PECB CDPO study guide
PECB CDPO · Work through your exam, one topic at a time.
The PECB Certified Data Protection Officer (CDPO) is a professional credential offered in the privacy and data protection space. This page is an independent study resource built for candidates preparing for the CDPO exam; it is not affiliated with, endorsed by, or operated by PECB, and it does not reproduce any official question bank. The material here is organised around four domains that reflect the work a data protection officer actually performs: data protection fundamentals and legal frameworks; roles, responsibilities, and accountability; risk management and impact assessments; and programme implementation, monitoring, and improvement. Each domain carries equal weight in the study plan, so candidates should budget time evenly rather than over-investing in GDPR article memorisation at the expense of accountability and risk topics. The PECB CDPO study guide has 4 sections and about 1,237 words.
01Data Protection Fundamentals and Legal Frameworks
This domain tests whether you can identify personal data and processing, select a lawful basis, apply the GDPR principles and scope rules, and choose the right transfer mechanism. Expect scenario questions that mix EU law with international instruments.
311 words, about 2 min02Data Protection Roles, Responsibilities and Accountability
This domain tests who decides, who executes, who advises, and who can prove compliance. Questions often hinge on controller and processor boundaries, DPO independence, and the evidence expected under the accountability principle.
315 words, about 2 min03Data Protection Risk Management and Impact Assessments
This domain tests whether you can scope a DPIA, assess risks to data subjects' rights and freedoms, and decide when prior consultation is required. It also tests the difference between privacy risk, security risk, and transfer risk.
312 words, about 2 min04Data Protection Program Implementation, Monitoring and Improvement
This domain tests how a data protection program is operationalized and improved: governance, records, training, incident response, monitoring, and corrective action. Expect questions on evidence, metrics, and the plan-do-check-act cycle.
299 words, about 1 min