CDPSE study guide
CDPSE · Work through your exam, one topic at a time.
The Certified Data Privacy Solutions Engineer (CDPSE) is an ISACA credential that validates expertise in implementing privacy-by-design principles into existing and future systems, networks and applications. It is aimed at technical professionals - security practitioners, engineers, architects and privacy or compliance staff - who work cross-functionally to engineer privacy solutions that are ethical and human centered. ISACA frames the value in three ways: privacy-by-design capabilities for compliance and efficiency, competency in multi-departmental communications to mitigate risk, and empowering security professionals to see how their work supports privacy initiatives. The exam consists of 120 questions across four job practice domains: Privacy Governance (20%), Privacy Risk Management and Compliance (18%), Data Life Cycle Management (23%) and Privacy Engineering (39%). The CDPSE study guide has 4 sections and about 1,237 words.
01Privacy Governance
CDPSE Domain 1, Privacy Governance, tests whether you can describe how a privacy program is directed, resourced, and held accountable. Expect questions on roles, policy architecture, oversight bodies, third-party governance, training, and metrics-not just reciting laws.
328 words, about 2 min02Privacy Risk Management and Compliance
CDPSE Domain 2, Privacy Risk Management and Compliance, tests your ability to identify privacy risk, assess it in terms of harm to individuals, treat it, and prove compliance. Use a repeatable risk process: establish context, inventory processing, identify threats such as excessive collection, secondary use, unauthorized access, and over-retention, analyze likelihood and impact, evaluate against criteria, treat through mitigation, transfer, avoidance, or acceptance, and monitor.
320 words, about 2 min03Data Life Cycle Management
CDPSE Domain 3, Data Life Cycle Management, tests how personal data is controlled from collection through disposal. Questions often ask which control belongs at which stage and what evidence proves it operates.
298 words, about 1 min04Privacy Engineering
CDPSE Domain 4, Privacy Engineering, tests the technical controls and design choices that make privacy requirements real in systems. Translate privacy requirements into architecture: data minimization in schemas, purpose binding, secure defaults, role- and attribute-based access control, encryption in transit and at rest, and key management.
291 words, about 1 min