IICTI Certified Data Protection and Privacy Professional

Holders demonstrate that they can apply and evaluate lawful basis, purpose limitation and legitimate interest analysis, dPIA and privacy risk engineering, privacy by design and privacy-enhancing technologies and international data transfers and transfer impact assessment, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Data Protection and Privacy Professional.

Who it is for: Professionals working, or preparing to work, in audit, risk & governance roles.

1. 01Lawful basis, purpose limitation and legitimate interest analysis11% of the exam

   • Evaluate complex processing operations to determine and document the appropriate lawful basis and purpose compatibility.
   • Scope: GDPR Articles 5, 6, 9 and 10, EDPB Guidelines 1/2024 on legitimate interest and the three-part LIA test, consent validity, compatibility assessment, special category conditions, Albanian Law No. 124/2024 on personal data protection.
2. 02DPIA and privacy risk engineering6% of the exam

   • Lead data protection impact assessments that identify privacy threats and justify mitigations and residual risk acceptance.
   • Scope: GDPR Article 35 and WP248 criteria, ISO/IEC 29134, LINDDUN privacy threat modelling, likelihood and severity scoring, residual risk, Article 36 prior consultation.
3. 03Privacy by design and privacy-enhancing technologies17% of the exam

   • Design systems that embed data minimisation and privacy-enhancing technologies, evaluating their effectiveness against re-identification risk.
   • Scope: GDPR Article 25, ISO 31700, EDPB Guidelines 01/2025 on pseudonymisation, anonymisation and re-identification risk, k-anonymity, differential privacy, secure multi-party computation, synthetic data.
4. 04International data transfers and transfer impact assessment7% of the exam

   • Evaluate international transfer scenarios and design transfer mechanisms and supplementary measures that withstand regulatory scrutiny.
   • Scope: GDPR Chapter V, 2021 Standard Contractual Clauses, EU-US Data Privacy Framework, BCRs, Article 49 derogations, EDPB Recommendations 01/2020 supplementary measures, Article 48 foreign authority requests.
5. 05Privacy information management and accountability14% of the exam

   • Design and lead an accountable privacy management system with measurable controls and demonstrable compliance.
   • Scope: ISO/IEC 27701:2025, NIST Privacy Framework 1.1, records of processing, privacy metrics and KPIs, DPO independence and tasks, policy hierarchy, internal audit of privacy controls.
6. 06Data subject rights operations at scale12% of the exam

   • Architect scalable, auditable processes and tooling for fulfilling data subject rights across complex data estates.
   • Scope: Access, rectification, erasure, restriction, portability and objection, EDPB Guidelines 01/2022 on the right of access, identity verification, erasure across backups and derived data, Article 22 automated decisions.
7. 07Personal data breach management and notification10% of the exam

   • Lead breach response decisions on risk, notification and communication under overlapping regulatory regimes.
   • Scope: GDPR Articles 33 and 34, EDPB Guidelines 9/2022, breach risk assessment, 72-hour notification, interplay with NIS2 and DORA incident reporting, forensic coordination and breach registers.
8. 08Processor, joint-controller and vendor governance7% of the exam

   • Evaluate role allocation and design contractual and oversight controls across processors, joint controllers and sub-processors.
   • Scope: GDPR Articles 26 and 28, EDPB Guidelines 07/2020 on controller and processor concepts, data processing agreements, sub-processor chains, audit rights, cloud and SaaS due diligence.
9. 09AI, profiling and algorithmic decision-making4% of the exam

   • Evaluate AI and profiling systems for data protection compliance and design governance for lawful, fair and transparent use.
   • Scope: EU AI Act interplay with GDPR, fundamental rights impact assessment, EDPB Opinion 28/2024 on AI models, training data lawfulness, profiling, ISO/IEC 42001, explainability and bias.
10. 10EPrivacy, adtech and online tracking compliance5% of the exam

    • Diagnose online tracking and advertising practices and design compliant consent and transparency mechanisms.
    • Scope: ePrivacy Directive Article 5(3), cookie and tracking technology consent, IAB TCF v2.2, consent management platforms, dark patterns, children's data and age assurance, DSA advertising rules.
11. 11Data economy regulation and data sharing3% of the exam

    • Evaluate data sharing and reuse initiatives against the EU data economy framework and GDPR obligations.
    • Scope: EU Data Act, Data Governance Act, European Health Data Space, data intermediaries, interplay with GDPR, data sharing agreements, data spaces and secondary use.
12. 12Regulatory enforcement, investigations and liability4% of the exam

    • Lead organisational responses to regulatory investigations and evaluate enforcement and litigation exposure.
    • Scope: Supervisory authority powers, one-stop-shop and the GDPR procedural regulation, EDPB Guidelines 04/2022 on fine calculation, Article 82 damages and CJEU case law, collective redress.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner