DAPLE (C1)

Questions are multiple choice. The published blueprint lists nine weighted domains, with law and regulatory frameworks and security architecture carrying the largest shares. The official body publishes the current item count, delivery method, and any accommodations - confirm on its site rather than relying on secondhand reports.

We do not state duration, fees, or passing scores because these change and no official source was supplied. The certifying organization publishes the current exam length, price, and scoring policy on its website; check that page before you schedule, and re-check if your test date is months away.

Engineers with production experience typically find the technical domains - encryption, access control, incident handling - straightforward. Difficulty concentrates in the legal and cross-border transfer material, where precise vocabulary matters and plausible-sounding answers are often subtly wrong. Expect scenario questions that reward reasoning over memorized definitions.

Retake rules, waiting periods, and any fees are set by the certifying body and are not published here. Check its official policy page for the current terms, including whether a cooling-off period applies between attempts. Plan your first attempt as if a retake is possible but not immediate.

Start with law and privacy principles to build vocabulary, then classification and data mapping, since every later control depends on knowing what data you hold. Follow with security architecture, cryptography, and identity. Finish with incident response, third-party transfers, and privacy by design, which draw on everything before them.

Three recurring traps: confusing controller and processor obligations when several parties are involved; treating encryption as a blanket exemption from breach notification rather than weighing key exposure; and assuming a transfer mechanism covers onward sharing. Read each scenario for who holds the data and who decides the purpose.

Take one real system you know and document its data flows end to end: what is collected, where it is stored, who can read it, which vendors see it, and how it is deleted. For each step, name the control and the legal basis. That exercise covers most domains better than rereading summaries.

No. This is independent study material and is not affiliated with or endorsed by the certifying organization. Domain weights shown here are unverified and flagged for review. Always treat the official blueprint and candidate handbook as authoritative for scope, scheduling, and scoring.