CDPSE
Privacy by design in engineering terms: who the CDPSE is for
Most privacy credentials are written for the people who interpret the law or run the program. The CDPSE is written for the people who build the systems: ISACA says it validates expertise in implementing privacy-by-design principles into existing and future systems, networks and applications. Privacy engineering alone is 39% of the exam, more than governance and compliance combined. This guide is about who the CDPSE suits, what that 39% contains, how it compares with the IAPP's CIPT, and what it takes to earn and keep.
The facts here come from ISACA's CDPSE Exam Content Outline for the updated exam available from 2 June 2025, ISACA's CDPSE and Get CDPSE Certified pages, its Certification Exams Candidate Guide, version 1.26, and its CPE 2027 page, read on 20 October 2026, with our CDPSE Exam Guide. Where this page and ISACA differ, ISACA wins.
What does the CDPSE measure?
ISACA's Candidate Guide says the CDPSE is designed for those experienced in the governance, architecture and life cycle of data privacy at a technical level. The exam content outline divides that into four domains and publishes the share of the exam each one carries:
| Domain | Share | Subdomains and topics |
|---|---|---|
| 1. Privacy Governance | 20% | Privacy governance: personal information, privacy principles, laws and regulations, documentation. Privacy operations: culture and responsibilities, vendor and supply chain management, incident management, data subject rights |
| 2. Privacy Risk Management and Compliance | 18% | Risk management: process and policies, privacy impact assessments, training, threats and vulnerabilities, risk response. Compliance: privacy frameworks, evidence and artifacts, monitoring and metrics |
| 3. Data Life Cycle Management | 23% | Collection and processing: data inventory, dataflow diagrams and classification, data quality, use limitation, analytics and AI. Persistence and destruction: minimization, disclosure and transfer, storage and retention, destruction |
| 4. Privacy Engineering | 39% | Technology stacks: infrastructure, cloud, devices and endpoints, connectivity, secure development, APIs and cloud-native services. Privacy-related security controls: asset management, identity and access, patching and hardening, protocols, encryption and hashing, monitoring and logging. Privacy controls: consent tagging, tracking technologies, anonymization and pseudonymization, privacy enhancing technologies, AI and machine learning |
The weighting is the credential's defining fact. Privacy engineering at 39% is more than the governance and compliance domains combined, and data life cycle management adds another 23%. Together, the two technical domains are 62% of the exam. A candidate who knows privacy law well but has never thought about API design, identity and access management or consent tagging will find most of the paper unfamiliar. A candidate who builds systems for a living will find it describes their work.
The engineering domain is also the broadest. It runs from the technology a system is built on, through the security controls that protect personal data, to the privacy-specific controls that decide how data is collected, tracked, de-identified and used in AI. That range is the CDPSE's answer to a practical question: what does an engineer need to know to make a system private, not only secure?
The three parts of privacy engineering
Technology stacks come first: infrastructure and platforms, legacy and cloud; devices and endpoints; connectivity; the secure development life cycle; and APIs and cloud-native services. Each is a place personal data lives or passes through, and each has privacy choices built into it, from where a managed service stores its logs to what an API returns by default. An engineer who understands the stack can see where personal data will end up before it gets there.
Privacy-related security controls come second: asset management, identity and access management, patch management and hardening, communication and transport protocols, encryption and hashing, and monitoring and logging. These are familiar to security engineers, and the CDPSE asks them to look at each one for its privacy outcome. Monitoring and logging are the clearest case, because the logs that protect a system can themselves collect personal data that needs an owner, a purpose and a retention rule.
Privacy controls come third, and they are what make the domain a privacy domain: consent tagging, tracking technologies such as cookie management, anonymization and pseudonymization, privacy enhancing technologies, and AI and machine learning considerations. Consent tagging is a good example of an engineering answer to a legal question: rather than looking up a person's choices in a separate system, the choice travels with the data, so every downstream process can respect it.
Who is the CDPSE for?
ISACA's CDPSE page says holders work cross-functionally to engineer effective privacy solutions that are ethical and human centered, and that the credential helps security professionals learn how their work can support privacy initiatives. Its experience rule asks for three years of work across the four CDPSE domains. The people who meet that bar fall into these roles:
| Role | Privacy work they do | CDPSE domains that carry the day job | Pairs it with |
|---|---|---|---|
| Privacy engineer | Design reviews, privacy controls, de-identification, consent systems | 4, then 3 | A CIPP for the region |
| Security engineer moving into privacy | Encryption, identity and access, logging, now with privacy outcomes | 4 (security controls), then 3 | CISSP or CISM |
| Data engineer or architect | Data inventory, dataflows, retention, deletion, analytics | 3, then 4 | CIPT |
| Cloud or platform engineer | Infrastructure, APIs, cloud-native services handling personal data | 4 (technology stacks) | CCSP |
| Technical privacy lead or privacy architect | Standards, reviews and evidence across engineering teams | All four | CIPM |
| IT auditor or risk professional with privacy scope | Testing privacy controls and gathering evidence | 2 (evidence and artifacts), then 4 | CISA or CRISC |
The pairings are our suggestion, not ISACA's. They follow one rule: pair the CDPSE with the credential for the side of the work you do not already cover, whether that is the law, the program, security or audit.
What the smaller domains add
The governance domain gives an engineer the context they work in: what counts as personal information, privacy principles such as privacy by design, consent and transparency, the laws and regulations in play, and the documentation, policies and guidelines that set expectations. Its operations subdomain covers organizational culture and responsibilities, vendor and supply chain management, incident management, and data subject rights, requests and notification. Risk management and compliance add the privacy impact assessment, training and awareness, threats and vulnerabilities, risk response, privacy frameworks, evidence and artifacts, and program monitoring and metrics. Together they are why ISACA describes CDPSE holders as working cross-functionally: an engineer who understands them can talk to legal, compliance and the business in their own terms.
Why the CDPSE sits in ISACA's family
ISACA lists the CDPSE alongside its CISA, CISM, CRISC and CGEIT credentials, and all of them share the same 200 to 800 scoring scale and the same CPE policy. That matters for people who already work in ISACA's world. An IT auditor with a CISA, or a security manager with a CISM, who is asked to take on privacy will find the CDPSE uses the same structure and the same continuing education rules, and that CPE hours that satisfy more than one ISACA certification can count toward each. ISACA's CDPSE page says the credential is required by many organizations and government agencies; it does not list them, so treat that as ISACA's own claim.
When does the CDPSE start to matter?
Privacy engineering work arrives at predictable moments, and each one maps to a part of the outline.
The organization has to prove privacy by design
In the EU, GDPR Article 25 requires controllers to implement appropriate technical and organizational measures for data protection by design and by default, both when the means of processing are decided and during processing. That is an engineering obligation, and somebody has to be able to show what was built and why. The CDPSE's compliance subdomain includes evidence and artifacts for exactly that reason: a design that cannot be evidenced cannot be shown to meet the duty.
Nobody knows where the personal data is
Data inventory, dataflow diagrams and classification are the first topics in the data life cycle domain. Our guide puts the principle plainly: every store of personal data, and every conduit for it, needs an owner, a classification, a retention rule and a position in the dataflow that a rights request can reach. Change keeps that work going. A change that adds a field changes what personal data an asset holds; one that adds an integration changes the dataflow; one that adds a region changes the transfer analysis.
Analytics or AI wants the data
The outline names data analytics, aggregation, AI and data warehouses in the collection and processing subdomain, and AI and machine learning considerations among the privacy controls. The engineering question is how to keep the signal while reducing the identification. Our guide gives an example: a fraud model needs the behavioral signal and may work on a pseudonym rather than a name, and a stable pseudonym, the same for a given person every time it is generated, lets analysts link records over time and across tables.
Something is exposed
Incident management sits in privacy operations, and the exam tests the order of response. Our guide's rule is that when a stem asks what to do FIRST after discovering an exposure, the answer is to contain it: restricting access comes before documenting, assessing or deciding retention. The same logic runs through other FIRST questions: when a system is still acting on stale state, stopping the processing comes before redesigning it.
A vendor or processor is added
Vendor and supply chain management is part of privacy operations. Our guide notes that when a stem asks what to do FIRST with a processor, the answer often points at verification, because accountability requires the controller to demonstrate the outcome, and a processor's assertion is not evidence of it.
What each engineering artifact asks of the outline
Here is the outline turned into the work products a privacy engineer actually produces. For each artifact, the second column says what it is for, and the third gives the CDPSE domain and subdomain that teaches it.
| Artifact | What it is for | CDPSE domain and subdomain |
|---|---|---|
| Data inventory and dataflow diagram | Knowing where personal data is and how it moves | 3. Data Collection and Processing |
| Retention schedule and deletion jobs | Keeping data only as long as it is needed, and proving it is destroyed | 3. Data Persistence and Destruction |
| Consent tagging in the data model | Carrying each person's choices with their data | 4. Privacy Controls |
| Cookie and tracking management | Controlling tracking technologies on sites and apps | 4. Privacy Controls |
| Pseudonymization or anonymization design | Reducing identification while keeping useful signal | 4. Privacy Controls |
| Access reviews and IAM policy | Limiting who can see personal data | 4. Privacy Related Security Controls |
| Encryption and hashing standards | Protecting data at rest and in transit | 4. Privacy Related Security Controls |
| Privacy gates in the development life cycle | Catching privacy issues before release | 4. Technology Stacks |
| Privacy impact assessment | Assessing a new system's risk before it goes live | 2. Risk Management |
| Evidence pack | Showing a regulator, auditor or customer what was built | 2. Compliance |
| Rights request pipeline | Finding, exporting or deleting a person's data on request | 1. Privacy Operations |
The first row is the foundation for most of the others. We have turned it into a register checklist, one asset at a time, that you can copy or download below.
Personal data asset register checklist
Personal data asset register checklist
Use this to build or check a register of every system that stores or moves personal data. Every store of personal data, and every conduit for it, needs an owner, a classification, a retention rule and a place in the dataflow that a rights request can reach. The fields follow ISACA's CDPSE exam content outline (2025): data inventory, dataflow diagrams and classification; persistence and destruction; and privacy and security controls.
For each asset (database, bucket, log, SaaS tool, API, device fleet)
- Name and owner (a person, not a team): ____________
- Classification of the personal data it holds
- Which fields of personal data it holds, and the purpose for each
- Where it sits in the dataflow diagram: what feeds it, what it feeds
- Retention rule, and the job or process that enforces it
- How data is destroyed at the end of retention, and how that is evidenced
- Regions where it is stored or processed (for transfer analysis)
- Access control: who can read it, who granted that, when it was last reviewed
- Encryption at rest and in transit; hashing or pseudonymization where used
- Logging and monitoring of access
- Whether a rights request (access, deletion, correction) can reach it, and how
When something changes
- A new field: update what personal data the asset holds
- A new integration: update the dataflow
- A new region: update the transfer analysis
- A new vendor or processor: assess it before data flows, and record the assessment
If an exposure is found
- Contain it first: restrict access before documenting, assessing or deciding retention
- Then record what happened, assess the impact and follow the incident process
Where does the credential apply?
The CDPSE is global. ISACA runs the exam at PSI test centers and by online remote proctoring, and its Candidate Guide lists the CDPSE exam in English. The content is not tied to one country's law: privacy laws and regulations appear as a governance topic, but the bulk of the exam is engineering that serves the GDPR's Article 25 in Europe, the reasonable-security duties of US state privacy laws, sector rules and customer contracts alike. Frameworks such as the NIST Privacy Framework are part of the compliance subdomain's privacy frameworks topic.
What the CDPSE is not
It is not a legal credential. Our guide calls it an engineering credential, not a legal one. It covers laws as part of governance; it does not teach what any particular law requires in detail.
It is not an entry credential. Certification needs three years of experience across the four domains, and ISACA allows no waivers or substitutions for the CDPSE. You can sit the exam before you have the experience, but you cannot certify until you do.
It is not a percentage. The pass mark is 450 on ISACA's scale of 200 to 800, and ISACA publishes no percentage pass mark.
It is not the same as a security credential. Security controls are part of privacy engineering, but the privacy controls, consent tagging, tracking, de-identification and privacy enhancing technologies, are what make the CDPSE a privacy credential. ISACA says it helps security professionals learn how their work supports privacy.
From exam to certification: ISACA's rules
| Step | ISACA's rule |
|---|---|
| Register | US$575 for members, US$760 for non-members; six months to sit the exam, extendable by six months for US$75 |
| Sit the exam | 120 multiple-choice questions in 3.5 hours (210 minutes), at a PSI test center or remotely proctored |
| Results | Preliminary pass status on screen; the official score within 10 working days |
| Retakes | Four attempts in a rolling 12 months; wait 30 days, then 90, then 90; full fee each time |
| Apply | Within five years of passing; US$50 application processing fee |
| Experience | Three or more years across the four CDPSE domains, within the 10 years before applying; no waivers or substitutions; verified by a supervisor or manager |
| Keep it | At least 20 CPE hours a year and 120 per three-year cycle; from 1 January 2027, at least 90 of the 120 aligned to the exam content outline |
The experience rule is shorter than the CISA's or CISM's five years, but stricter in one way: there are no waivers. Three years of work across the four domains means real exposure to governance, risk and compliance as well as engineering, so a pure developer may need to show where their work touched the other domains.
How does it compare with the credentials around it?
| CDPSE | CIPT | CISM | |
|---|---|---|---|
| Awarded by | ISACA | IAPP | ISACA |
| Center of gravity | Privacy engineering (39%) and the data life cycle (23%) | The data life cycle and privacy risk management | Running an information security program |
| Exam | 120 questions, 3.5 hours, 450 on 200 to 800 | 90 questions, 2.5 hours, 300 on 100 to 500 | 150 questions, 4 hours, 450 on 200 to 800 |
| Experience to certify | 3 years across the four domains; no waivers | None required | 5 years in security management; waivers up to 2 |
The CDPSE and the CIPT answer the same question, how to build privacy into systems, from two directions. The CDPSE leans harder into technology stacks and security controls and requires experience to certify; the CIPT is built around the data life cycle and privacy risk, and has no experience requirement. An engineer in a team that already speaks ISACA may find the CDPSE fits; one in a privacy office that speaks IAPP may find the CIPT does. Some hold both. Our CIPT exam page sets out the IAPP side.
What will the exam expect of you?
The CDPSE has 120 multiple-choice questions in 3.5 hours, which is 1 minute 45 seconds a question on average. As on all ISACA exams, stems often carry a qualifier in capital letters, and FIRST is the one that catches engineers. Our guide's patterns are consistent. FIRST after an exposure means containment. FIRST in a lawful-processing question separates whether you may process from how you will protect it. FIRST in a vendor question often means verification, because accountability needs evidence and a processor's assertion is not evidence. FIRST in a system design question can point at the obligation that had to exist before the first login.
The technical questions reward precision: the difference between anonymization and pseudonymization, between a stable pseudonym and one that changes, between encryption and hashing, and between a privacy control and a security control that happens to help privacy. Test yourself with the CDPSE quiz, see the domains on one page in the CDPSE mind map, and if the credential is part of a job move, the CDPSE interview questions page covers what employers ask.
How to prepare
Start from the exam content outline, which ISACA publishes free, and size your time to the weights. If you plan 100 hours, the shares give 39 to privacy engineering, 23 to data life cycle management, 20 to governance and 18 to risk management and compliance. Then move hours toward what your job does not cover: an engineer may need more time on governance and compliance; a governance lead more on technology stacks and controls.
The CDPSE Exam Guide (Wikidata) has 11 chapters across 390 pages. Every chapter maps to a published domain, and the book is weighted the same way as the exam, with privacy engineering given four chapters. It is written as an engineering credential guide, not a legal one, and every source is named at the back.
The CDPSE Practice Questions (Wikidata) has 200 questions weighted to the published domain shares, with a full rationale for each and the answer letters spread on purpose.
Engineers can also prepare from their own systems. Pick a service you know well and walk it through the four domains: the governance rules it is meant to follow, the risk assessment that approved it, the data it collects and how long it keeps it, and the stack, security controls and privacy controls that run it. Every gap in that walk-through is a topic to study, and the result is a privacy review your team can use.
Is it current? Both books follow ISACA's CDPSE exam content outline for the updated exam available from 2 June 2025. ISACA revises outlines from time to time, so check its CDPSE page before you book.
So, do you need the CDPSE?
Take it if you build or secure systems that handle personal data and you want a credential that tests the engineering, not only the law: privacy engineers, security engineers moving into privacy, data and cloud engineers, and technical privacy leads. It suits especially well if you already work in ISACA's world of audit, security and risk credentials, because the CDPSE shares their exam format and continuing education rules.
ISACA's own pitch for the CDPSE names three benefits: privacy-by-design capabilities for compliance and efficiency, competency in communicating across departments to reduce risk, and a way for security professionals to learn how their work can support privacy initiatives. If those three describe the gap in your current role, the credential is aimed at you.
Look at the CIPT if you have less than three years of relevant experience, or if your privacy team is built around the IAPP. Look at a CIPP or the CIPM if your job is the law or the program rather than the systems. And if you are a security engineer with no privacy scope yet, the CDPSE is a clear signal that you want some.
Questions people ask about the CDPSE
Who is the CDPSE for?
ISACA says the CDPSE is designed for those experienced in the governance, architecture and life cycle of data privacy at a technical level, and that it validates expertise in implementing privacy-by-design principles into existing and future systems, networks and applications. That means privacy engineers, security engineers, data engineers, architects and technical privacy leads.
What experience do I need for the CDPSE?
Three or more years of professional work experience across the four CDPSE domains, within the 10 years before you apply. ISACA allows no experience waivers or substitutions for the CDPSE. You can sit the exam first and apply within five years of passing.
How many questions are on the CDPSE exam?
120 multiple-choice questions in 3.5 hours (210 minutes), at a PSI test center or remotely proctored. The exam is offered in English.
What is the CDPSE passing score?
450 on ISACA's scale of 200 to 800. ISACA publishes no percentage pass mark.
What does the CDPSE cover?
Four domains: privacy governance (20%), privacy risk management and compliance (18%), data life cycle management (23%) and privacy engineering (39%).
How much does the CDPSE cost?
ISACA lists the exam at US$575 for members and US$760 for non-members, plus a one-time US$50 application processing fee after you pass.
CDPSE or CIPT?
Both are technical privacy credentials. ISACA's CDPSE gives privacy engineering 39% of its exam, covers security controls and technology stacks in detail, and needs three years of experience to certify. The IAPP's CIPT is built around the data life cycle and privacy risk, with no experience requirement. Engineers in ISACA-centered security and audit teams may lean to the CDPSE, and those in IAPP-centered privacy teams to the CIPT.
Is the CDPSE a legal credential?
No. It covers privacy laws and regulations as part of governance, but it is an engineering credential: how to build privacy into systems, not what the law says in a given country.
How do I keep the CDPSE?
Earn at least 20 CPE hours a year and 120 over each three-year cycle, pay the annual maintenance fee, and follow ISACA's Code of Professional Ethics. From 1 January 2027 at least 90 of the 120 hours must be aligned to the exam content outline.
Which CDPSE outline is current?
The exam content outline for the updated exam available from 2 June 2025. Check ISACA's CDPSE page before you book.
CDPSE: test yourself in five minutes
Which books prepare you for the CDPSE exam?
A study companion for the ISACA Certified Data Privacy Solutions Engineer examination. 11 chapters, 390 pages.
Practice questions with full rationales, sized to the published domain weights. 213 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISACA, CDPSE Exam Content Outline, updated exam available 2 June 2025
- ISACA, CDPSE Certification: positioning, fees, holder count
- ISACA, Get CDPSE Certified: experience, application and CPE requirements
- ISACA, Certification Exams Candidate Guide, version 1.26
- ISACA, CPE Policy Changes for 2027
- IAPP, CIPT: Certified Information Privacy Technologist
- Regulation (EU) 2016/679 (GDPR), Article 25
- NIST, Privacy Framework
Credential Press is not affiliated with, endorsed by or authorized by ISACA or the IAPP. CDPSE, CISA, CISM, CRISC and CGEIT are trademarks of ISACA; CIPT is a trademark of the IAPP.