There are four CDPSE domains: Privacy Governance (20%), Privacy Risk Management and Compliance (18%), Data Life Cycle Management (23%), and Privacy Engineering (39%). Those weights come from the ISACA CDPSE Examination Content Outline effective 2025, which is the current blueprint and has no announced successor. If you are sitting the exam now, that is the shape of your paper.
One number in that list should change your plan before you read anything else. Privacy Engineering is 39% on its own, nearly twice the size of any other domain, and it is the technical one, running from cloud infrastructure and identity management through to anonymization and machine learning. If you come from law, compliance, or privacy program management, that domain is both the largest share of the exam and the least familiar territory you will cross. This post walks all four in turn, and then argues about where your hours should go.
What are the CDPSE domains and their weights?
| Domain | Name | Weight | Approx. questions |
|---|---|---|---|
| 1 | Privacy Governance | 20% | 24 |
| 2 | Privacy Risk Management and Compliance | 18% | 22 |
| 3 | Data Life Cycle Management | 23% | 28 |
| 4 | Privacy Engineering | 39% | 47 |
The question column is a planning tool, not a promise. ISACA publishes the percentage weights and the 120-question total but no per-domain count, so those numbers are our arithmetic on its weights. Its Certification Exam Candidate Guide adds that ISACA exams contain unscored pretest items that do not count toward your score, and the counts above are rounded, so the column will not sum tidily. The paper itself is 120 multiple-choice items in 3.5 hours, scored on a scale of 200 to 800 with 450 to pass. For format, eligibility, and what the credential is actually for, start with what the CDPSE certification is.
One framing point before the tour. Every CDPSE question is written from the privacy engineer's seat. You are the person who builds privacy into a system, implements the control, and lives with the data across its life cycle. You are not the lawyer deciding whether a law applies, and you are not the executive accepting the risk. When two options both look defensible, the one that describes a design or implementation decision usually wins over the one that describes an opinion.
Domain 1: Privacy Governance (20%)
Domain 1 splits in two. Privacy Governance (1A) covers personal information and what actually counts as identifiable, privacy principles including Privacy by Design, consent, and transparency, privacy laws and regulations, and privacy documentation such as policies and guidelines. Privacy Operations (1B) covers organizational culture, structure, and responsibilities, vendor and supply chain management, incident management, and data subject rights, requests, and notification.
What the exam asks here is mostly about categories and roles. Is this data set still personal data. Who is the controller, who is the processor, and which one carries the notification duty. Which document is the external notice and which is the internal standard. Expect data subject request scenarios where the engineering question is hidden inside a legal-sounding stem: fulfilling a portability request means a machine-readable export exists, and fulfilling erasure means you know every copy, including the backups.
The trap here is treating consent as the default lawful basis. It is one basis among several and often the weakest to build on, because it can be withdrawn and your system then has to act on the withdrawal. For legally trained candidates this is the cheapest 20% they will ever buy, and for exactly that reason the most tempting place to overspend.
Domain 2: Privacy Risk Management and Compliance (18%)
The smallest domain, and the one that carries the exam's signature instrument. Risk Management (2A) covers the risk process and policies, privacy-focused assessment including the Privacy Impact Assessment, privacy training and awareness, threats and vulnerabilities, and risk response. Compliance (2B) covers privacy frameworks, evidence and artifacts, and program monitoring and metrics.
Two things get asked repeatedly. The first is the PIA and its cousins: what triggers one, what the necessity and proportionality test is actually challenging, and what you do when a completed assessment still leaves high residual risk. If a stem describes new high-risk processing and asks for the first step, the assessment is nearly always the credited answer. The second is the frameworks, where you need to place ISO/IEC 27701 as an extension of an ISO/IEC 27001 management system, recognize the NIST Privacy Framework, and know ISO/IEC 29100 as the principles many others build on.
Watch the line between privacy risk and security risk, because the exam tests it directly. Privacy risk is harm to the individual. Security risk is harm to the organization. Encrypting a database beautifully does nothing about collecting more data than you need or using it for a purpose nobody agreed to. At 18% this is the lightest domain, but its risk vocabulary gets reused in the two big ones, so read it early and briefly rather than skipping it.
Domain 3: Data Life Cycle Management (23%)
Domain 3 follows the data from arrival to destruction. Data Collection and Processing (3A) covers the data inventory, dataflow diagrams, and classification, data quality and accuracy, data use limitation, and data analytics including aggregation, AI, and the data warehouse. Data Persistence and Destruction (3B) covers data minimization, data disclosure and transfer, storage, retention, and archiving, and data destruction.
The questions are practical and they reward one instinct: collect less, keep it for less time, and destroy it in a way you can prove. Expect stems where a signup form collects a date of birth to run an age check, where a correction reaches one system and not the three downstream copies, where two anonymized data sets combine into a re-identification, and where an erasure was declared complete while the backups still hold the record. Cross-border transfer sits here too, so transfer mechanisms and their technical safeguards are fair game.
Do not treat minimization and anonymization as the same control. Minimization changes how much data exists. Anonymization changes whether the data still points at a person. The exam separates them deliberately. Study this domain second, because it defines the data that Domain 1 governs and that Domain 4 protects.
Domain 4: Privacy Engineering (39%)
This is the exam. Three sub-areas, not two. Technology Stacks (4A) covers infrastructure and platform technology including legacy systems and cloud computing, devices and endpoints, connectivity, the secure development life cycle, and APIs and cloud-native services. Privacy Related Security Controls (4B) covers asset management, identity and access management, patch management and hardening, communication and transport protocols, encryption and hashing, and monitoring and logging. Privacy Controls (4C) covers consent tagging, tracking technologies including cookie management, anonymization and pseudonymization, privacy enhancing technologies, and AI and machine learning considerations.
Count how many of those are engineering topics rather than policy topics. Nearly all of them. The depth expected is not that of a specialist in any one of these, but it is well past literacy. You are expected to know which side of the shared responsibility model owns data residency configuration, why an unsalted hash of an email address is not anonymization, what tokenization does that encryption does not, why an API returning full user objects is a privacy failure and not just a performance one, and which privacy enhancing technology fits a use case where two organizations need a joint statistic without exchanging raw records.
The distinctions the exam leans on hardest are the ones people get almost right. Anonymized data falls outside privacy law; pseudonymized data does not, because the mapping back to a person still exists somewhere. A privacy enhancing technology reduces residual risk, it does not remove it, and every one of them costs something in accuracy or performance. Logging everything is a security reflex that quietly builds a high-value store of personal data, and the fix is minimization and masking rather than switching logging off.
If you want that domain taught rather than listed, our CDPSE study guide gives Privacy Engineering the page budget its 39% deserves, across the technology stack, the security controls, and the privacy controls, then drills it with full-length practice where every option is explained, including the attractive wrong one.
Why do older CDPSE materials list different domains?
Because the effective-2025 outline restructured the exam. CDPSE used to run on three domains: Privacy Governance, Privacy Architecture, and Data Life Cycle. Those names are history. They are not current domains, they are not sub-areas of the current domains, and material organized around them is teaching a structure the exam no longer uses.
The restructure did more than rename things, which is why it matters more than the usual outline refresh. Privacy Engineering, now the largest domain on the paper, did not exist as a domain under the old shape, so a guide built to the three-domain structure can look complete and still under-serve 39% of your exam.
One more thing to watch. ISACA's own CDPSE Planning Guide PDF is stale on the domain structure and is not consistent with itself about how many domains there are, so do not use it as your blueprint no matter how official the file name looks. Take the names and weights from the Examination Content Outline on ISACA's CDPSE pages and from the current Certification Exam Candidate Guide, and confirm both before you plan around them.
Do you have to pass each CDPSE domain?
No, and this is the misreading a weights post invites. You get one scaled score between 200 and 800, 450 is the pass, and it is built from the total number of items you answered correctly regardless of which domain they came from. The domain percentages reported with your result are information only.
So points are fungible. A weak domain costs you exactly its share of the paper and not a point more, which is why the weights are a budgeting instrument rather than a set of hurdles. How hard the CDPSE exam is takes the scoring side of that apart properly.
How should the CDPSE domains shape your study time?
Split your hours by weight, and accept how lopsided that looks. Domain 4 alone should take roughly as much time as Domains 1 and 2 combined, because it is roughly as much of the exam as Domains 1 and 2 combined.
Now the part the table cannot tell you. A candidate arriving from a legal, compliance, or privacy program background who reads the four domains at an even pace is misallocating badly, and usually without noticing, because the early chapters feel productive. Privacy Governance and Privacy Risk Management and Compliance are 38% of the paper between them and they are the 38% that reads most like work you already do. Every comfortable hour spent there is an hour not spent on shared responsibility models, key management, or the difference between k-anonymity and differential privacy, which is where the other 62% lives.
The order we would use: skim Domain 1 for vocabulary, read Domain 2 quickly for the assessment and framework material, work Domain 3 properly because it feeds everything, then give Privacy Engineering the longest and last block, with practice questions rather than reading as the main activity. If your background is already engineering, invert the emphasis at the front end but not at the back. Domain 4 still gets the most time, because it is still 39%.
One thing to settle before you plan any of it. The CDPSE experience requirement governs whether a pass turns into a certification, and it is worth knowing where you stand before you book a sitting rather than after.
FAQ
How many questions are in each CDPSE domain?
ISACA does not publish a per-domain question count. It publishes the weights and the 120-question total, and multiplying one by the other gives roughly 24 on Privacy Governance, 22 on Privacy Risk Management and Compliance, 28 on Data Life Cycle Management, and 47 on Privacy Engineering. Those are rounded, and ISACA's Certification Exam Candidate Guide notes that its exams include unscored pretest items, so treat them as planning estimates.
Which CDPSE domain is the hardest?
Privacy Engineering, for most candidates, and it is also the largest at 39%. It runs from cloud and legacy infrastructure, secure development, and identity and access management through encryption, logging, tracking technologies, anonymization, privacy enhancing technologies, and machine learning. If your background is legal or program management rather than technical, this is where your study time should concentrate.
Do I need to pass each CDPSE domain separately?
No. CDPSE is scored as one scaled result from 200 to 800, with 450 to pass. The domain-level figures reported with your result are informational only, because your score is based on the total number of items answered correctly regardless of domain. There is no per-domain pass mark.
Did the CDPSE domains change?
Yes. The Examination Content Outline effective 2025 restructured the exam into the current four domains. Earlier material was organized around a three-domain structure whose names included Privacy Architecture, which is no longer a CDPSE domain, and the current Privacy Engineering domain did not exist under that older shape. Check what any study material was written to, and take the current names and weights from ISACA's Examination Content Outline and Certification Exam Candidate Guide.
How much of the CDPSE exam is technical?
Privacy Engineering is 39% and is technical throughout, and parts of Data Life Cycle Management are technical too, including data classification, analytics, and destruction methods. A reasonable working assumption is that around half the paper expects you to reason about systems and controls rather than about policy. That is the main thing separating CDPSE from a privacy program credential.
Looking for a plain-English CDPSE guide? ISACA CDPSE: Simply Certified Study Guide covers all four domains at their 20/18/23/39 weights, with full-length practice exams, every answer explained.
Simply Certified is an independent publisher. CDPSE and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.