CDPSE Practice Test

CDPSE Exam at a Glance

What changed for CDPSE in 2026

• Oct 26, 2026: Delivery changed to Computer-based at PSI test centers or remotely proctored; continuous registration (previously Computer-based at PSI test centers or remote proctoring; continuous registration).^[4]
• Oct 26, 2026: Score release changed to Preliminary pass/fail on screen; official score within 10 working days (previously Preliminary result on screen; official score within 10 working days).^[2]
• Oct 26, 2026: Testing window changed to 6-month eligibility period from registration (one US$75 six-month extension) (previously 6-month eligibility period from registration (US$75 six-month extension)).^[2]

What the CDPSE is and how it works

According to ISACA, “The Certified Data Privacy Solutions Engineer ® (CDPSE ® ) exam consists of 120 questions covering 4 job practice domains, all testing your knowledge and ability on real-life job practices leveraged by expert professionals.”^[1]

The CDPSE is the data privacy credential from ISACA. It tests whether you can apply privacy practice to real technical work. The exam has 120 multiple-choice questions covering 4 job practice domains.

Delivery. The exam is computer-based. You can sit it at an authorized PSI testing center or take it as a remotely proctored exam. Registration is continuous, so there is no fixed exam date to wait for.

Scoring. Scores are scaled from 200 to 800, and you need 450 or higher to pass. You see a preliminary pass or fail result on screen. The official score is emailed and available online within 10 working days.

Fees and time. Registration costs US$575 for ISACA members and US$760 for nonmembers, based on your membership status when you register. You have a 6-month eligibility period from registration. If you need more time, a single 6-month extension costs US$75.

Eligibility and retakes. Anyone can sit the exam. The certification itself requires 3 or more years of professional experience across the 4 CDPSE domains. If you do not pass, you get 4 attempts within a rolling 12-month period, with waits of 30, 90 and 90 days between them.

After you pass. You must apply for certification within 5 years of passing. Renewal needs 120 CPE hours per 3-year cycle, with at least 20 each year.

Always check the ISACA CDPSE pages before you pay, because fees and policies can change.

Worked examples: how to reason through CDPSE questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: A privacy governance framework should include which of the following as a primary component for managing third-party data processors?

1. Annual security audits of all vendors
2. Data Processing Agreements (DPAs) with contractual privacy obligations
3. Prohibition of all data sharing with third parties
4. On-site inspections of all processor facilities

Answer: B. Data Processing Agreements (DPAs) with contractual privacy obligations

Explanation:

The answer is B. A Data Processing Agreement is the contract that binds a processor to the controller's privacy obligations, so it is the core governance tool for third parties. Option A is wrong because audits check security after the fact, and they do not create the obligations. Option C is wrong because a ban on all sharing is unworkable, since most organizations need processors. Option D is wrong because on-site inspections of every facility are costly and are not a primary component of the framework. Rule to remember: when the question asks how to manage processors, look for the contractual control first. Audits and inspections support the contract and do not replace it.

Example 2

Question: Binding Corporate Rules (BCRs) are MOST appropriate for which scenario?

1. Data transfers between unrelated businesses in different countries
2. Intra-group data transfers among entities within a multinational corporation
3. Data transfers to government agencies in non-adequate countries
4. Transfers of anonymized research data to universities

Answer: B. Intra-group data transfers among entities within a multinational corporation

Explanation:

The answer is B. Binding Corporate Rules are internal data protection policies approved for a multinational group, so they cover transfers among entities of that same group. Option A is wrong because unrelated businesses are not part of one group and would need a different transfer mechanism, such as contractual clauses. Option C is wrong because transfers to government agencies are not what BCRs are built for. Option D is wrong because anonymized research data sent to universities is not an intra-group transfer, and anonymized data may fall outside personal data rules anyway. Rule to remember: BCRs mean one corporate family and internal transfers. A transfer between separate organizations points to another tool.

Example 3

Question: When managing privacy risks, it is crucial to distinguish them from security risks. Which of the following scenarios describes a privacy risk arising from authorized data processing, rather than a security risk from unauthorized access?

1. A hacker exploits a software vulnerability to access customer records.
2. An employee's login credentials are stolen and used to exfiltrate a client database.
3. Customer data collected for marketing is used to make automated, adverse credit decisions without transparency.
4. An unencrypted laptop containing personal data is lost or stolen.

Answer: C. Customer data collected for marketing is used to make automated, adverse credit decisions without transparency.

Explanation:

The answer is C. The company is processing data it is allowed to hold, but it reuses marketing data for automated credit decisions without transparency. That harms the individual even though nobody broke in, which makes it a privacy risk. Options A and B involve a hacker or stolen credentials, which are unauthorized access and so security risks. Option D is a lost unencrypted laptop, which is a loss of confidentiality and also a security risk. Rule to remember: ask whether the harm comes from someone getting in without permission, which is security, or from the organization's own use of the data, which is privacy. Purpose limitation and transparency are the usual signals.

How to use these practice tests

Start with the ISACA CDPSE exam content outline and read the domain names and task lists. Use them as your checklist, because our practice sets are not a copy of the official outline.

Next, take the general sets such as CDPSE and CDPSE Certification to find your weak areas. Do not worry about the score at this stage. For every miss, write down why the right option is right and why your choice was wrong.

Then work through the topic sets, one at a time, matching each to a gap you found: Governance Frameworks, Impact Assessments, Risk Management, Subject Rights, Incident Response, Technical Privacy Controls, Cross-Border Data Transfers and Data Lifecycle Management. After each set, reread the matching part of the official material.

In the last stretch, use the mixed sets under timed conditions and keep the 120-question length in mind. Look for patterns in your errors, such as mixing up privacy risk and security risk, and fix those before test day.

Sources & last verified

1. ISACA — number of questions (official source). “The Certified Data Privacy Solutions Engineer ® (CDPSE ® ) exam consists of 120 questions covering 4 job practice domains, all testing your knowledge and…” Verified Oct 26, 2026.
2. ISACA — exam fee, passing score, retake policy, score release (official source). “Exam registration fees are based on membership status at the time of exam registration: • ISACA Member: US$575 • ISACA Nonmember: US$760” Verified Oct 26, 2026 · source checked Oct 24, 2026.
3. ISACA — validity, renewal, eligibility (official source). “Candidates must apply for certification within five years of having passed the exam.” Verified Oct 26, 2026.
4. ISACA — delivery (official source). “ISACA’S CDPSE certification exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams.” Verified Oct 26, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.