What is CDPSE certification? It is ISACA's technical privacy credential. CDPSE stands for Certified Data Privacy Solutions Engineer, and it is aimed at the person who builds privacy into systems rather than the person who interprets the rules. The exam is 120 multiple-choice questions in 3.5 hours across four domains, scored on a scale of 200 to 800 with 450 required to pass. It costs USD 575 for ISACA members and USD 760 for nonmembers, it is offered in English only, and you sit it at a PSI test center or at home with a remote proctor.
The word engineer in the title is not decoration. Under the CDPSE Examination Content Outline effective 2025, a single domain called Privacy Engineering carries 39% of the paper, and it is technical: cloud and legacy stacks, identity and access management, encryption and hashing, anonymization, privacy enhancing technologies, and AI and machine learning data handling. Nearly two out of every five questions come from there. If that sentence made you uncomfortable, this is probably the wrong credential for you, and the rest of this post explains why.
What is CDPSE certification for?
It certifies technical privacy ability. Not privacy literacy, not the ability to summarize a regulation, but the ability to take a privacy requirement and turn it into a configuration, an architecture decision, or a control that someone can audit later.
ISACA describes the audience as people experienced in the governance, architecture, and life cycle of data privacy at a technical level. In practice that means privacy engineers, security and IT architects moving into privacy work, and the audit, risk, and infrastructure people who keep being handed privacy problems because they are the ones who actually know where the data sits.
Who should sit CDPSE, and who should not?
This is the part most people searching the term actually need settled, so here is a straight answer.
Sit CDPSE if you could sketch, on a whiteboard, where personal data enters your organization, which systems copy it, and which of those copies are encrypted. If you have argued with a product team about a default setting, written a retention job, or had to explain to legal why a deletion request cannot reach the backups, the exam is describing your job.
Do not sit CDPSE because you want a privacy credential and this one happens to be from ISACA. If your work is drafting notices, running consent programs, managing vendor contracts, or advising on regulation, roughly 39% of this exam is a subject you do not practice. You can learn it, and plenty of people do, but you are choosing to spend most of your study time outside your own competence. That is a choice worth making deliberately rather than by accident.
What are the four CDPSE domains?
Every question maps to one of four domains. Under the CDPSE Examination Content Outline effective 2025, the published weights are:
| Domain | Weight |
|---|---|
| 1. Privacy Governance | 20% |
| 2. Privacy Risk Management and Compliance | 18% |
| 3. Data Life Cycle Management | 23% |
| 4. Privacy Engineering | 39% |
Domain 1 covers personal information, privacy principles including Privacy by Design, laws and documentation, plus the operational side: roles, vendors, incidents, and data subject requests. Domain 2 is privacy risk work, with the Privacy Impact Assessment at its center, and the frameworks and evidence that prove a program is running. Domain 3 walks the data life cycle from inventory, classification, and use limitation through minimization, transfer, retention, and provable destruction. Domain 4 is the engineering.
That structure is worth checking against any material you already own, because CDPSE was restructured. The older three-domain shape, with a domain called Privacy Architecture, is superseded. We take all four apart section by section in the CDPSE domains explained.
Why is Domain 4 nearly 40% of the exam?
Because that is the gap ISACA built the credential to fill. The domain has three sub-areas rather than the usual two, and their contents explain the design.
Technology stacks and privacy-related security controls are, between them, a security engineer's syllabus pointed at privacy outcomes: on-premises and legacy systems, IaaS, PaaS and SaaS, the shared responsibility model, data residency, devices and endpoints, network connectivity, the secure development life cycle, APIs and cloud-native services, asset management, identity and access management, patching and hardening, transport protocols, encryption and hashing, and monitoring and logging. The third sub-area, privacy controls, is the one that belongs to nobody else's job description: consent tagging, tracking technologies and cookie management, anonymization and pseudonymization, privacy enhancing technologies, and AI and machine learning considerations.
ISACA publishes the weight rather than a question count, but 39% of a 120-question paper works out at roughly 47 questions, more than Domains 1 and 2 combined. Any study plan that treats it as the last chapter is mistuned before it starts, and how hard the CDPSE exam is takes that difficulty apart honestly.
What is the CDPSE exam format?
120 multiple-choice questions in 3.5 hours, which is 210 minutes, or 105 seconds a question. One stem, four options, one best answer, and nothing to configure or write.
Correct your expectations here if you hold another ISACA credential. CISA, CISM, CRISC, and CGEIT are 150 questions in 4 hours. CDPSE is a shorter paper on a shorter clock, and candidates who plan their pacing from a CISA rehearsal arrive with the wrong instincts. The other difference that catches people out: CDPSE is delivered in English only, unlike the multilingual ISACA exams.
Scoring is scaled. Raw performance converts to a number between 200 and 800, and 450 is the minimum passing score. There is no published percentage equivalent, so do not let anyone convert 450 out of 800 into a target percentage for you. Domain-level results come back with your score as information only, because the result is based on total items answered correctly across the whole paper rather than on clearing a bar in each domain. ISACA does not publish a CDPSE pass rate, and any figure you find quoted was estimated by someone without access to the data.
What does the CDPSE cost and how do you book it?
USD 575 if you hold ISACA membership when you register, USD 760 if you do not. The fee is nonrefundable and nontransferable. Certification after you pass adds a one-time USD 50 application processing fee.
Registration opens a six-month eligibility window, and you have to schedule and sit inside it. ISACA sells one six-month extension for USD 75, one per exam, and a booked sitting has to be canceled at least 48 hours ahead for the extension to apply. Retakes are capped at four attempts in a rolling 12-month period, with waits of 30, then 90, then 90 days between them, so a bad first sitting costs you a quarter of a year as well as another full fee. Every figure in this section is one ISACA can change, so price it on ISACA's own pages before you register.
What experience does CDPSE certification require?
Three or more years of privacy work, gained within the 10 years before your application date. That is the number to plan around, and it applies to certification rather than to sitting the exam.
Beyond that, be careful, because ISACA's own pages do not currently say the same thing. The CDPSE certification page states the three-year requirement and the 10-year window and stops there. ISACA's certification application FAQ adds two rules on top: that the experience must span at least two of the CDPSE exam content outline domain areas, and that there are no substitutions or experience waivers. The no-waivers half is corroborated by ISACA's Certification Exam Candidate Guide, which says the same in its certification summary table, so plan on it. The two-domain spread is not corroborated anywhere, and it sits in an FAQ that still refers to the retired 2020 domain names, so we flag it as ISACA's FAQ position rather than stating it as settled. Read both pages before you apply, and if the two-domain spread affects you, ask ISACA in writing.
One rule the books tend to omit: your experience has to be independently verified. A supervisor, manager, colleague, or client signs for it. A family member cannot, and neither can your HR department. Passing the exam also gives you five years to apply, which is generous, but the clock is real. The full picture, including what counts as qualifying work, is in the CDPSE experience requirements.
What does it cost to keep the CDPSE?
Continuing professional education of 20 hours a year and 120 hours across each three-year reporting period, plus an annual maintenance fee due on 1 January: USD 45 for members and USD 85 for nonmembers.
If CDPSE is your third or later ISACA credential, that maintenance fee drops to USD 25 for members and USD 50 for nonmembers, which is one of the few places the ISACA line rewards collecting. Keep your CPE records for 12 months past the end of the cycle, because ISACA audits them and failing an audit means losing the credential rather than paying a penalty.
Where does CDPSE sit next to the rest of the ISACA line?
It is the technical outlier. CISA certifies the auditor who evaluates controls somebody else built. CRISC certifies the practitioner who sizes risk and argues for a response. CDPSE certifies the person who has to build the thing, then prove the build satisfies a privacy obligation.
That makes it the natural second or third credential for an ISACA-line professional whose work has drifted toward data protection, and the natural first ISACA credential for an engineer who has been doing privacy work without a name for it. It is also the point in our catalog where the ISACA security line meets privacy work proper, which is why so many candidates arrive from one side and are surprised by the other. Governance people are surprised by Domain 4. Engineers are surprised that Domains 1 and 2 together are still 38% and are full of law, roles, and assessment procedure.
What does the CDPSE actually test?
Here is the thesis that should shape your preparation: CDPSE rewards the build-it-in-by-design reflex over the fix-it-afterward one.
Questions are written as decisions. Which control is BEST, what should be done FIRST, which action MOST reduces exposure. Frequently no option is wrong, and all four are things a competent professional might do. What separates them is whether the answer prevents the privacy harm or merely responds to it, and whether it treats privacy risk (harm to an individual) or security risk (harm to the organization). Encrypting a database is a fine answer to the wrong question if the real problem is that you collected the field at all.
Two ranking habits carry a surprising number of items. When two options both work, the one that minimizes the data usually wins. And hashing is not anonymization: if a mapping back to a person still exists anywhere, you are processing personal data and every obligation still applies. The ISACA CDPSE: Simply Certified Study Guide is built around that decision lens, with the page budget proportioned to the real 20/18/23/39 weighting so Domain 4 gets the depth its 39% deserves.
FAQ
How many questions is the CDPSE exam?
120 multiple-choice questions in a single 3.5-hour session, which is 210 minutes, or about 105 seconds per question. CISA, CISM, CRISC, and CGEIT run to 150 questions in 4 hours, so a rehearsal built on one of those is the wrong pacing model for this paper.
What score do you need to pass the CDPSE?
450 on a scaled range of 200 to 800. Because the score is scaled, there is no official percentage equivalent, and converting 450 out of 800 into a percentage will mislead you. Domain-level results are reported for information only and have no bearing on the pass or fail decision.
Can I take the CDPSE exam without three years of experience?
Yes. Sitting the exam and applying for certification are separate steps, and you have five years from passing in which to apply. Until you meet the experience requirement and submit an approved application, what you hold is a passing score rather than a certification.
Is CDPSE a technical certification or a legal one?
Technical. Privacy Engineering alone is 39% of the exam, and Data Life Cycle Management adds another 23%. Law and governance appear throughout Domain 1, but the credential is built for the person implementing privacy controls in systems, not the person advising on regulation.
Which CDPSE outline is current?
The CDPSE Examination Content Outline effective 2025, with four domains weighted 20/18/23/39. It replaced an older three-domain structure that included a domain called Privacy Architecture, so check the domain names on any material you already own before you trust its weighting.
Looking for a plain-English CDPSE guide? ISACA CDPSE: Simply Certified Study Guide covers all four domains at their 20/18/23/39 weights, with full-length practice exams, every answer explained.
Simply Certified is an independent publisher. CDPSE and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.