ISACA CDPSE Certification

The Certified Data Privacy Solutions Engineer is ISACA’s credential for the people who build privacy, the engineers, architects, and technical leads who translate privacy law and policy into working systems. Where legal-track certifications prove you can interpret a regulation, the CDPSE proves you can implement it: designing privacy into pipelines and platforms, choosing the right controls and privacy-enhancing technologies, governing data through its full life cycle, and assessing the privacy risk of what the organization actually runs.

The CDPSE exam contains 120 questions and runs on a 3.5-hour clock, covering four domains.

ISACA reports CDPSE results on a scaled 200-800 range, with 450 required to pass. The scaled score is not a raw percentage, so Certifym sets the pass mark on its practice exams at 65% as an honest raw-score equivalent.

The credential is aimed at candidates with three or more years of relevant experience. In practice that means privacy engineers, security architects moving into privacy, and IT professionals who own the systems where personal data lives.

Four domains: Privacy Governance (20%), Privacy Risk Management and Compliance (18%), Data Life Cycle Management (23%), and Privacy Engineering (39%). Privacy Engineering is the heavyweight domain and the exam’s center of gravity.

The exam content outline was restructured effective June 2, 2025. ISACA moved from the original three domains to four, splitting risk management and compliance into its own domain and consolidating all of the technical material (infrastructure, SDLC, APIs, encryption, monitoring, consent technology, PETs, and AI/ML privacy considerations) into a single Privacy Engineering domain that now carries 39% of the exam. If your study materials still show three domains, they predate the current outline.

The difficulty comes from its technical center of gravity. With Privacy Engineering at 39% of the exam, you cannot pass on governance reading alone, you need working knowledge of infrastructure and platform technologies, privacy in the SDLC and in APIs, identity and access management, encryption and hashing, monitoring and logging, anonymization and pseudonymization, privacy-enhancing technologies, and AI/ML privacy considerations. Domains 1 and 2 also lean on scenario judgment: controller/processor roles, consent validity, cross-border transfers, breach clocks, and DSAR calls.

Start from the current exam content outline, download it directly from isaca.org and confirm it shows four domains, not three. Then drill blueprint-weighted full-length practice. Each Certifym CDPSE practice exam is a 120-question timed simulation weighted exactly to the official blueprint (24 questions on governance, 21 on risk and compliance, 28 on the data life cycle, and 47 on privacy engineering) on the same 3.5-hour clock as the real exam, so hitting the pass mark means demonstrated competence across all four domains rather than luck in the heavy ones.

CDPSE is the recognized technical counterpart to the compliance-side privacy credentials. Legal-track certifications prove you can interpret a regulation; CDPSE proves you can implement it in systems, privacy by design in pipelines and platforms, control and PET selection, data life cycle governance, and privacy risk assessment of what the organization actually runs.