GDPR Foundation exam-day guide
GDPR Foundation · Prepare for the day ahead.
Your checklist
Valid photo ID
Bring the original government-issued photo ID in the exact name used for your registration. If your ID name differs from your booking (e.g., a middle name or a married name), confirm with the provider in advance whether additional documentation is accepted.
Appointment confirmation and candidate number
Have your booking confirmation, candidate/registration number, and any test-centre instructions saved offline (screenshot or printout) so you can access them without a network connection.
Know the delivery format
Confirm with the provider whether your sitting is at a test centre, an online-proctored session, or a paper test, because the ID checks, permitted items, and room rules differ by format.
Online-proctored system check
If you sit remotely, run the provider's system/equipment test on the same computer, webcam, and network you will use on the day, and check the minimum bandwidth and browser requirements. Confirm with the provider which browsers and operating systems are supported.
Permitted materials
Confirm with the provider whether any materials are allowed. Many foundation-level exams are closed-book with no notes or reference material; do not assume a data-protection exam permits a legal text or printed GDPR.
Scratch paper and pen policy
Confirm with the provider whether blank paper, a pen, or an on-screen notepad is provided or permitted. If paper is allowed, expect to show it blank to the invigilator or proctor before and after the test.
Personal items storage
Plan for phones, smart watches, bags, and notes to be stored away or out of the room. For remote sittings, expect to clear your desk and show the room on camera if asked.
Timing and travel plan
Arrive with buffer time before your slot; test centres commonly require check-in before the start, and late arrivals may be refused entry. Confirm the provider's arrival window and late-arrival policy.
Access arrangements
If you need extra time, a separate room, or other adjustments, confirm with the provider that these are approved and recorded on your booking before the exam day; they are usually not granted on the day.
Scoring and results expectations
Confirm with the provider the number of questions, time limit, pass mark, and when results are issued, so you are not surprised by the format or the wait for your score.
Review the exam syllabus
Check the provider's published syllabus or exam objectives and confirm the scope (for example, GDPR principles, lawful bases, data subject rights, controller/processor roles, DPO, breach notification, transfers). Do not rely on memory of the scope alone.
Rest and logistics
Plan sleep, food, water, and, for a test centre, parking or transit. Confirm with the provider whether water or snacks are allowed in the testing room, as rules vary.
Plan the day
Stop expanding your sources and work only from the official syllabus and your own summary notes. Do a timed practice run under exam conditions to check your pacing, then review weak areas: definitions of controller, processor, joint controllers; the six lawful bases; the principles in Article 5; data subject rights and their time limits; the DPO's tasks and independence; personal data breach notification timelines; and the conditions for international transfers. Write short explanations in your own words rather than re-reading, because the exam tests applied understanding, not recitation. Confirm your booking details, ID name, and any access arrangements now, so problems can be fixed before the day.
Do a light review of your summary sheet only; avoid cramming new material. Prepare your ID, confirmation, and any permitted items in one place. For a remote sitting, retest your equipment and internet, charge devices, and check the proctor's check-in time. For a test centre, confirm the address, travel time, and arrival window. Set two alarms, get a full night's sleep, and avoid last-minute study that increases anxiety. Re-read the provider's candidate rules once so nothing on the day is a surprise.
Eat a normal meal and hydrate, but follow the provider's rules on drinks in the testing room. Leave early with buffer time. Do not attempt to learn new topics; a brief skim of your summary sheet is enough. At the venue or before logging in, switch your phone off and store it as instructed. Arrive at check-in with your ID ready and your name matching the booking. Take a few slow breaths and read the instructions screen carefully before starting.
Read each question fully and watch for qualifiers such as 'not', 'best', 'first', and 'most likely'. Answer the easier questions first if the platform allows navigation, then return to harder ones. For scenario questions, identify the role (controller, processor, DPO, supervisory authority) and the legal basis before choosing an option. Eliminate clearly wrong answers and choose the best remaining one; do not leave blanks if there is no penalty for guessing, but confirm with the provider whether negative marking applies. Keep an eye on the clock and reserve time to review flagged questions. If a technical problem occurs during a remote sitting, stop and contact the proctor immediately rather than troubleshooting alone.
Rules to check
Bring the original photo ID in the name used for your registration; copies, expired documents, or a mismatched name may result in refusal of entry. If your documents differ from your booking, confirm with the provider beforehand what is accepted.
Follow the provider's rules on personal items: phones, smart watches, and notes are normally stored away or excluded from the testing room. For remote sittings, follow proctor instructions on desk clearance and room scans.
Closed-book is the safe assumption for a foundation exam. Do not bring notes, legal texts, or unauthorised aids unless the provider has confirmed in writing that they are permitted.
Breaks are usually not allowed during a timed sitting, or only with proctor approval that may pause or not pause the clock. Confirm with the provider whether scheduled or unscheduled breaks are available and how they affect your time.
Do not communicate with other candidates, share questions, or attempt to record the exam. Suspected misconduct can lead to invalidation of your result and further action under the provider's rules.
Understand the scoring before you sit: confirm with the provider the number of questions, time allowed, pass mark, and whether wrong answers are penalised. If there is no penalty, answer every question.
If equipment fails or you experience a disruption during a remote exam, notify the proctor immediately and follow their instructions; do not attempt to restart the session on your own unless told to do so.
Results and any retake policy are set by the provider. Confirm with the provider how and when results are issued and what the retake rules and fees are, rather than assuming a fixed timeline.