Prepare for CDPSE by matching the proposed change to the privacy requirement being assessed. Use the four-domain map and newsletter exercise to distinguish reducing unnecessary collection from protecting data already collected.
Which CDPSE outline should you use?
The Certified Data Privacy Solutions Engineer (CDPSE) exam uses the four-domain outline effective from 2 June 2025.
Older notes with three domains, including Privacy Architecture, reflect the previous structure. Compare both coverage and topic detail with the current outline; a publication date alone does not establish alignment.
Privacy Engineering is the largest domain at 39%, while the other three total 61%. Study governance, risk and the data lifecycle as well as technical controls.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: CDPSE® Exam Content Outline — ISACA exam content outline page, retrieved 14 September 2026; ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities — ISACA press release, 7 April 2025
What should you review in the four domains?
Use all four domains as your coverage checklist, then practise the supporting tasks in the official outline.
The weights describe exam content. The review tasks are study suggestions; actual legal and organisational requirements depend on the situation being assessed.
| Domain | Weight | A useful review task |
|---|---|---|
| Privacy Governance | 20% | Review privacy principles, policies, roles, vendor oversight, incident management and data subject rights. |
| Privacy Risk Management and Compliance | 18% | Review privacy assessments, risk responses, compliance evidence, monitoring and metrics. |
| Data Life Cycle Management | 23% | Trace collection, inventory, use, disclosure, storage, retention and destruction against supplied requirements. |
| Privacy Engineering | 39% | Review secure development, platforms, access controls, encryption, consent and tracking controls, anonymization, pseudonymization and privacy enhancing technologies. |
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: CDPSE® Exam Content Outline — ISACA exam content outline page, retrieved 14 September 2026; ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities — ISACA press release, 7 April 2025
Practise fixing a data-collection gap
A control should address the requirement being assessed. Encrypting unrelated fields does not stop the form collecting them.
This original exercise supplies a fictional policy. Its collection restriction are scenario assumptions, not a universal legal rule.
Original practice exercise mapped to the outline's data minimization and use limitation topics.
Meridian Software (a fictional company) runs an optional email newsletter. Its approved internal privacy policy, created for this exercise, states that sign-up for the newsletter may collect only the fields needed to send the messages, and unrelated fields must not be collected. The newsletter needs exactly one field, an email address, to deliver issues. The current sign-up form requires three fields: email address, full birthdate, and home address. Two proposals are on the table. Proposal A removes the birthdate and address fields, keeping only the email address. Proposal B keeps all three required fields but encrypts them in the database. Which proposal resolves the policy's minimization gap, and what does the other proposal actually do?
Reveal the worked answer
Proposal A resolves the specified collection gap by removing birthdate and home address. Proposal B retains all three required fields, so it does not meet that requirement. It changes how the stored fields are protected, rather than whether those fields are collected.
The newsletter needs only an email address under the supplied facts. Removing the unrelated fields makes this form meet that collection criterion. Encryption can protect stored information, but it does not make those fields necessary to send the newsletter. This does not establish that encryption is useless or that Proposal A satisfies every other privacy obligation. Apply the stated requirement rather than treating one control as the answer to every privacy problem.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: CDPSE® Exam Content Outline — ISACA exam content outline page, retrieved 14 September 2026
How should you practise privacy scenarios?
Identify the requirement, the affected data and the change that would address the specific gap.
Trace a record through the lifecycle and use the applicable scenario rules at each stage. Include separately retained copies where the question says they are in scope.
For engineering topics, study what each listed technique does and its limitations. Practise explaining why an option addresses one requirement while leaving another unresolved. Use current reference material for technical definitions; a topic name alone is not a complete procedure.
- Check every domain and its detailed subtopics against your materials; use weights and your actual practice gaps to allocate time.
- After an error, record the concept, role, criterion or evidence you misread and revisit the corresponding objective.
- Explain why the alternatives fail under the supplied facts, then practise mixed timed questions. Treat practice percentages as feedback, not predicted scaled scores.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: CDPSE® Exam Content Outline — ISACA exam content outline page, retrieved 14 September 2026; ISACA Certification Exams Candidate Guide — 2026 edition PDF, retrieved 14 September 2026
Can you take CDPSE before meeting the experience requirement?
Yes. You can sit the exam before you qualify for certification. Passing alone does not award the credential.
Certification requires at least three cumulative years performing the professional tasks of a CDPSE. Use the current application to document how your work relates to the exam’s scope.
The candidate guide lists no experience waivers or substitutions. Do not assume an older eligibility summary applies to the current four-domain program.
Apply within five years of passing. The relevant work experience must fall within the ten years preceding your application and be verified through the application process. Certification also requires the application fee and agreement to ISACA’s professional ethics requirements.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: Earn a CDPSE® Certification — ISACA get-certified page, retrieved 14 September 2026; ISACA Certification Exams Candidate Guide — 2026 edition PDF, retrieved 14 September 2026
What should you expect on exam day?
CDPSE has 120 multiple-choice questions in 210 minutes. Each has four options and one best answer. The exam is closed book and is delivered through PSI at a testing center or by remote proctoring.
Read the stated role, constraints and qualifiers such as BEST or MOST. ISACA says there is no penalty for wrong answers, so answer every question. Practise pacing across the full session, including time for review.
The passing standard is 450 on the 200–800 scaled score. It is not a raw percentage or a fixed correct-answer count. The guide mentions unscored pretest items without specifying their number. Domain weights describe content coverage; the domain feedback is informational, not a set of separate passing thresholds.
A preliminary result appears on screen. The official result follows within 10 working days.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: CDPSE® Exam Content Outline — ISACA exam content outline page, retrieved 14 September 2026; ISACA Certification Exams Candidate Guide — 2026 edition PDF, retrieved 14 September 2026
What should you check before booking?
Registration gives you six months of exam eligibility. Check the current candidate guide, your appointment instructions and the booking price before paying.
You can reschedule without penalty at least 48 hours before your appointment, within the eligibility period. The handbook describes one optional paid six-month extension under specific timing conditions; it is not automatic.
After a failed first attempt, the retake waits are 30 days, then 90 days after the second and third attempts. The limit is four total attempts in a rolling 12 months, with a fee for each attempt.
- Check that your original, valid government-issued ID has the required name, photo and signature and matches your registration.
- For remote testing, complete the compatibility check and review the workspace and check-in rules before your appointment.
- Keep notes, calculators and extra screens out of the testing area. Follow the proctor’s instructions; approved breaks consume exam time.
- If you need accommodations, arrange approval through ISACA before scheduling.
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.: ISACA Certification Exams Candidate Guide — 2026 edition PDF, retrieved 14 September 2026
Facts checked against ISACA's CDPSE exam content outline, get-certified page, and 2026 candidate guide.
Key facts verified against retrieved ISACA sources on 14 September 2026.: