Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by BCS
Exam Format
60 min
40
26/40 (65%)
Foundation
Registration
BCS Remote Proctoring (Questionmark), Pearson VUE, or online proctoring
Validity
No formal expiry, but staying current with legislation changes is recommended
Progress to BCS Practitioner Certificate in Data Protection; Continuous professional development through BCS membership
FC-DP Exam Topics and Domains
FC-DP is organized into 10 weighted domains.
1
An Introduction to the History of Data Protection in the UK
6%
Demonstrate an awareness around personal data rights in the EU and the UK
Background to the rights to protect personal data in the EU and the UKGeneral Data Protection Regulation 2016/679 (EU GDPR)UK GDPRUK Data Protection Act 2018, Part 2, Chapters 1 to 3, Parts 5 and 6Future legislative changes
- Identify and explain how UK data protection has evolved
- Understand what data protection and privacy mean and why they are important
Describe the territorial scope and jurisdiction of the UK GDPR (Article 3)
Extent of the territorial scope and the jurisdiction of UK GDPRAlignment with the EU GDPR
- Explain that UK GDPR applies to processing of personal data in the context of activities of an establishment of a controller or processor in the UK regardless of where processing takes place
- Explain how UK GDPR mirrors EU GDPR territorial scope
2
Principles of Data Protection and Applicable Terminology
15%
Define key items of terminology
Personal dataSpecial category dataBiometric and genetic dataCriminal offence data (Article 10 UK GDPR / Section 10 and 11 DPA 2018)Processing of personal data including scope of processing (Article 2 UK GDPR)Pseudonymisation and anonymisationProfilingData subjectControllerProcessorRecipients and third partiesFiling system
- Explain the meaning of all terminology and definitions under Article 4 UK GDPR
- Explain pseudonymisation and anonymisation in terms of whether data is personal data under UK GDPR
Describe the data protection principles
Lawfulness, fairness and transparency - Article 5(1)(a)Purpose limitation - Article 5(1)(b)Data minimisation - Article 5(1)(c)Accuracy - Article 5(1)(d)Storage limitation - Article 5(1)(e)Integrity and confidentiality - Article 5(1)(f)
- Describe all six data protection principles
- Apply the principles to practical scenarios involving personal data processing
3
Lawful Bases for Processing of Personal Data
10%
Explain the lawful basis to process personal data listed under Article 6 UK GDPR
ConsentContractLegal obligationVital interestsPublic interest taskLegitimate interests
- Explain each of the six lawful bases for processing under Article 6
- Identify the appropriate lawful basis for given scenarios
Describe the conditions permitted for processing special category data (Article 9 UK GDPR / Schedule 1 DPA 2018)
Additional conditions and safeguards under Schedule 1, Part 1 of DPA 2018Schedule 1, Part 2 Public Interest conditionsSchedule 1, Part 4 Appropriate policy documents
Identify where additional conditions and safeguards from DPA 2018 are needed for special category data processing
4
Accountability Principle
21.5%
Identify the accountability obligations (Article 5(2) and Article 24) UK GDPR
Article 5(2) - Demonstrating compliance with principles equals accountabilityArticle 24 - Responsibility of the controller
- Explain accountability as demonstrating compliance, not just achieving it
- Explain controller responsibility including technical and organisational measures
Describe the purpose of a Data Protection Impact Assessment (DPIA)
Legal requirement of when to conduct a DPIAAssessing levels of risk (e.g., AI, children's data)
- Understand the legal requirements of when to conduct a DPIA
- Demonstrate how high-risk data is assessed
Explain the process of conducting a DPIA (Article 35) and prior consultation with ICO (Article 36)
What is included in a DPIAConsultation with the ICO (Article 36)
- Explain the full DPIA process and documentation requirements
- Identify when there is a legal requirement to consult the ICO
Identify the importance of keeping a Record of Processing Activity (RoPA) (Article 30)
Article 30(1) controller obligationsArticle 30(2) processor obligationsRoPA as a dynamic document
- Identify and explain controller and processor obligations under Article 30
- Understand RoPA as a critical dynamic compliance document
Outline the interplay with privacy notices (Articles 13 and 14) UK GDPR
The individual's right to be informed and the privacy noticeCollecting personal data from individuals directly and from a third party
Outline when to show a privacy notice, its required content, and how it should be structured
Demonstrate how to adopt a data protection by design and by default approach (Article 25)
Steps taken at the time of determining the means for processingRisk-based approach
- Demonstrate that Article 25 requires privacy measures at the design stage, not after processing has commenced
- Explain the risk-based approach considering nature, scope, technology, and cost
Identify suitable information security measures (Article 32) UK GDPR
Technical measuresOrganisational measures
Explain what security measures controllers and processors must take to secure data
Explain the designation, position and tasks of the Data Protection Officer (Articles 37 to 39)
The role of the DPOTasks of the DPO
Explain the designation, position and tasks of the DPO under UK GDPR
Explain the role of the DPO and compliance monitoring
DPO responsibility to monitor data protection complianceRequirements for data protection accountability framework
Understand the importance of the DPO role in monitoring compliance, managing risks, and recording and reporting improvements
5
Obligations of Controllers, Joint Controllers and Data Processors
7.5%
Identify the controller and processor obligations
Controller obligations (Article 24) UK GDPRJoint controllers (Article 26) UK GDPRProcessor obligations (Article 28) UK GDPRProcessing under the authority of a controller or processor (Article 29) UK GDPR
Explain the differences between controllers, joint controllers and processors and their respective obligations
6
International Data Transfers under UK GDPR
7.5%
Explain the principles of data transfers under UK GDPR and the impact of data transfers to and from the EU
Principles of what amounts to a data transfer under UK GDPRImpact of data transfers to and from the EU as a result of BrexitRestricted transfers and mechanisms for lawful transfers
- Identify principles of what amounts to a data transfer under UK GDPR
- Explain the impact of data transfers to and from the EU as a result of Brexit
- Demonstrate knowledge of restricted transfers and their lawful mechanisms
7
Data Subject Rights
12.5%
Explain the key rights granted to individuals (Articles 12 to 17 and 21 to 22) UK GDPR
Being informed (transparency) including further processing compatibility (Articles 13 and 14)Subject access (Article 15) UK GDPRRectification (Article 16) UK GDPRErasure - Right to be forgotten (Article 17) UK GDPRObjection (Article 21) UK GDPRAutomated individual decision making and profiling (Article 22) UK GDPR
Identify the different rights for individuals regarding their personal data under UK GDPR
Explain the fundamental rights of other information requests
Freedom of Information rights (FOI)Environmental Information Regulations (EIR)
Explain what FOI and EIR are, their purpose, how requests are made, and response obligations
Explain the impact of AI on data rights
What is meant by AI and the impact on data rightsImpact of AI on the principles and concepts of data protection
Explain the impact of AI on data protection principles including lawfulness, fairness, transparency, data minimisation, security, controller/processor obligations and individual rights
8
Independent Supervisory Authorities (ISAs) and the Information Commissioner's Office (ICO)
7.5%
Express awareness of the role of ISAs under EU GDPR (Articles 57 and 58 EU GDPR)
The role of ISAs under EU GDPRTasks (Article 57) EU GDPRPowers (Article 58) EU GDPRCo-operation between ISAs (Article 60) EU GDPR
Explain the role of ISAs under EU GDPR
Explain the role of the ICO
Tasks of the ICO (Article 57 UK GDPR)Powers of the ICO (Article 58 UK GDPR)
- Understand the role of the ICO as the data protection regulator
- Explain the impact of ICO tasks and powers
9
Breaches, Enforcement and Liability
7.5%
Explain the obligation and requirements surrounding the reporting of personal data breaches (Articles 33 and 34)
Obligation and requirements to the ICO (Article 33)Obligation and requirements to the data subject (Article 34)
- Be aware of all breach reporting requirements including when to notify ICO and data subjects
- Understand timescales and documentation requirements for reporting
Identify the powers of the ICO imposed as a result of a breach or complaint (Article 58 UK GDPR)
Investigative powersInformation noticesConsensual auditsAssessment noticesCorrective measures, warnings, and reprimandsEnforcement noticesPenalty notices (fines)
Explain the varying powers of the ICO which may impact controllers responsible for data breaches
Describe liabilities
CompensationLiability between controller and processorCriminal liability under Data Protection Act 2018
Be aware of the liability regime regarding UK GDPR and DPA 2018
10
Privacy and Electronic Communications (EC Directive) Regulations (PECR) 2003 and Subsequent Amendments
5%
PECR and its relationship with UK GDPR
Relationship between PECR and UK GDPR including consent definitionObjective and broad scope of PECRProvisions relating to electronic marketing communicationsRole of the ICO in relation to PECR
- Identify the relationship between PECR and UK GDPR
- Understand the scope and provisions of PECR for electronic marketing
- Explain the ICO's role in PECR enforcement
How do I earn this certification?
Passing FC-DP earns the BCS Foundation Certificate in Data Protection certification. It sits in the Information Security and Data Protection track.
Next Level Options
Alternative Paths
- CISMP - BCS Foundation Certificate in Information Security Management PrinciplesComplementary certification covering broader information security management principles. Useful for those combining data protection with security responsibilities.
- CIPP/E - IAPP Certified Information Privacy Professional / EuropeAlternative privacy certification with broader European focus. Widely recognised internationally for privacy professionals.
- CIPM - IAPP Certified Information Privacy ManagerFocuses on privacy programme management. Complementary for those wanting operational privacy management skills.
- CIPT - IAPP Certified Information Privacy TechnologistFor technology professionals wanting to embed privacy into IT systems and products.
- C-DPO - PECB Certified Data Protection Officer International DPO certification alternative for those seeking vendor-neutral DPO qualification.
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for FC-DP is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
ACTIVE
Updates
- Artificial Intelligence (AI) AI impact on data protection principles and individual rights is now examined. Candidates must understand how AI challenges lawfulness, fairness, transparency, data minimisation, security, and individual rights.
- Data (Use and Access) Act 2025 Future legislative changes section now references DUA Act 2025 instead of the Data Protection and Digital Information Bill. Candidates should be aware of key changes including the stop-the-clock rule for SARs.
Who should take this exam?
- Good standard of written English and maths
- Some knowledge of data protection law
- Basic working knowledge of IT and GDPR
Related practice tests
- AIDBABCS Advanced International Diploma in Business Analysis
- TM12BCS Certified Tester Advanced Level (2012)
- EC-AIBCS Essentials Certificate in Artificial Intelligence
- FC-AgileBCS Foundation Certificate in Agile
- FC-ACDBCS Foundation Certificate in Architecture Concepts and Domains