Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by ISACA
Exam Format
Registration
Validity
Skills this practice test covers
- Map personal information with a data inventory, a dataflow diagram and a classification scheme.
- Run a privacy impact assessment and choose a response to each risk it finds.
- Apply data minimization, retention, archiving and destruction rules across the data life cycle.
- Choose between anonymization, pseudonymization, encryption and hashing to protect a dataset.
- Build consent tagging and cookie management into applications and their APIs.
- Handle data subject requests, privacy incidents and vendor contracts in daily privacy operations.
Explore related topics
CDPSE exam content
4 domains · 36 topics · 175 of 185 questions sorted by domain
Privacy Governance20%37 questions
This domain covers the program side of privacy: personal information, privacy principles, privacy laws and privacy documentation. Its operations half adds organizational roles, vendor and supply chain management, incident management and data subject requests.
Skills tested
- Identify the personal information an organization holds and the privacy laws and regulations that apply to it.
- Apply privacy principles such as privacy by design, consent and transparency to a privacy program.
- Write and maintain privacy documentation, such as policies and guidelines.
- Review vendor contracts and service level agreements (SLAs) for privacy practices, then monitor them.
- Answer data subject requests and support the incident management process when personal data is involved.
Questions by topic
- Organizational Culture, Structure, and Responsibilities7
- Vendor and Supply Chain Management8
- Data Subject Rights, Requests, and Notification5
- Privacy Operations3
- Privacy Principles (e.g., Privacy by Design, Consent, Transparency)4
- Privacy Documentation3
- Incident Management5
- Privacy Governance2
Privacy Risk Management and Compliance18%30 questions
Here candidates assess privacy risk and show compliance. The topics run from privacy impact assessments, privacy training, and threats and vulnerabilities to privacy frameworks, evidence and program metrics.
Skills tested
- Perform a privacy impact assessment (PIA) and other privacy-focused assessments.
- Identify privacy threats and vulnerabilities, then agree on a risk response with stakeholders.
- Plan privacy training and awareness that builds a privacy-aware culture.
- Collect the evidence and artifacts that show compliance with a privacy framework.
- Define metrics that report privacy program performance to stakeholders.
Questions by topic
- Privacy-Focused Assessment (e.g., Privacy Impact Assessment (PIA))6
- Program Monitoring and Metrics6
- Risk Management3
- Compliance4
- Threats and Vulnerabilities5
- Privacy Frameworks2
- Risk Response4
Data Life Cycle Management23%42 questions
This domain follows personal data from collection to destruction. It covers data inventories, dataflow diagrams and classification, data quality and use limits, analytics, and the rules for disclosure, transfer, retention, archiving and destruction.
Skills tested
- Keep the personal information inventory and dataflow records current and accurate.
- Classify personal information so that its risk can be assessed and controls applied.
- Limit data use to its stated purpose and collect only the data that purpose needs.
- Set retention and archiving rules, then destroy data so that it cannot be recovered.
- Check data analytics work, such as aggregation and data warehouses, for privacy risk.
Questions by topic
- Data Destruction8
- Data Disclosure and Transfer6
- Data Inventory, Dataflow Diagram, and Classification8
- Data Minimization5
- Data Storage, Retention, and Archiving7
- Data Analytics (e.g., Aggregation, AI, Data Warehouse)3
- Data Quality (e.g. Accuracy)5
Privacy Engineering39%66 questions
The largest domain is about technology. Candidates protect privacy across technology stacks, privacy related security controls and privacy controls, from devices, connectivity and APIs to consent tagging and AI/machine learning.
Skills tested
- Review infrastructure, devices and endpoints, connectivity and cloud-native services for privacy risk.
- Build privacy checks into the secure development life cycle.
- Apply asset management, identity and access management, patching and hardening, and monitoring and logging.
- Choose encryption, hashing, anonymization or pseudonymization to fit the data and its use.
- Use privacy enhancing technologies (PETs) and handle tracking technologies such as cookies.
Questions by topic
- Privacy Enhancing Technologies (PETs)9
- Technology Stacks3
- Anonymization and Pseudonymization7
- Connectivity3
- Encryption and Hashing7
- Consent Tagging4
- APIs and Cloud-Native Services9
- AI/Machine Learning (ML) Considerations4
- Secure Development Life Cycle6
- Identity and Access Management3
- Monitoring and Logging3
- Privacy Related Security Controls3
- Devices and Endpoints4
- Privacy Principles (e.g., Privacy by Design, Consent, Transparency)1
Requirements
- No prerequisites to sit the exam: anyone can book it.
- For the title: an application showing three years of CDPSE work experience in at least two of the four domains, all within the past ten years.
- The application is due within five years of passing. Holders also agree to ISACA's Code of Professional Ethics and its continuing professional education (CPE) policy.
- Recommended: working knowledge of privacy laws, privacy by design and data protection technologies.
About the CDPSE exam
CDPSE measures whether a technical privacy professional can assess, build and run the privacy controls inside systems, applications and data flows. ISACA's four domains start with privacy governance and risk, then move to managing the data life cycle and to privacy engineering, the largest domain. Passing the exam is the first part. ISACA then awards the Certified Data Privacy Solutions Engineer title to candidates whose application shows matching work experience.
The PlanetCert practice test gives Privacy Engineering the most questions, with many on privacy enhancing technologies (PETs), APIs and cloud-native services, and encryption and hashing. Every answer has an explanation, which helps most where two terms look alike, such as pseudonymized data that can still be linked to a person and anonymized data that cannot. Flashcard Mode suits the data life cycle vocabulary, from data minimization to data destruction. Brainy AI Assistant can explain how consent tagging works inside an application, or walk through a privacy impact assessment step by step.
How to earn the certification
- Earns
- Certified Data Privacy Solutions Engineer (CDPSE)Professional
CDPSE runs on ISACA's three-year CPE cycle: holders report CPE every year and pay an annual maintenance fee.
How to prepare for CDPSE
- 1
Check materials against the four domains
ISACA's current outline has four domains, with Privacy Engineering as the largest. Make sure the review manual, course or notes follow these four domains before building a study plan.
- 2
Draw one real dataflow diagram
Pick a simple system, such as an online sign-up form, and map where each piece of personal data goes, who receives it, how long it stays and how it is destroyed. That one drawing touches most of the data life cycle topics.
- 3
Give engineering the most hours
Privacy Engineering is the largest domain. Compare its controls side by side: encryption with hashing, anonymization with pseudonymization, and consent tagging with cookie management.
- 4
Walk a PIA from start to finish
Take one planned change, such as a new analytics tool, and run a privacy impact assessment: describe the processing, list the threats, rate the risk and choose a response.
- 5
Rehearse in Timed Mode last
Take the CDPSE practice test in Timed Mode once each domain feels solid. For each miss, ask Brainy AI Assistant why the chosen control did not fit the case.
Start a timed CDPSErun
ISACA's own preparation for CDPSE includes the CDPSE Online Review Course, the CDPSE Review Manual and the CDPSE Questions, Answers & Explanations Database. ISACA members can also join the CDPSE study groups on its Engage community.
Who CDPSE is for
- Privacy engineers who design and run privacy controls in applications and data platforms.
- Security architects and IT staff who are taking on privacy work.
- Data protection officers and consultants who advise on the technical side of privacy.
- Compliance staff who need to see how privacy rules turn into technical controls.
Typical job titles: Privacy engineer · Privacy architect · Data protection officer · Privacy consultant · Security architect · Privacy program manager
CDPSE glossary
16 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Anonymization
- Changing personal data so that the person can no longer be identified by any reasonable means.
- Consent Tagging
- Attaching a person's consent choices to their data, so that systems further down the line can respect those choices.
- Cryptographic erasure
- Destroying the keys that encrypted a set of data, so that any remaining encrypted copies can no longer be read.
- Data Minimization
- Collecting and keeping only the personal data that a stated purpose needs.
- Data Use Limitation
- The rule that personal data is used only for the purposes it was collected for.
- Dataflow Diagram
- A drawing that shows where personal data enters a system, where it moves, and where it is stored.
- Differential privacy
- A method that adds measured random noise to results, so that the results reveal very little about any one person.
- Hashing
- A one-way function that turns data into a fixed-length value, used to check data or to replace an identifier.
- ISO/IEC 27701
- An international standard that extends an information security management system to cover privacy information management.
- K-anonymity
- A property of a dataset in which each record matches at least k-1 other records on its identifying fields, so no single person stands out.
- Privacy by Design
- Planning privacy controls into a system from the start of its design, instead of adding them after it is built.
- Privacy Enhancing Technologies (PETs)
- Technologies that protect personal data while it is used, such as differential privacy and homomorphic encryption.
- Privacy Impact Assessment (PIA)
- A structured review of how a system or process uses personal information, done to find privacy risks and decide how to reduce them.
- Pseudonymization
- Replacing direct identifiers with codes or tokens, so the data points back to a person only with extra information that is kept apart.
- Secure Development Life Cycle
- A software process that adds security and privacy checks to every stage, from design through testing and release.
- Tracking Technologies
- Tools such as cookies and similar identifiers that follow what a user does across visits or across sites.
Related practice tests
- AAISMAdvanced in AI Security Management
- CCOACertified Cybersecurity Operations Analyst
- CRISCCertified in Risk and Information Systems Control (CRISC)
- CGEITCertified in the Governance of Enterprise IT (CGEIT)
- CISMCertified Information Security Manager (CISM)