ICDL Data Protection (ICDL)
ICDL Data Protection
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ICDL Data Protection certification is part of the ICDL family of digital skills credentials offered by ICDL Foundation, a global social enterprise committed to raising standards of digital competence in the workforce, education and society. ICDL certification is available in more than 100 countries through a network of more than 20,000 testing centres. This module is designed for anyone who handles personal data at work or in study - office staff, administrators, managers, students and jobseekers - and who needs to understand how data protection rules apply in everyday practice. The exam covers four areas: data protection concepts, data protection in practice, data security and breach handling, and compliance and individual rights. Candidates are expected to recognise lawful bases for processing, apply principles such as minimisation and storage limitation, respond to data subject requests, and know how to detect, report and contain a breach. Preparation typically combines the official ICDL syllabus with hands-on practice in realistic workplace scenarios, such as reviewing a privacy notice, assessing a data-sharing request, or drafting a breach notification. Note: the official ICDL Data Protection module page was unavailable at the time of writing, so exam-specific details such as item count, duration, pass mark and fee are not confirmed here.
What you'll study
About ICDL Data Protection preparation
What is the format of the ICDL Data Protection exam?
The exam is delivered through ICDL Accredited Test Centres and is designed to test practical understanding rather than recall alone. However, the official module page was not available when this page was written, so the precise question types, item count and delivery mode are not confirmed. Check with your local test centre before booking.
How long is the exam and how many questions does it contain?
These figures are not published in the source material available here. ICDL exam durations and item counts vary by module and are set by the test centre or national operator. Confirm the current timing and structure directly with your Accredited Test Centre when you register.
What score do I need to pass?
The pass mark is not stated in the available source. ICDL assessments typically use a criterion-referenced pass threshold, but the exact percentage for this module should be confirmed with your test centre. Do not rely on figures from other ICDL modules, as they can differ.
How much does the exam cost?
Fees are set locally by ICDL Accredited Test Centres and vary by country and currency. The official module page did not provide a fee at the time of writing. Contact a test centre in your region for a current price, including any registration or materials charges.
Can I retake the exam if I fail?
Retake rules are managed by ICDL Accredited Test Centres and national operators, not by a single global policy. Ask your centre about the number of attempts allowed, any waiting period, and whether a retake fee applies. Plan your study so that you are ready on the first attempt.
How long is the certification valid?
The source material does not state a validity period for this module. ICDL certifications are generally not time-limited, but some employers or regulators may ask for evidence of current knowledge. Check with your test centre if validity is important for your role.
In what order should I study the four domains?
Start with Data Protection Concepts to learn the vocabulary - personal data, processing, controller, processor, lawful basis. Then move to Data Protection in Practice, where those concepts become procedures. Study Data Security and Breach Handling next, because breach response depends on practical controls. Finish with Compliance and Individual Rights, which ties together requests, accountability and records.
What are the most common reasons candidates fail?
Typical weak areas are confusing the roles of controller and processor, misapplying lawful bases to real scenarios, and treating breach notification as a single step rather than a process of detection, containment, assessment and reporting. Candidates also lose marks by ignoring individual rights such as access and erasure. Practise applying rules to short workplace cases.
Is this exam suitable for beginners?
It assumes basic digital literacy and some awareness of how organisations handle data, but it does not require prior legal training. The concepts domain builds the foundation. If you are new to the topic, allow extra time for the compliance and breach-handling domains, which are the most scenario-heavy.