and 34.

The career context is covered in the Privacy Engineer and DPO Career Guide. Each IAPP and ISACA certification also has its own detailed exam guide, linked below; this page compares them rather than repeating their domain tables.

The certifications at a glance

Certification	Awarding body	Main focus	Exam format (as published)	Experience to be certified
BCS Foundation Certificate in Data Protection	BCS, The Chartered Institute for IT	UK data protection law fundamentals	40 multiple-choice questions, 60 minutes, pass 26/40 (65%), closed book, invigilated	None mandatory
BCS Practitioner Certificate in Data Protection	BCS	Applying UK data protection law, including accountability, breaches, public authorities, PECR and AI	40 multiple-choice questions, 90 minutes, pass 26/40 (65%), closed book, invigilated	None mandatory; Foundation recommended
CDPSE (Certified Data Privacy Solutions Engineer)	ISACA	Privacy engineering, data life cycle, privacy governance and risk	Computer-based at PSI centres or remotely proctored, English only	Three or more years across the four CDPSE domains within the past ten years
CIPM (Certified Information Privacy Manager)	IAPP	Building and running a privacy programme	90 multiple-choice questions, 2.5 hours with a 15-minute break	None stated
CIPP (Certified Information Privacy Professional), by region	IAPP	Privacy law and regulation of one region	CIPP/E: 90 multiple-choice questions, 2.5 hours with a 15-minute break	None stated
CIPT (Certified Information Privacy Technologist)	IAPP	Building data protection into products and services	See the CIPM and CIPT guide	None stated
EXIN Data Protection Officer	EXIN	GDPR foundations, information security and DPO practice	Awarded on passing three exams: PDPF (40 questions, 1 hour, 65%), Information Security Foundation based on ISO/IEC 27001, and PDPP (40 questions, 2 hours, 65%, with mandatory accredited training and practical assignments)	None stated

Fees published on the day of checking: the IAPP store lists the CIPM and CIPP/E exams at USD 550 each, for members and non-members; ISACA lists the CDPSE exam at USD 575 for members and USD 760 for non-members, plus a one-time USD 50 application fee. BCS and EXIN exam prices depend on the accredited training provider or exam route, so ask the provider.

BCS Foundation and Practitioner Certificates in Data Protection

What they test: both certificates are built on UK law. The current syllabuses (Foundation v3.9 and Practitioner v9.9, both created in March 2026) cover UK GDPR, the Data Protection Act 2018, PECR, and the Data (Use and Access) Act 2025, with EU GDPR for comparison. The Practitioner syllabus weights the accountability principle at 15%, breaches, enforcement and liability at 12.5%, controller and processor obligations at 10%, and application in key industry areas at 10%. It also includes provisions for public authorities (7.5%), children's data (2.5%) and artificial intelligence and personal data (5%). The Foundation syllabus puts 21.5% on accountability and 15% on principles and terminology.

How they run: both are invigilated, closed-book exams of 40 multiple-choice questions with a pass mark of 26 (65%). Foundation runs for 60 minutes; Practitioner for 90 minutes. BCS states a total qualification time for Practitioner of 34 hours, including 22.5 guided learning hours, and allows accredited training or self-study.

Who they suit: UK DPOs, information governance and records staff, public authority data protection leads, and anyone advising on UK law, PECR marketing rules and ICO enforcement. The Foundation is BCS's stated stepping stone to the Practitioner.

Gaps to plan for: the content is UK law first. A DPO for an EU establishment or a multinational group needs EU GDPR depth and member state variations beyond the comparison material. The exams are knowledge tests; they do not assess programme design or technical privacy controls. See GDPR Variations in Six EU Member States.

Worked scenario: a records manager at an NHS trust is asked to take on the DPO role. The trust is a public authority, so a DPO is mandatory. The Practitioner syllabus covers public authority provisions, the ICO and PECR directly, so the BCS Practitioner is a direct fit for the legal layer; programme operation is then built through experience or a programme credential.

CDPSE (ISACA)

What it tests: ISACA describes CDPSE as validating expertise in implementing privacy by design. The current outline, in place since June 2025, has four domains: Privacy Governance, Privacy Risk Management and Compliance, Data Life Cycle Management, and Privacy Engineering, which carries the largest weight. The outline is jurisdiction neutral. Domain weights and subdomains are in the CDPSE Certification Guide.

How it runs: computer based at PSI test centres or remotely proctored, in English. To be certified you must pass within the last five years, have three or more years of CDPSE work experience across the four domains within the ten years before applying, pay the USD 50 application fee, agree to ISACA's Code of Professional Ethics, and then maintain 120 CPE hours per three-year period with at least 20 a year.

Who it suits: privacy engineers, security architects, data platform leads and IT auditors who implement or assess privacy controls: data inventories and flows, retention and destruction, identity and access management, encryption, logging and privacy enhancing technologies.

Gaps to plan for: it is not a law exam, so it does not replace jurisdiction-specific legal knowledge for a DPO. The experience requirement means early-career candidates may pass the exam but wait to be awarded the credential.

Worked scenario: a cloud security engineer becomes the technical privacy lead for a SaaS product that processes customer personal data. Their daily work is data mapping, retention automation, access reviews and pseudonymisation, which sits squarely in CDPSE's engineering and data life cycle domains. See the Data flow mapping for security and privacy guide.

CIPM (IAPP)

What it tests: the IAPP describes CIPM as showing you can establish, maintain and manage a privacy programme across all stages of its life cycle. Its domains cover developing a framework, programme governance, assessing data, protecting personal data, sustaining performance (metrics, audits, PIAs and DPIAs) and responding to requests and incidents. The full blueprint is in the CIPM and CIPT Certification Guide.

How it runs: 90 multiple-choice questions in 2.5 hours with a 15-minute break, at a Pearson VUE centre or online through OnVUE, to be taken within a year of purchase. The IAPP says the exam is offered in English, with French, German, Brazilian Portuguese and Simplified Chinese versions translated from it. CIPM is ANAB accredited.

Who it suits: DPOs and privacy managers whose work is the Article 39 monitoring, training, audit and DPIA tasks, in any jurisdiction, because the programme content is not tied to one law.

Gaps to plan for: CIPM assumes you know the law you are operationalising; on its own it does not prove expert legal knowledge of a regime. EXIN accepts CIPM in place of its Foundation level (PDPF) on the EXIN DPO path, which is useful for holders who later want the EXIN title.

Worked scenario: a compliance manager at a 2,000-person retailer already holds a law credential and now owns the privacy programme: records of processing, DPIA process, supplier assessments and request handling. CIPM maps to that day-to-day work.

CIPP (IAPP), by region

What it tests: the IAPP lists regional concentrations: CIPP/A (Asia), CIPP/AU (Australia), CIPP/C (Canada), CIPP/CN (China), CIPP/E (Europe) and CIPP/US (United States). Each tests the privacy laws, regulations and frameworks of its region. CIPP/E covers European data protection law including GDPR, transfers and enforcement; CIPP/US covers federal and state law. Domain detail is in the CIPP/E and CIPP/US Certification Guide and the CIPP/C and CIPP/A Certification Guide.

How it runs: for CIPP/E, the IAPP store lists 90 multiple-choice questions in 2.5 hours with a 15-minute break, in English, German and French, at Pearson VUE centres or online, to be taken within a year of purchase.

Who it suits: DPOs, privacy counsel and privacy analysts who must advise on the law of a specific region, and security leaders who need to understand legal obligations that drive controls.

Gaps to plan for: each concentration covers one region, so a group DPO for EU and US operations may need two. UK-specific rules such as PECR and the Data Protection Act 2018 are not the core of CIPP/E. Law knowledge alone does not evidence programme operation.

Worked scenario: an in-house lawyer in a Dublin fintech is designated as DPO. The EU legal layer is the priority, so CIPP/E fits; a programme credential follows once the role expands.

CIPT (IAPP)

What it tests: the IAPP says CIPT proves you understand how to use technical solutions to build data protection into products and services, and positions it for technology and data professionals. Its domains cover the privacy technologist's role, data collection, use and destruction, privacy risk management, privacy by design, and privacy engineering and governance. It is ANAB accredited.

Who it suits: product managers, software engineers, architects and security staff who design systems that process personal data, and DPOs who need credibility with engineering teams.

Gaps to plan for: like CDPSE it is not a law exam. CIPT and CDPSE overlap in theme; see the decision table below for how to choose between them.

Worked scenario: a product security lead at a health app needs to run privacy reviews of new features, covering tracking technologies, consent flows and anonymisation. CIPT fits the product-design focus.

EXIN Data Protection Officer path

What it tests: EXIN awards the Data Protection Officer certification automatically once three certifications are passed: EXIN Privacy and Data Protection Foundation (PDPF), EXIN Information Security Foundation based on ISO/IEC 27001, and EXIN Privacy and Data Protection Professional (PDPP). PDPF covers GDPR scope, principles and practice of processing, international transfers, and risk assessment and mitigation. PDPP covers data protection policies, managing and organising data protection, the roles of controller, processor and DPO, DPIAs, and data breaches, notification and incident response.

How it runs: PDPF is 40 multiple-choice questions in one hour with a 65% pass mark, closed book, in Chinese, English, Dutch or Portuguese. PDPP is 40 multiple-choice questions in two hours with a 65% pass mark, closed book, in English, Portuguese or Chinese, and requires accredited training including successful completion of practical assignments. EXIN accepts IAPP CIPM in place of PDPF; the advanced level must always be an EXIN certification.

Who it suits: DPOs and privacy officers who want a single structured path that combines GDPR, DPO practice and an information security foundation, particularly where training providers in their country deliver EXIN.

Gaps to plan for: the content is EU GDPR based, so UK-specific law and PECR need separate study. The mandatory training adds cost and scheduling to the PDPP step.

Worked scenario: a security officer at a Dutch logistics firm is appointed DPO. They already know ISO/IEC 27001 practice, so the information security foundation is quick, and the PDPP practical assignments give structured DPO practice.

How to choose: decision guidance

Your situation	Layer to cover first	Certifications that test that layer
DPO for a UK organisation or UK public authority	UK law, PECR, ICO enforcement	BCS Practitioner Certificate in Data Protection
DPO for an EU establishment	EU GDPR	CIPP/E; EXIN PDPF and PDPP
Group DPO across regions	Each region's law, then programme	Relevant CIPP concentrations, then CIPM
Privacy programme manager	Governance, metrics, DPIAs, requests	CIPM; EXIN PDPP
Privacy engineer or architect with three or more years' experience	Privacy engineering and data life cycle	CDPSE; CIPT
Product or software team member new to privacy	Privacy by design in products	CIPT
Security professional moving into privacy	Law basics, then engineering	BCS Foundation or CIPP for law; CDPSE or CIPT for engineering

Small organisations: the DPO is often part time or external. Prioritise the law credential for your jurisdiction and lean on programme templates; Article 38(6) allows other duties provided they do not create a conflict of interest.
Large organisations: split the layers across a team: a DPO with law and programme credentials, privacy engineers with CDPSE or CIPT, and security staff with basic data protection knowledge.
Buying an external DPO service: ask which named individuals hold which credentials, for which jurisdiction, and how the provider avoids conflicts with other services it sells you.
Maintenance load: ISACA requires 120 CPE hours per three years for CDPSE. IAPP credentials carry continuing education and maintenance requirements, set out in each IAPP guide. Count this before collecting several credentials.

Common failure patterns

Choosing the wrong jurisdiction: a UK DPO with only CIPP/E, or an EU DPO with only a UK-law certificate, has a visible gap in the one area Article 37(5) names.
Treating a law certificate as programme competence: passing a law exam does not mean the holder can run DPIAs, supplier reviews and request handling at scale.
Engineering credential without legal grounding: privacy engineers who cannot explain lawful basis or retention requirements build controls nobody can justify to the regulator.
Appointing a conflicted DPO: a CISO or head of IT who sets the purposes and means of processing may face a conflict under Article 38(6), however well qualified.
Ignoring security of processing: breach handling under Articles 33 and 34 depends on security operations. A DPO who cannot read an incident timeline struggles with notification decisions. See the Data Breach Notification Checklist.
Collecting credentials without maintaining them: lapsed credentials on a CV or tender response undermine trust.

Measuring whether certification is paying off

Coverage of layers: for each privacy role, whether law, programme and technical layers are each evidenced by a credential or documented experience.
DPIA quality: share of DPIAs completed before go-live and accepted without rework.
Request handling: share of data subject requests answered within the statutory deadline.
Breach decisions: share of personal data breaches with a documented notification decision within 72 hours of awareness.
Credential currency: share of team credentials in good standing.

Framework mapping

Framework	Reference	Relevance
GDPR	Articles 37, 38 and 39	Designation on expert knowledge, independence and DPO tasks
NIST SP 800-53 Rev. 5	PM-19 Privacy Program Leadership Role; AT-3 Role-based Training	A designated privacy lead and training for privacy roles
NIST CSF 2.0	GV.RR-02; PR.AT-02	Roles and responsibilities established; specialised roles given knowledge and skills
ISO/IEC 27001:2022 Annex A	5.34 Privacy and protection of PII; 6.3 Information security awareness, education and training	Privacy obligations met and staff competence

Related compliance context is in the GDPR Compliance Guide for Security Teams and the NIST SP 800-53 Privacy Controls and FIPS 199/200 Categorisation Guide.

Practitioner checklist

List the Article 39 tasks your role actually performs before choosing any certification.
Pick the law credential for the jurisdiction you advise on first.
Add a programme credential once you own DPIAs, audits and request handling.
For engineering roles, check whether you meet CDPSE's three-year experience rule or whether CIPT fits better now.
Confirm exam format, language and price on the awarding body's page on the day you book.
Budget training, exam and maintenance costs for the full certification cycle.
Check the DPO's reporting line and other duties against Article 38 independently of qualifications.
When buying an external DPO service, ask for named individuals and their credentials.

Privacy and DPO Certifications Compared: CIPP, CIPM, CIPT, CDPSE, EXIN and BCS Routes