Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by BCS
Exam Format
90 min
40
26/40 (65%)
Practitioner
Registration
Pearson VUE or online proctoring
Validity
Lifetime (no expiry)
PC-DP Exam Topics and Domains
PC-DP is organized into 14 weighted domains.
1
Context of Data Protection Legislation
7.5%
Explain the concepts of data protection and privacy
An individual's right to private and family lifeRelevance of confidentiality and respect for home, family life and correspondence
- Define the terms 'data protection' and 'privacy' and explain the differences between them
- Explain what data protection and privacy mean and why data protection is important
Describe the history of data protection in the UK
United Nations Universal Declaration of Human RightsEuropean Convention on Human Rights and Fundamental Freedoms (ECHR)Council of Europe Convention 108 (1981)OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data 2013Human Rights Act 1998Data Protection Act 1998Privacy and Electronic Communications Regulation (PECR) 2003 and amendments subsequent to 2021General Data Protection Regulation 2016/679UK Data Protection Act 2018Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019UK GDPRFuture legislative changes
- Describe the evolution of the legislative framework for data protection in the EU and the UK
- Not expected to have detailed knowledge of content of each legislation or chronological order
Describe the territorial scope and jurisdiction of GDPR
Territorial scope and jurisdiction of EU GDPRTerritorial scope and jurisdiction of UK GDPRCo-operation between independent supervisory authorities
Describe how the wider territorial scope and jurisdiction of the EU GDPR and UK GDPR impacts on the processing of personal data by global organisations
When a representative of the controller is needed
European RepresentativeUK Representative
Outline the obligations for controllers in relation to appointing European and UK representatives
2
Principles of Data Protection and Applicable Terminology
5%
Define key items of terminology
Personal dataSpecial Category dataBiometric and Genetic dataCriminal Offence dataProcessing of personal data including scope of processingPseudonymisation and anonymisationPurely personal and household purposesProfilingData subjectControllerData ProcessorRecipients and third parties
- Demonstrate knowledge and understanding of all key definitions relating to personal data under UK GDPR
- Explain how pseudonymisation and anonymisation relate to the processing of personal data
Demonstrate how UK GDPR principles regulate the processing of personal data
Lawfulness, fairness and transparency - Article 5(1)(a)Purpose limitation - Article 5(1)(b) including compatibilityData minimisation - Article 5(1)(c)Accuracy - Article 5(1)(d)Storage limitation - Article 5(1)(e)Integrity and confidentiality - Article 5(1)(f)
- Define and explain the UK GDPR personal data processing principles
- Explain the considerations when processing existing personal data for a new purpose
3
Lawful Bases for Processing Personal Data
5%
Illustrate the lawful bases to process personal data (Article 6)
ConsentContractLegal obligationVital interestsPublic interest taskLegitimate interests
Explain the legitimate bases for processing personal data and explain when these legitimate bases are applicable
Conditions for processing special category data (Article 9)
Conditions for processing special category dataAdditional conditions and safeguards (Schedule 1 DPA 2018)Substantial public interest conditions (Part 2, Schedule 1 DPA 2018)
- Identify the ten conditions for processing special category data in Article 9 UK GDPR
- Identify which five require additional conditions and safeguards in DPA 2018
- Understand when an Appropriate Policy Document is required
Rules for processing criminal offence data
Definition of criminal offence dataRules for processing criminal offence data
- Describe the range of information classed as criminal offence data
- Explain processing rules and restrictions on maintaining registers of criminal convictions
4
Accountability Principle
15%
Accountability and data governance obligation (Article 5(2) and Article 24)
The Accountability obligation under UK GDPRPrivacy management framework requirements
- Explain why a controller needs to take responsibility for compliance with UK GDPR
- Describe key measures to demonstrate compliance
Purpose of a Data Protection Impact Assessment (DPIA) and prior consultation (Article 36)
What a DPIA is and its purposeWhen a DPIA is required under UK GDPRRisk assessment considerations in DPIAsMandatory consultation with ICO following a DPIA
- Explain what a DPIA is, when it is needed
- Distinguish between legal requirement and good practice for DPIAs
- Explain when ICO consultation is required
Process of conducting a DPIA (Article 35)
How a DPIA is undertaken and documentedEvaluating risks and considering mitigationsStakeholder consultation in DPIAs
- Identify the need to conduct a DPIA prior to high-risk processing
- Recognise need to consult with stakeholders and DPO
- Demonstrate knowledge of how high risks should be evaluated and recorded
Record of Processing Activity (RoPA) (Article 30)
Definition and purpose of a RoPAInformation to be included in a RoPA
- Explain what a RoPA is and why it is required for accountability obligations
- Describe information required in a RoPA per Article 30
Interplay with privacy notices (Articles 13 and 14)
Privacy notice definition and transparency principleInformation provision to data subjects
- Explain what a privacy notice is and what information it should contain
- Explain how controllers present privacy notices to fulfil transparency principle
Data protection by design and by default (Article 25)
Data protection by designData protection by defaultResponsibilities for compliance
- Explain the concepts of data protection by design and default
- Describe how controllers can undertake this in practice
- Explain how it links with the DPIA process
Appropriate information security measures (Article 32)
UK GDPR and the importance of information securityOrganisational measuresTechnical measuresData processors and information security
Explain what security measures controllers and processors must take to secure data
Designation, position and tasks of the DPO (Articles 37-39)
Requirement to appoint a DPOPosition and remit of the DPOTasks of the DPO
- Describe criteria for appointing a DPO
- Describe the remit and purpose of the position
- Describe key tasks required of the DPO
DPO role in monitoring compliance and managing risks (Article 39(1)(b))
Role of the DPO in monitoring complianceDPO approach to assessing and measuring risks
- Be aware of the DPO role in identifying, evaluating and measuring risks
- Be aware of the remit of the DPO regarding accountability (they are not accountable)
- Know the required action if DPO advice is not followed
5
Obligations of Controllers, Joint Controllers and Data Processors
10%
Controller and processor obligations (Articles 24 and 28)
Obligations of controllersObligations of processors
Identify and explain distinctions between controller and processor responsibilities and obligations
Joint controllers (Article 26)
Joint controllers definition and responsibilities
- Define what a joint controller is
- Explain roles and responsibilities in respect of data processing
- Identify impact on data subjects
Processing under authority of controller or processor (Article 29)
Processing under authority requirements
Explain requirements concerning processing of personal data on instructions of controller
Contract with a processor and when necessary
When a contract with a processor is requiredContent of a processor contractSub-processor arrangements
- Explain legal contracts required when controller uses a processor
- Describe UK GDPR stipulations for contract content
- Be aware of sub-processor arrangements
6
International Data Transfers under EU and UK GDPR
2.5%
General principles for transferring personal data to third countries
Impact of data transfers to/from EEA as a result of BrexitPost-Brexit adequacy regarding transfers under EU GDPRRestricted transfers and safeguard mechanisms
- Explain importance of ensuring free flow of personal data vs third country protections
- Explain mechanisms permitting lawful international transfers
- Demonstrate implications of UK-EU data transfers since Brexit
7
Data Subject Rights
5%
Key rights granted to individuals (Articles 12-17, 21-22)
Right to be informed (transparency) - Articles 13 and 14Subject access - Article 15Prohibition against enforced subject access requests - Section 184 DPA 2018Void contractual terms relating to health records - Section 185 DPA 2018Right to rectification - Article 16Right to erasure (Right to be forgotten) - Article 17Right to object - Article 21Automated individual decision making and profiling - Article 22
- Explain in detail the different rights UK GDPR grants to individuals
- Explain how controllers should ensure they can fulfil data subject requests
Additional rights (awareness level)
Restriction of processing - Article 18Notification obligation - Article 19Data portability - Article 20
Have an awareness of these additional rights (not expected to know in detail)
Restrictions and exemptions affecting data subject rights
Restrictions - Article 23Exemptions - Schedule 2 Parts 1-4 DPA 2018
Have awareness of restrictions and exemptions that may impact on individual rights
Fundamental rights of information requests
Freedom of Information Act (FoIA)Environmental Information Regulations (EIR)
- Explain what FOI and EIR rights and regulations are and their purpose
- Explain how requests can be made and response timeframes
- Consider exemptions and public interest test
8
The Role of Independent Supervisory Authorities and the ICO
7.5%
Role and importance of supervisory authorities
Independent supervisory authoritiesTasks of the ISAs (Article 57)European Data Protection Board (EDPB) - Articles 68-73
- Describe the role and importance of supervisory authorities
- Outline the tasks of independent supervisory authorities
The Information Commissioner's Office (ICO)
Role of the ICOInvestigative and corrective powersICO guidance and codes of practicePromoting public awarenessPrivacy seals and certification schemesAdvice and reporting to ParliamentData Protection Fees and Exceptions
- Describe the role and functions of the ICO
- Explain the ICO's investigative and corrective powers
- Understand the ICO does NOT undertake DPIAs for controllers
9
Breaches, Enforcement and Liability
12.5%
Obligations to report personal data breaches (Articles 33 and 34)
Reporting breaches to the ICO (Article 33)Notifying data subjects (Article 34)
Explain obligations to report personal data breaches to ICO and data subjects
Data Protection Complaints
Complaint handling process
Understand the data protection complaints process
Sanctions for breaches or complaints
ReprimandsNotices and Administrative fines
Describe the sanctions that can be imposed
Liabilities of controllers and processors
Controller and processor liability
Explain liabilities of controllers and processors
Criminal liabilities and offences
Criminal liabilities under data protection legislationOffences under the Computer Misuse Act 1990The role of the Tribunal
- Explain criminal liabilities and offences
- Understand that compensation can only be claimed via courts, not ordered by ICO
- Know the role of the Tribunal
10
Processing of Personal Data in Relation to Children
2.5%
Consent in relation to Information Society Services (Article 8)
Age of consent for children's data - UK 13 yearsChildren's right to erasureAge Appropriate Design Code (Children's Code)
- Understand age requirements for children's consent (13 in UK)
- Know that controllers must make reasonable efforts to verify parental responsibility
- Understand the Age Appropriate Design Code
11
Specific Provisions Relevant to Public Authorities
7.5%
Public authority data protection provisions
Meaning of Public Authority/BodyPublic task lawful basis considerations - Article 6(1)(e)DPA 2018 Section 7(2) interplay for public authorities with Article 6(1)(f)Relevant exemptions from Schedules 2 and 3
- Understand provisions specifically relevant to public authorities
- Know that public task does not require statutory or common law obligation
12
Privacy and Electronic Communications (EC Directive) Regulations (PECR) 2003
5%
PECR and its relationship with GDPR
Link to GDPR consent definitionTypes of electronic marketing and obligationsPECR scope and application
- Understand PECR's relationship with GDPR
- Know that PECR DOES apply to business-to-business communications
- Understand different types of electronic marketing obligations
13
Application of Data Protection Legislation in Key Areas of Industry
7.5%
ICO Employment Practices Guidance
Employment practices and data protection
- Understand the ICO Employment Practices Guidance helps employers comply with data protection legislation
- Know that the guidance encourages good practice but is not mandatory
Surveillance cameras and personal information
Surveillance Cameras and Personal Information Code
Understand surveillance camera governance under data protection law
Cookies and digital technologies
Cookies governance under data protection law and PECR
- Understand how cookies and digital technologies are governed by data protection law and PECR
- Know that UK GDPR only applies to cookies that are online cookie identifiers
Data Sharing Code
ICO Data Sharing Code of Practice
Understand the ICO Data Sharing Code
14
AI and the Processing of Personal Data
7.5%
What is meant by AI
AI definition and concepts
Understand what is meant by AI in the context of data protection
AI Risks and Benefits
Risks of AI to data protectionBenefits of AI
Understand the risks and benefits of AI for data protection
The Data Protection Principles and AI
Applying data protection principles to AI processing
Understand how data protection principles apply to AI processing
DPIAs and AI
Conducting DPIAs for AI processing
- Understand the importance of conducting DPIAs when implementing AI
- Know that a DPIA assesses whether AI use is necessary and proportionate and assesses risks
How do I earn this certification?
Passing PC-DP earns the BCS Practitioner Certificate in Data Protection certification. It sits in the Information Security and Data Protection track.
Current Level Exams
- PC-FOI - BCS Practitioner Certificate in Freedom of Information
- PC-IAA - BCS Practitioner Certificate in Information Assurance Architecture
- PC-IRM - BCS Practitioner Certificate in Information Risk Management
Next Level Options
Alternative Paths
- PC-FOI - BCS Practitioner Certificate in Freedom of InformationComplementary qualification covering FOI legislation in depth, useful for public sector DPOs
- PC-IRM - BCS Practitioner Certificate in Information Risk ManagementComplementary qualification for professionals managing information risk alongside data protection
- FC-ISMP - BCS Foundation Certificate in Information Security Management PrinciplesFoundation-level qualification for those wanting broader information security context
- CIPP/E - IAPP Certified Information Privacy Professional/EuropeAlternative vendor-neutral European privacy certification widely recognised in the industry
- CIPM - IAPP Certified Information Privacy ManagerPrivacy management certification focused on operationalising privacy programmes
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for PC-DP is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2025-02-28
Updates
- Artificial Intelligence Module 14 (v9.8) New dedicated module on AI and data protection, 7.5% weighting • Release date: 2025-02-28
- Data (Use and Access) Act 2025 To be incorporated in next syllabus update Major legislative change - new syllabus version expected to reflect DUA Act • Release date: 2026-02-02
Who should take this exam?
- BCS Foundation Certificate in Data Protection (not mandatory but ideal)
- Attendance at an accredited training course
- Familiarity with UK GDPR and the syllabus
- Familiarity with recommended reading outlined in the syllabus
Related practice tests
- AIDBABCS Advanced International Diploma in Business Analysis
- TM12BCS Certified Tester Advanced Level (2012)
- EC-AIBCS Essentials Certificate in Artificial Intelligence
- FC-AgileBCS Foundation Certificate in Agile
- FC-ACDBCS Foundation Certificate in Architecture Concepts and Domains