The CDPSE exam domains changed in 2025. ISACA's Certified Data Privacy Solutions Engineer now has four domains instead of three, and one of them, Privacy Engineering, is 39% of the 120-question exam on its own. If you are studying from older notes that list three domains, you are planning for a test that no longer exists.
This entry maps the four current domains and their weights, explains what each one asks, shows how the weights translate into real question counts, and sets out a five-week plan that puts your hours where the points are. Every figure here was read on ISACA's own pages on 5 November 2026.
What are the CDPSE exam domains now?
CDPSE has four job practice domains. Their weights, taken from ISACA's own outline, are:
- Privacy Governance — 20%
- Privacy Risk Management and Compliance — 18%
- Data Life Cycle Management — 23%
- Privacy Engineering — 39%
The four add up to 100%, and the standout number is that last one. Privacy Engineering is nearly twice the size of any other domain and more than double the smallest. A candidate who treats all four equally is giving the biggest part of the exam the same attention as the smallest.
You can see the structure on ISACA's CDPSE exam content outline, which lists the four domains and states that the exam consists of 120 questions.
Why did ISACA change the CDPSE domains?
ISACA restructured the exam to reflect how privacy work is actually done today, moving the weight toward building privacy into systems rather than only governing it on paper. The exam used to have three domains: Privacy Governance, Privacy Architecture, and Data Life Cycle Management.
ISACA's April 2025 announcement set out the change: the old Privacy Architecture domain became the much larger Privacy Engineering domain, a new Privacy Risk Management and Compliance domain was carved out, and governance and the data life cycle stayed. The updated exam became available on 2 June 2025, with new preparation materials from 2 April 2025. If a study guide does not mention Privacy Engineering, it predates this change.
What does each CDPSE domain cover?
Here is what each of the four domains is about, in plain terms.
- Privacy Governance (20%): the policy and management side. Privacy strategy, programs, roles and responsibilities, training and awareness, and how privacy fits alongside governance, risk and the wider business.
- Privacy Risk Management and Compliance (18%): finding, rating and treating privacy risk, and meeting legal and regulatory duties. Privacy impact assessments, risk registers and the link between a risk and the control that answers it.
- Data Life Cycle Management (23%): how personal data moves from collection to deletion. Purpose, minimization, retention and the handling of data at each stage so it is only kept and used as it should be.
- Privacy Engineering (39%): building privacy into systems and products. Privacy by design and by default, technical controls, data protection techniques such as anonymization and encryption, and privacy in the software development life cycle.
Three of the four domains are about doing, not just describing. That is the shift the 2025 update made concrete.
How do the four domains map to 120 questions?
The weights are percentages of the whole exam, so turning them into question counts is simple arithmetic. By my own reckoning, and assuming every question carries the same value, which ISACA does not promise, the 120 questions split roughly like this:
- Privacy Engineering, 39%: about 47 questions.
- Data Life Cycle Management, 23%: about 28 questions.
- Privacy Governance, 20%: about 24 questions.
- Privacy Risk Management and Compliance, 18%: about 22 questions.
Put the top two together and Privacy Engineering plus Data Life Cycle Management make up roughly 62% of the exam, or about 75 of the 120 questions. These are the hands-on, technical areas. The number to keep in front of you is 47: nearly half of everything you can get wrong before you fail sits inside Privacy Engineering.
Which CDPSE domain deserves the most study time?
Privacy Engineering, clearly, both because it is the largest at 39% and because it is where candidates with a legal, audit or policy background are weakest. It asks you to turn a privacy principle into a technical control: to say not just that data should be minimized, but how a design achieves it.
Data Life Cycle Management is the second priority. It is close to Privacy Engineering in spirit, and the two reinforce each other, because a control only makes sense once you know which stage of the data's life it protects.
Privacy Governance and Privacy Risk Management and Compliance together are only 38% of the exam. They are not small, but they are the areas where general privacy and audit experience carries you furthest, so they usually need less fresh study than the engineering half.
What does a CDPSE-style problem look like?
Here is a scenario written in my own words to show the kind of judgment the engineering and life-cycle domains call for. It is not taken from any exam.
A product team wants to add a feature that recommends content based on what a user has read. They plan to keep the full reading history indefinitely so the model can improve over time. They ask you to sign off on the privacy design.
A CDPSE-minded answer would work through the domains in order:
- Data Life Cycle Management: indefinite retention conflicts with keeping data only as long as the purpose needs. Ask what the model actually requires, and set a retention period and a deletion path.
- Privacy Engineering: the model may not need the raw history at all. Aggregated or pseudonymized signals could serve the same purpose, so push the design toward data minimization and privacy by default.
- Privacy Risk Management and Compliance: run a privacy impact assessment, record the residual risk, and check the lawful basis and any notice the user must see.
- Privacy Governance: make sure the decision, and who approved it, is written down and fits the privacy program.
Notice that the strongest answer is rarely "block it" or "allow it." It is the design change that lets the feature ship while collecting and keeping less.
How much does the CDPSE exam cost, and how long is it?
The CDPSE is a 120-question, computer-based exam of 210 minutes, delivered at PSI test centers or by remote proctor, with a passing score of 450 on a scale of 200 to 800. The ISACA CDPSE certification page lists the registration fee as US$575 for ISACA members and US$760 for non-members.
A few details catch people out. The 450 pass mark is a scaled score, not a raw 56%, because ISACA converts your marks onto the 200-to-800 scale, so do not try to count 56% of 120 and stop there. Passing the exam is also not the whole certification: you then pay a US$50 application processing fee and submit an application that demonstrates your privacy and technology experience, and you have five years from passing to do so. Confirm the current figures on your ISACA account on the day you register, since fees and policies change.
With 210 minutes over 120 questions, you have about 1.75 minutes, or 105 seconds, for each one. That is comfortable for recall but tight for the scenario questions that make you weigh a design, so pace is something to practice, not assume.
How should you study for the CDPSE exam in five weeks?
The plan below follows the weights, not the domain order, so your hours land where the questions are. It assumes you already work in privacy, security or IT and can give it ten to twelve hours a week.
- Week 1, Privacy Engineering, part one: privacy by design and by default, and the core data protection techniques: anonymization, pseudonymization, encryption and access control. This is the largest domain, so it gets the most time.
- Week 2, Privacy Engineering, part two, plus the data life cycle: privacy in the development life cycle, then collection, minimization, purpose, retention and deletion. Draw a single diagram of data moving through one system and label the control at each stage.
- Week 3, Data Life Cycle Management and the handover to risk: finish the life cycle, then start privacy impact assessments and how a risk connects to a treatment.
- Week 4, Risk and Compliance, then Governance: privacy risk management, legal and regulatory duties, then privacy strategy, programs, roles and awareness. These lean on experience, so review rather than learn from scratch.
- Week 5, practice and repair: take a full timed practice test, read the report by domain, and spend the rest of the week on your two weakest domains. Expect Privacy Engineering to still need attention, because it is the biggest and the least forgiving.
Study the technical half with a notebook, not just a highlighter. Writing out how a control satisfies a principle is the exact move the scenario questions ask for.
What mistakes make the CDPSE exam harder than it is?
- Studying from a three-domain guide. The single biggest trap in 2026 is old material. If Privacy Engineering is missing, so is 39% of the exam.
- Treating the domains as equal. Four domains does not mean four equal piles of study. Privacy Engineering plus Data Life Cycle Management is about 62% of the questions.
- Reading 450 as a percentage. It is a scaled score on a 200-to-800 range, so judge your readiness by practice-test domain reports, not by a raw count.
- Memorizing laws instead of applying them. Compliance questions usually ask what to do in a situation, not to recite an article number.
- Forgetting the experience step. Passing is only part of it; the US$50 application and the experience evidence still stand between you and the credential.
If you have sat a reasoning-heavy security exam before, the style will feel familiar. My earlier entry on how the reasoning-heavy GCTI exam is built describes the same move from recall to judgment on a very different subject.
Is there a video on ISACA privacy and risk certifications?
EduSum's YouTube channel has no CDPSE video yet. This guide covers CRISC, ISACA's risk certification, which overlaps the Privacy Risk Management and Compliance domain and shows how ISACA frames risk work, so it is the closest topic the channel offers.
Frequently asked questions
1. How many domains does the CDPSE exam have now?
Four. Since the 2 June 2025 update, CDPSE covers Privacy Governance (20%), Privacy Risk Management and Compliance (18%), Data Life Cycle Management (23%) and Privacy Engineering (39%), replacing the earlier three-domain structure.
2. Which CDPSE domain is the largest?
Privacy Engineering, at 39% of the exam. That is roughly 47 of the 120 questions and more than double the smallest domain, so it deserves the most study time.
3. How many questions are on the CDPSE exam and how long is it?
The CDPSE exam has 120 questions and lasts 210 minutes. That works out to about 1.75 minutes per question.
4. What is the CDPSE passing score?
450 on a scale of 200 to 800. It is a scaled score, not a raw percentage, so ISACA converts your marks before comparing them to the 450 mark. Confirm your result in your ISACA account.
5. How much does the CDPSE exam cost?
ISACA lists US$575 for members and US$760 for non-members to register. Earning the certification also needs a US$50 application processing fee and evidence of relevant experience, which you can submit within five years of passing.