The CDPSE (Certified Data Privacy Solutions Engineer) is an ISACA exam for people who build and run privacy controls in technical systems. This page gives you the verified exam facts, such as the fee, question count and passing score, and links to free practice sets on privacy governance, risk, rights, transfers and technical controls. The questions are written by us with AI tools.
The CDPSE has 120 questions and costs $760[1][2] (ISACA, verified Oct 26, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 120 multiple-choice questions[1] | ISACA · Oct 26, 2026 |
| Passing score | 450 on a 200–800 scaled score[2] | ISACA · Oct 26, 2026 |
| Exam fee | US$575 members / US$760 nonmembers[2] | ISACA · Oct 26, 2026 |
| Retake policy | 4 attempts per rolling 12 months; waits of 30, 90 and 90 days[2] | ISACA · Oct 26, 2026 |
| Validity | Passing result valid 5 years for certification application[3] | ISACA · Oct 26, 2026 |
| Renewal | 120 CPE hours per 3-year cycle, minimum 20 per year[3] | ISACA · Oct 26, 2026 |
| Delivery | Computer-based at PSI test centers or remotely proctored; continuous registration[4] | ISACA · Oct 26, 2026 |
| Eligibility | Exam open to anyone; certification requires 3+ years of experience across the 4 CDPSE domains[3] | ISACA · Oct 26, 2026 |
| Score release | Preliminary pass/fail on screen; official score within 10 working days[2] | ISACA · Oct 26, 2026 |
| Testing window | 6-month eligibility period from registration (one US$75 six-month extension)[2] | ISACA · Oct 26, 2026 |
According to ISACA, “The Certified Data Privacy Solutions Engineer ® (CDPSE ® ) exam consists of 120 questions covering 4 job practice domains, all testing your knowledge and ability on real-life job practices leveraged by expert professionals.”[1]
The CDPSE is the data privacy credential from ISACA. It tests whether you can apply privacy practice to real technical work. The exam has 120 multiple-choice questions covering 4 job practice domains.
Delivery. The exam is computer-based. You can sit it at an authorized PSI testing center or take it as a remotely proctored exam. Registration is continuous, so there is no fixed exam date to wait for.
Scoring. Scores are scaled from 200 to 800, and you need 450 or higher to pass. You see a preliminary pass or fail result on screen. The official score is emailed and available online within 10 working days.
Fees and time. Registration costs US$575 for ISACA members and US$760 for nonmembers, based on your membership status when you register. You have a 6-month eligibility period from registration. If you need more time, a single 6-month extension costs US$75.
Eligibility and retakes. Anyone can sit the exam. The certification itself requires 3 or more years of professional experience across the 4 CDPSE domains. If you do not pass, you get 4 attempts within a rolling 12-month period, with waits of 30, 90 and 90 days between them.
After you pass. You must apply for certification within 5 years of passing. Renewal needs 120 CPE hours per 3-year cycle, with at least 20 each year.
Always check the ISACA CDPSE pages before you pay, because fees and policies can change.
Prepare for the CDPSE - Certified Data Privacy Solutions Engineer exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: A privacy governance framework should include which of the following as a primary component for managing third-party data processors?
Answer: B. Data Processing Agreements (DPAs) with contractual privacy obligations
Explanation:
The answer is B. A Data Processing Agreement is the contract that binds a processor to the controller's privacy obligations, so it is the core governance tool for third parties. Option A is wrong because audits check security after the fact, and they do not create the obligations. Option C is wrong because a ban on all sharing is unworkable, since most organizations need processors. Option D is wrong because on-site inspections of every facility are costly and are not a primary component of the framework. Rule to remember: when the question asks how to manage processors, look for the contractual control first. Audits and inspections support the contract and do not replace it.
Question: Binding Corporate Rules (BCRs) are MOST appropriate for which scenario?
Answer: B. Intra-group data transfers among entities within a multinational corporation
Explanation:
The answer is B. Binding Corporate Rules are internal data protection policies approved for a multinational group, so they cover transfers among entities of that same group. Option A is wrong because unrelated businesses are not part of one group and would need a different transfer mechanism, such as contractual clauses. Option C is wrong because transfers to government agencies are not what BCRs are built for. Option D is wrong because anonymized research data sent to universities is not an intra-group transfer, and anonymized data may fall outside personal data rules anyway. Rule to remember: BCRs mean one corporate family and internal transfers. A transfer between separate organizations points to another tool.
Question: When managing privacy risks, it is crucial to distinguish them from security risks. Which of the following scenarios describes a privacy risk arising from authorized data processing, rather than a security risk from unauthorized access?
Answer: C. Customer data collected for marketing is used to make automated, adverse credit decisions without transparency.
Explanation:
The answer is C. The company is processing data it is allowed to hold, but it reuses marketing data for automated credit decisions without transparency. That harms the individual even though nobody broke in, which makes it a privacy risk. Options A and B involve a hacker or stolen credentials, which are unauthorized access and so security risks. Option D is a lost unencrypted laptop, which is a loss of confidentiality and also a security risk. Rule to remember: ask whether the harm comes from someone getting in without permission, which is security, or from the organization's own use of the data, which is privacy. Purpose limitation and transparency are the usual signals.
Start with the ISACA CDPSE exam content outline and read the domain names and task lists. Use them as your checklist, because our practice sets are not a copy of the official outline.
Next, take the general sets such as CDPSE and CDPSE Certification to find your weak areas. Do not worry about the score at this stage. For every miss, write down why the right option is right and why your choice was wrong.
Then work through the topic sets, one at a time, matching each to a gap you found: Governance Frameworks, Impact Assessments, Risk Management, Subject Rights, Incident Response, Technical Privacy Controls, Cross-Border Data Transfers and Data Lifecycle Management. After each set, reread the matching part of the official material.
In the last stretch, use the mixed sets under timed conditions and keep the 120-question length in mind. Look for patterns in your errors, such as mixing up privacy risk and security risk, and fix those before test day.
The CDPSE exam has 120 multiple-choice questions covering 4 job practice domains, according to the ISACA exam content outline. It is computer-based. You can take it at a PSI testing center or as a remotely proctored exam.
You need 450 or higher on a scaled range of 200 to 800. A preliminary pass or fail result appears on screen after the exam. The official score is emailed and available online within 10 working days.
Registration is US$575 for ISACA members and US$760 for nonmembers, based on your membership status when you register. Your eligibility period lasts 6 months from registration, and a 6-month extension costs US$75. Check ISACA before paying.
No. The exam is open to anyone. The certification itself requires 3 or more years of professional work experience across the 4 CDPSE domains. You must apply for certification within 5 years of passing the exam.
You get 4 attempts within a rolling 12-month period. The waits between attempts are 30, 90 and 90 days. Read the current ISACA exam candidate guide before you book a retake, in case the policy has changed.
You need to report a minimum of 120 CPE hours during each 3-year cycle, with at least 20 hours each year. ISACA sets the reporting rules, so use its CDPSE certification page for the current details.
How we verify: editorial & fact-checking policy. Report an error: contact us.