DAPLE (C1) study guide
DAPLE (C1) · Work through your exam, one topic at a time.
DAPLE (C1) - the Certified Data Protection Lead Engineer (C1) - is a vendor-neutral credential aimed at engineers and architects who build and operate systems that must satisfy data protection obligations. It sits at the intersection of privacy law and hands-on engineering: rather than testing policy drafting alone, it expects you to reason about how classification, encryption, access control, logging, and vendor data flows actually behave in production. The DAPLE (C1) study guide has 9 sections and about 3,702 words.
01Data Protection Law and Regulatory Frameworks
Framework questions are scenario questions: a fact pattern names an organisation, a data type and a jurisdiction, and asks which law applies, in what role the organisation acts, and what obligation follows. You need the GDPR architecture cold, plus enough CCPA/CPRA, LGPD and PIPL to spot where a second regime layers a parallel duty onto the same processing.
514 words, about 3 min02Data Privacy Principles and Governance
This domain tests whether you can turn the Art 5 principles into operational rules a business can be audited against, and describe the governance machinery that produces evidence. Questions often present a plausible-sounding practice and ask which principle it breaches, or which governance artefact would have prevented it.
469 words, about 2 min03Data Classification, Inventory, and Data Mapping
You are tested on finding personal data, labelling it, and proving where it flows. Expect questions that contrast a record of processing with a data flow map, or that ask which classification tier a dataset attracts and what handling rule follows.
445 words, about 2 min04Data Security Architecture and Controls
This domain tests control selection and justification. You will be asked which technical and organisational measures meet Art 32 in a given risk context, and how those measures map onto recognised frameworks such as ISO/IEC 27001, NIST CSF and CIS Controls.
390 words, about 2 min05Encryption, Key Management, and Cryptography
The exam tests practical cryptographic choices and, more heavily, the key lifecycle, because most real-world failures are key failures rather than algorithm failures. Expect questions on which primitive fits which job, and on what makes an encryption claim defensible.
396 words, about 2 min06Access Control, Identity, and Authentication
Questions here probe whether you can separate authentication from authorisation, choose an access model that fits a scenario, and control privileged and non-human identities. Expect distractor answers that solve the wrong problem.
344 words, about 2 min07Incident Response, Breach Notification, and Forensics
This domain combines process, legal clock and evidence handling. Questions typically hinge on when the notification clock starts, whether notification is required, and what evidence must be preserved before remediation destroys it.
397 words, about 2 min08Third-Party Risk, Vendor Management, and Cross-Border Transfers
This domain tests vendor governance from due diligence through contract, monitoring and exit, plus the Chapter V transfer toolkit. Questions often present a transfer scenario and ask which mechanism is valid, or present a vendor claim and ask what evidence is missing.
364 words, about 2 min09Privacy Engineering, Privacy by Design, and Emerging Technology
This domain tests whether you can build privacy into a product rather than bolting it on. Questions ask which engineering technique reduces risk in a given design, how Art 25 applies by default, and how to treat AI and other emerging technology.
383 words, about 2 min