ISACACertified Data Privacy Solutions Engineer
The ISACA Certified Data Privacy Solutions Engineer (CDPSE) certification validates your ability to implement privacy-by-design principles into existing and future systems, networks, and applications. It is for technical professionals who work cross-functionally to engineer ethical, human-centered privacy solutions. Earning CDPSE proves you can help your organization meet modern privacy compliance demands while enabling secure, efficient technology operations.
841 practice questions · Updated 2026-07-30
4Domains
27Objectives
224Concepts
841Questions
CDPSE Curriculum
Every domain, objective, and concept the CDPSE exam measures.
- Define Personal Information
- Identify Types of Personal Information
- Recognize Sensitive Personal Information
- Understand Data Subject
- Differentiate Personal vs. Non-Personal Data
- Apply Privacy Principles to Personal Information
- Privacy by Design principles
- Privacy by Default
- Implementing Privacy by Design
- Consent requirements
- Consent mechanisms
- Consent management
- Transparency obligations
- Privacy notices and policies
- Transparency in practice
- Identify Applicable Privacy Laws
- Understand Key Privacy Law Principles
- Compare Privacy Law Requirements
- Assess Organizational Compliance
- Apply Privacy Laws to Data Flows
- Monitor Regulatory Changes
- Privacy Documentation Purpose
- Policy vs. Guideline Distinction
- Privacy Policy Components
- Guideline Development
- Documentation Lifecycle
- Alignment with Standards
- Stakeholder Communication
- Organizational Culture Influence
- Privacy Roles and Responsibilities
- Privacy Governance Structure
- Cross-Functional Collaboration
- Privacy Awareness and Training
- Accountability and Ownership
- Vendor Risk Assessment
- Contractual Privacy Requirements
- Vendor Due Diligence
- Ongoing Vendor Monitoring
- Incident Response and Breach Notification
- Data Processing Agreements
- Sub-processor Management
- Vendor Termination and Data Return
- Incident Response Plan
- Incident Detection and Reporting
- Incident Triage and Classification
- Incident Investigation and Analysis
- Incident Containment and Eradication
- Incident Recovery and Remediation
- Incident Communication and Notification
- Post-Incident Review and Lessons Learned
- Data Subject Rights Overview
- Handling Data Subject Requests
- Verification of Requestor Identity
- Exemptions and Limitations
- Notification Obligations
- Documentation and Record-Keeping
- Coordination with Other Departments
- Risk Management Process Overview
- Risk Identification
- Risk Assessment and Analysis
- Risk Evaluation and Prioritization
- Risk Treatment and Mitigation
- Risk Monitoring and Review
- Risk Communication and Reporting
- Privacy Policies and Standards
- Policy Implementation and Enforcement
- Policy Review and Update
- PIA Definition and Purpose
- PIA Triggers and Timing
- PIA Process Steps
- Data Flow Mapping
- Privacy Risk Identification
- Risk Mitigation Strategies
- Stakeholder Engagement
- PIA Documentation and Reporting
- PIA Review and Update
- Privacy Training Program Design
- Target Audience Identification
- Training Content Development
- Training Delivery Methods
- Training Frequency and Updates
- Awareness Campaigns
- Measuring Training Effectiveness
- Documentation and Compliance
- Threat Identification
- Vulnerability Assessment
- Threat and Vulnerability Analysis
- Risk Prioritization
- Mitigation Strategies
- Risk Response Options
- Selecting Risk Response
- Implementing Risk Responses
- Monitoring and Reviewing Risk Responses
- Privacy Framework Fundamentals
- Common Privacy Frameworks
- Framework Selection Criteria
- Framework Implementation Approach
- Framework Alignment and Integration
- Framework Maintenance and Continuous Improvement
- Evidence types
- Evidence collection methods
- Evidence preservation
- Evidence analysis
- Artifact definition
- Artifact creation
- Artifact management
- Evidence and artifact mapping
- Evidence and artifact review
- Define program monitoring metrics
- Establish monitoring processes
- Analyze metric data
- Report on program performance
- Use metrics for improvement
- Data Inventory Definition
- Data Inventory Components
- Data Inventory Creation Process
- Dataflow Diagram Purpose
- Dataflow Diagram Symbols and Notation
- Dataflow Diagram Creation
- Data Classification Definition
- Classification Levels and Criteria
- Classification Implementation
- Define data quality
- Identify data quality dimensions
- Explain data accuracy
- Assess data accuracy
- Implement accuracy controls
- Monitor data accuracy
- Data Use Limitation Principle
- Purpose Specification
- Compatibility Assessment
- Consent and Legal Basis
- Data Minimization in Use
- Use Limitation Controls
- Monitoring and Auditing Data Use
- Data Retention and Deletion
- Third-Party Use Restrictions
- User Rights and Transparency
- Data Aggregation
- Aggregation Techniques
- Privacy Risks in Aggregation
- Aggregation Controls
- Artificial Intelligence (AI) Fundamentals
- AI and Data Privacy
- AI Governance
- Data Warehouse Concepts
- Data Warehouse Architecture
- Privacy in Data Warehousing
- Data Minimization Principles
- Legal and Regulatory Requirements
- Data Collection Limitation
- Data Retention and Disposal
- Purpose Specification
- Data Anonymization and Pseudonymization
- Privacy by Design and Default
- Data Flow Mapping and Inventory
- Minimization in Data Sharing and Third-Party Management
- Monitoring and Auditing Minimization Practices
- Data Disclosure Principles
- Data Transfer Mechanisms
- Cross-Border Data Transfer Compliance
- Data Subject Rights in Disclosure
- Third-Party Disclosure Risks
- Incident Response for Unauthorized Disclosure
- Data Storage Fundamentals
- Storage Architecture and Design
- Data Retention Policies
- Retention Schedule Development
- Legal and Regulatory Compliance
- Data Archiving Strategies
- Archiving Implementation Methods
- Data Retrieval and Access
- Data Disposal and Destruction
- Monitoring and Auditing Retention
- Data Destruction Fundamentals
- Legal and Regulatory Requirements
- Data Destruction Methods
- Data Destruction Policies and Procedures
- Data Destruction Verification and Auditing
- Data Destruction for Different Media Types
- Data Destruction and Data Retention
- Data Destruction in Cloud and Outsourced Environments
- Data Destruction Incident Response
- Data Destruction Training and Awareness
- Legacy Infrastructure
- Cloud Computing Models
- Cloud Deployment Models
- Virtualization and Containers
- Endpoints and Device Types
- Endpoint Security and Privacy
- Network Connectivity
- Wireless and Mobile Connectivity
- API Fundamentals
- API Security and Privacy Controls
- Cloud-Native Services
- Data Residency and Sovereignty
- Asset Inventory and Classification
- Asset Lifecycle Management
- Secure Development Life Cycle (SDLC)
- Threat Modeling in SDLC
- Identity and Access Management (IAM) Fundamentals
- Authentication Methods
- Authorization Models
- Privileged Access Management
- Patch Management Process
- System Hardening
- Secure Communication Protocols
- Transport Layer Security (TLS)
- Encryption Fundamentals
- Hashing and Digital Signatures
- Key Management
- Monitoring and Logging Fundamentals
- Log Management and Analysis
- Intrusion Detection and Prevention
- Consent Tagging Fundamentals
- Consent Tagging Implementation
- Cookie Management Basics
- Cookie Consent Mechanisms
- Anonymization Techniques
- Pseudonymization Techniques
- Privacy-Enhancing Technologies Overview
- PET Selection and Evaluation
- AI and Machine Learning Privacy Risks
- Privacy-Preserving AI Techniques
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CDPSE, so none is invented.