Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A 2026 reference to PECB's GDPR data protection officer certification: the three weighted exam domains, the 80-question open-book exam, the two credential levels and their experience rules, fees and maintenance, how the scheme maps to GDPR Articles 37 to 39, and how the CDPO compares to the IAPP's CIPP/E and CIPM and ISACA's CDPSE. Written for anyone weighing the CDPO or trying to pin down what it certifies.
The PECB CDPO is a personnel certification for the data protection officer role the GDPR creates: the person who informs and advises, monitors compliance, and works with the supervisory authority.
The exam leans on situations rather than recall. PECB's sample scenario describes a French software company whose survey app was breached, exposing respondents' names. The questions ask why the GDPR applies, which data subject right the company serves by telling users why it collects their data, what it should do to prevent a repeat, and whether the people affected must be told. The three domains run from GDPR concepts and principles, through the roles of controllers, processors and the DPO, to the technical and organizational measures that protect personal data.
The exam is open book, with a hard copy of the GDPR on the desk, and the full credential asks for five years of professional experience, two of them in data protection. The CDPO sits in the ISO/IEC 17024 scope of PECB's IAS accreditation. It is issued and maintained by PECB, the Professional Evaluation and Certification Board, the same body behind the ISO/IEC 27001 and ISO/IEC 27701 credentials.
When a DPO is mandatory, what qualifies one, and the DPO contract. Tested in Domain 1.
Independence, resources, and reporting to the highest management level. Domains 1 and 2.
Telling the controller, processor and staff what the GDPR requires of them, through communication plans and advice. Domain 3.
Program monitoring, staff training and awareness, internal audits, and nonconformities. Domain 3.
When a DPIA is required, how to run one, and the DPO's advice. Domain 2.
Cooperation, the contact point role, and breach notification. Domain 2.
Four things that set the credential apart for people who hold the DPO title, or are about to.
The GDPR sets out the DPO role in three articles: Article 37 on designation, Article 38 on position and Article 39 on tasks. PECB's course and exam follow that outline. You are tested on informing and advising, monitoring compliance, advising on data protection impact assessments and cooperating with the supervisory authority, the duties the regulation itself assigns, rather than on privacy law as a subject.
The English exam is 80 multiple-choice questions in three hours, and you may bring a hard copy of the GDPR, the course materials and your own notes. Memorizing article numbers buys you little when the text is on the desk, so the points go to candidates who can read a scenario and find the right provision quickly.
The CIPM and CIPP/E have no experience requirement. PECB's full DPO credential asks for five years of professional experience, two in data protection, plus 300 hours of data protection activities and two professional references. Newer candidates start as Provisional DPO and upgrade later. Our PECB certification article explains how PECB checks references and logged hours.
No article of the GDPR requires a DPO to be certified. Article 37(5) asks for professional qualities and expert knowledge of data protection law and practices, and the CDPO is one documented way to show both. PECB does not claim a DoD 8140 listing for the CDPO, so it won't satisfy a cyber-coded position requirement. If you need one, check the current Approved Qualifications Matrix at cyber.mil.
Its weight comes from the accreditation behind it. The International Accreditation Service lists PECB Certified Data Protection Officer in the ISO/IEC 17024:2012 scope of PECB's accreditation, the international standard for bodies that certify people, and because the full credential checks experience, the certificate also speaks to the work you have done.
The certification, the exam structure, and what it takes to keep the CDPO active, as of October 2026.
The CDPO covers the DPO's job under the GDPR. What comes next depends on whether you need the full credential, more depth in the law or the program, or the management system the program runs on.
Start as a Provisional DPO and upgrade once your experience catches up: five years in total, two in data protection, and 300 hours of activities such as advising on DPIAs or monitoring a GDPR compliance program. Upgrades run through your PECB dashboard for a $100 application fee, and PECB decides in each case whether another exam is needed.
The IAPP's CIPP/E goes deeper on European data protection law, from the institutions behind it to employment, surveillance and marketing rules. The CIPM covers running the privacy program itself. Both are 90-question, 2.5-hour exams with no prerequisites, and either one fills in a different side of a DPO's profile. Our CIPM guide has the details.
PECB's DPO course links the GDPR to ISO/IEC 27701 and ISO/IEC 27001. If your organization runs a privacy information management system, or is building one, PECB's ISO/IEC 27701 Lead Implementer and Lead Auditor credentials cover the framework side of the program a DPO monitors.
Anyone who passes can hold the Provisional DPO credential, so the CDPO can be a first certification. Most candidates come from legal, compliance, audit or security work, take the CDPO when they are named DPO or about to be, and upgrade to the full credential once the experience is logged.
Common starting points, none required
The DPO role under the GDPR
Two things to settle before you commit: can you certify, and at which level, and should you pursue the CDPO specifically. Here's a straight answer to both.
No experience requirement.
Pass the exam, sign the PECB Code of Ethics and apply. PECB sets no professional experience or project hours for the Provisional DPO credential, and Provisional credentials carry no CPD or maintenance fee requirement. You don't have to take a course to sit the exam, though PECB partner courses bundle the first attempt, one free retake, the application fee and the first year of maintenance fees.
Experience checked by PECB.
The full PECB Certified Data Protection Officer needs five years of professional experience, two of them in data protection, and 300 hours of data protection activities. You list job titles, dates and duties, PECB checks your project log, and two professional references vouch for your work (not relatives, and not people you supervise). If you fail the exam, the first retake can't come sooner than 15 days after the original exam date.
The CDPO maps to the roles that carry GDPR accountability inside an organization or for its clients, starting with the DPO position Article 37 makes mandatory for public authorities and for certain kinds of large-scale processing.
The DPO an organization designates under Article 37. Informs and advises the controller and staff, monitors compliance, advises on DPIAs, and acts as the contact point for the supervisory authority and for data subjects, reporting directly to the highest management level.
Fills the DPO role for several client organizations under a service contract, which Article 37(6) allows, and keeps each client's records of processing, DPIAs and breach procedures in order.
Turns GDPR requirements into the policies, data inventories, records of processing and training that business teams follow, and tracks whether the program is meeting its objectives.
Owns data protection inside a broader regulatory function, running gap analyses and internal audits against the GDPR and following each nonconformity through to corrective action.
Handles the daily work of a GDPR program: answering data subject requests, drafting privacy notices, mapping data flows, and preparing the first draft of a DPIA for the DPO to review.
Leads the technical and organizational measures that protect personal data, from access control and logging to pseudonymization, and runs the incident process that decides whether a breach has to be notified.
Shortest version: the CDPO is for the person who holds the DPO role, CIPP/E is for the people who interpret European data protection law, CIPM is for the people who run the privacy program, and CDPSE is for the engineers who build privacy into systems.
| PECB CDPO | CIPP/E | CIPM | CDPSE | |
|---|---|---|---|---|
| Issuer | PECB | IAPP | IAPP | ISACA |
| Focus | The DPO role under the GDPR | European data protection law | Privacy program management | Privacy engineering |
| Experience to Certify | None for Provisional DPO. 5 years (2 in data protection) and 300 hours for DPO | None | None | 3 years of experience, verified after the exam |
| Exam Format | 80 items, 3 hours, open book | 90 items (75 scored), 2.5 hours | 90 items (75 scored), 2.5 hours | 120 items, 3.5 hours |
| Passing Score | 70% | 300 (scaled 100 to 500) | 300 (scaled 100 to 500) | 450 (scaled 200 to 800) |
| Exam Cost | Included in PECB partner course fees | $550 | $550 | $575 member / $760 non-member |
| Renewal | 90 CPD hours and $390 per 3-year cycle | 20 CPE hours per 2-year term, $250 maintenance | 20 CPE hours per 2-year term, $250 maintenance | 20 CPE hours per year, 120 per 3-year cycle |
| Current Blueprint | Candidate Handbook v1.5 (2026) | BoK v1.3.3, effective September 1, 2025 | BoK v4.2.0, effective September 1, 2025 | 4-domain job practice |
| Best For | Designated DPOs, outsourced DPOs, future DPOs | EU privacy counsel, compliance leads, DPOs | Program managers, privacy officers | Security engineers, architects, developers |
CDPO facts are from PECB's Candidate Handbook v1.5, the List of PECB Exams and PECB's 2026 maintenance policy. CIPM and CDPSE facts are from our CIPM guide and CDPSE guide, and CIPP/E facts are from the IAPP. Training Camp runs a PECB DPO boot camp. Fees and requirements change, so check each body's current rules before you register.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB authorized DPO boot camp runs four days, live online or in person, and works through the DPO role from designation to DPIAs, breach notification and supervisory authorities. Official PECB courseware, the certification exam, the certification application fee, one free retake and 35 CPD credits are included. If you are planning more than one PECB credential, browse the full PECB course lineup.
Data privacy basics, how PECB credentials work, GRC career strategy, and how a DPO credential sits next to the other privacy certifications.
The ground the DPO role stands on: what data privacy means in practice, why the GDPR can reach a company far outside Europe, and the GDPR's top fine of 20 million euros or 4 percent of global annual turnover.
How PECB exams, credential tiers, logged hours and professional references work across its schemes, and where its CNIL approval to certify data protection officers fits.
Where privacy credentials sit beside the audit, risk and security management certifications GRC teams hire for, with the GDPR one of the reasons privacy became a core GRC job.
Why European privacy work tends to favor GDPR-focused credentials, and how that transatlantic split shows up when a hiring manager reads your resume.
ISACA's privacy engineering credential, built for the people who put privacy into systems rather than the DPO who monitors them, and a plain read on who benefits.
Two other PECB credentials side by side, useful if your DPO work keeps running into the information security management system underneath it.
For organizations using AI, the EU AI Act now sits next to the GDPR. How the IAPP's AI governance exam maps to it, and why privacy people who already work across regimes have a head start.
PECB's Candidate Handbook v1.5 divides the 80-question exam into three competency domains and publishes the share of the exam each one carries, shown in the badges below. Domain 1 is half the exam on its own, so time spent on GDPR concepts, principles and data subject rights pays back the most. Click any domain for what it covers.
The largest domain, at 40 of the 80 questions. GDPR concepts and terminology, the regulation's objectives for protecting natural persons, material and territorial scope, and the roles of the European Data Protection Board, the supervisory authorities and other EU bodies. It covers the data protection principles, lawful bases including legitimate interest, special categories of data, data subject rights and the information owed to data subjects. It also takes in DPO designation, qualifications and the DPO employment contract, why DPO independence matters, gap analysis, records of processing, transfers outside the EU/EEA, and how the UK GDPR differs from the EU GDPR. These questions measure comprehension, application and analysis.
Who does what, in 25 questions. The obligations of controllers, processors and joint controllers, the part top management plays, and the DPO's position and responsibilities in the compliance program. Data protection impact assessments get close attention: when one is required, how the process repeats, methodologies including those of the CNIL and the ICO, and the advice the DPO gives. Risk management, records of processing and documented information follow. The domain closes on incident management and personal data breaches, meaning which breaches go to the supervisory authority and to data subjects, the notification periods, and the resolution report. These questions measure evaluation.
The measures that protect personal data, and the checks that show they work, in 15 questions. Data protection by design and by default, anonymization versus pseudonymization, security measures such as access control, logging and monitoring, and protecting data on mobile and portable devices. It also covers training, awareness and communication plans, measuring whether the compliance program meets its objectives, internal and external data protection audits, major and minor nonconformities, root cause analysis and corrective action, and continual improvement. These questions measure evaluation.
Domains, question counts and weights reflect the PECB Certified Data Protection Officer Candidate Handbook, version 1.5 (2026), for the 80-question multiple-choice exam: 40, 25 and 15 questions. The passing score is 70 percent. The French and Spanish exams are still listed as essay exams, so check the List of PECB Exams for your language before you book.
The questions candidates ask most often when researching the PECB Certified Data Protection Officer certification.
The PECB Certified Data Protection Officer (CDPO) is a personnel certification for people who act, or will act, as the data protection officer an organization designates under the EU General Data Protection Regulation (GDPR). PECB builds the scheme around the DPO's job: informing and advising the controller or processor, monitoring GDPR compliance, advising on data protection impact assessments, and cooperating with the supervisory authority. Pass the exam and you can apply for one of two credentials, Provisional DPO or DPO, depending on your experience.
People who hold the DPO title or are about to: designated DPOs, deputy DPOs, outsourced DPOs who serve clients under a service contract, privacy and compliance managers running a GDPR program, and the information security, incident management and business continuity staff who share those duties. PECB asks course participants to arrive with a fundamental understanding of the GDPR and a thorough grasp of data protection requirements.
PECB's Candidate Handbook (version 1.5, 2026) splits the 80 questions three ways. Domain 1, data protection concepts, the GDPR and compliance measures, has 40 questions (50 percent). Domain 2, roles and responsibilities of accountable parties for GDPR compliance, has 25 (31.25 percent), and Domain 3, technical and organizational measures for data protection, has 15 (18.75 percent). The first domain's questions test comprehension, application and analysis, while the other two test evaluation.
In English it is an 80-question multiple-choice exam with three hours on the clock. Each question has three options and one correct answer, and the exam mixes stand-alone questions with scenarios that each carry five questions. It is open book: you can bring a hard copy of the GDPR, the training course materials and your own course notes. The passing score is 70 percent. You can sit it online through the PECB Exams application with a remote invigilator, or on paper through the partner that ran your course, and online results arrive as soon as you submit.
There are two. The PECB Certified Provisional Data Protection Officer needs a passed exam and a signed PECB Code of Ethics, with no experience requirement. The full PECB Certified Data Protection Officer needs five years of professional experience, two of them in data protection, plus 300 hours of data protection activities such as helping apply GDPR requirements, monitoring a GDPR compliance program, advising on data protection impact assessments and monitoring a data protection project. Every application also needs two professional references. A Provisional DPO can upgrade later for a $100 application fee.
As of October 2026, PECB's certification application fee is $500, and keeping the full DPO credential active costs $390 in Annual Maintenance Fees per three-year cycle. When you train through a PECB partner, PECB says the course fee covers the first exam attempt, one free retake, the application fee and the first year of maintenance fees, as long as you complete the cycle within 12 months of the course. Training Camp's 4-day PECB DPO boot camp includes the exam, the application fee and a free retake.
PECB certifications are valid for three years. To renew the DPO credential you report continuing professional development (90 CPD hours over the cycle under PECB's 2026 maintenance policy), pay the Annual Maintenance Fees and follow the PECB Code of Ethics. Miss the CPD or the fees and the certification is suspended for up to 12 months while you catch up, and PECB can revoke it if you don't. The Provisional DPO credential has no maintenance requirement.
Yes. PECB specifies the CDPO scheme in compliance with ISO/IEC 17024, the international standard for bodies that certify people, and the International Accreditation Service (IAS) certificate PECB links from its accreditations page lists PECB Certified Data Protection Officer in its ISO/IEC 17024:2012 scope (certificate PCB-111, effective October 30, 2025, valid to January 1, 2027). PECB also holds UKAS accreditation, but the CDPO is not on that schedule.
No. Articles 37 to 39 don't name any certification. Article 37(5) says the DPO is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfill the Article 39 tasks. A credential like the CDPO is one way to show that knowledge. It doesn't make anyone a DPO. Only the controller or processor can do that, by designating them.
Closely. Article 37 covers when a DPO is mandatory and what qualifies one, and Domain 1 tests the designation requirements, the DPO's qualifications and the DPO employment contract. Article 38 sets the DPO's position, including independence and reporting to the highest management level, and Domain 1 tests why DPO independence matters. Article 39 lists the tasks: informing and advising (Domain 3's communication plans and improvement advice), monitoring compliance, which includes staff training and the related audits (Domain 3's training, monitoring, internal audit and nonconformity work), advising on DPIAs (Domain 2), and working with the supervisory authority (Domain 2, including breach notification).
They test different things. The IAPP's CIPP/E tests knowledge of European data protection law across five domains, with a 90-question, 2.5-hour exam, $550 to sit and no prerequisites. The CDPO tests whether you can do the DPO's job under the GDPR, with an open-book exam built on scenarios, and the full credential asks for five years of experience. If you'll mainly interpret the law, start with the CIPP/E. If you have been named DPO, or soon will be, the CDPO matches the role. The two cover overlapping GDPR ground, so they pair well.
No. PECB is also approved by the French data protection authority, the CNIL, to certify DPO skills and knowledge under the CNIL's own scheme (CNIL deliberations 2018-317 and 2018-318). That is a separate certification with different renewal rules: a new written test and at least one year of DPO-related experience in the last three years, certified by an employer or client. The CDPO on this page follows PECB's own scheme and renews through CPD and maintenance fees.
The format did. PECB is moving its essay exams to open-book multiple choice, and the English CDPO exam is now 80 multiple-choice questions under Candidate Handbook version 1.5 (2026). PECB's List of Exams still shows the French and Spanish versions as 12-question essay exams, both three hours and open book. The GDPR itself, the text the exam is built on, has applied since May 25, 2018.
For people who carry the DPO title, or are being lined up for it, yes. The exam follows the tasks Article 39 assigns, the open-book format rewards knowing where things sit in the regulation over memorizing it, and the full credential requires documented data protection experience, which tells an employer more than a pass alone. It's a weaker fit if your work is US privacy law, privacy engineering or broad legal interpretation, where the CIPP/US, CDPSE or CIPP/E sit closer to the job.
If you're weighing the certification, comparing it with IAPP credentials, or planning GDPR training for a team, tell us where you are and we'll help you map out the right path.