ICS CDPP
ICS Certified Data Protection Professional
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ICS Certified Data Protection Professional (CDPP) is a professional credential for practitioners who handle privacy and data protection compliance in an operational or advisory role: privacy officers, compliance and risk staff, legal and IT professionals moving into privacy work, and consultants supporting client compliance programmes. The syllabus is organised around seven domains: data protection law and regulatory frameworks; principles and lawful bases for processing; data subject rights and consent management; privacy governance, accountability and programme management; impact assessments and risk management; breach management and incident response; and international transfers. The exam is multiple choice and tests applied judgement as much as recall, so expect scenario-style items that ask you to pick the most appropriate course of action rather than simply define a term. Preparation works best as a staged build: secure the legal foundations and the principles first, since rights, assessments and transfers all depend on them, then work through governance and breach response, which carry the most procedural detail. Use the domains' published weightings to allocate study time rather than treating every topic equally. The certifying body publishes current details on scheduling, duration, fees, scoring and retake rules on its own website; candidates should confirm those directly with ICS before booking, as this page does not restate them.
What you'll study
About ICS CDPP preparation
What is the CDPP actually testing: law or practice?
Both, weighted toward practice. You need solid command of core concepts and terminology, but many items are scenario-based and ask what a competent professional should do next. Memorising definitions alone will not carry you through; practise applying concepts to short fact patterns.
How long is the exam and how many questions are there?
The certifying body publishes the current question count, time allowance and scoring rules, and these can change between exam versions. Check the ICS website or your candidate handbook for the figures that apply to your booking rather than relying on secondhand reports.
How hard is it, and what is a realistic study timeline?
Candidates with existing compliance or legal backgrounds typically need a few weeks of focused study; career changers should allow longer. Difficulty comes less from obscure facts than from scenario items with two plausible answers, so timed practice questions are the best gauge of readiness.
What should I study first?
Start with law and regulatory frameworks, then principles and lawful bases. Rights, consent, impact assessments and transfers all build on those foundations, so studying them out of order means re-learning. Leave governance and breach response until the core concepts are secure.
Can I pass by focusing on the highest-weighted domains?
No. Law and principles together carry substantial weight, but the smaller domains still contribute and are often where candidates lose easy marks. Use the weightings to prioritise time, not to skip topics entirely, and make sure you can answer baseline questions in every domain.
What are the most common ways candidates fail?
Rushing scenario questions and picking the first plausible option; confusing similar concepts such as different lawful bases or the distinction between a controller and a processor; and neglecting breach notification timing and transfer mechanisms, which are detail-heavy and frequently examined.
What happens if I fail? Can I retake it?
Retake eligibility, waiting periods and any associated fees are set by the certifying body and are not fixed here. Confirm the current retake policy with ICS before you book, and build a gap analysis from your score report into your next attempt.
Do I need to memorise specific statutes and article numbers?
You should know the structure and key obligations of major frameworks well enough to reason about them, but the exam rewards understanding over citation. Focus on what a provision requires and when it applies; precise numbering is less useful than knowing which rule governs a given scenario.
How should I use practice questions?
Treat them as diagnostics, not a question bank to memorise. After each set, write down why the wrong options were wrong. If you cannot articulate the reasoning, you have found a gap, and that topic deserves a return to the source material.