Candidate handbook
DPAI candidate handbook
Data Protection & AI Professional
Everything that applies to the DPAI certification exam: what it covers, how the exam works, how it is scored and where to study.
Blueprint version 1, published on November 2, 2026.
What the certification attests
For privacy, legal and compliance teams and DPOs: GDPR and LGPD, data subject rights, accountability, breaches, international transfers and privacy in AI.
You work on a privacy or DPO team
You handle requests, records of processing and DPIAs every day and want to show that you master the method, not just the routine.
You come from law or compliance and are moving into privacy
You know regulation and contracts and need the operational side of the GDPR and the LGPD: rights handling, breaches, transfers and accountability.
You are the product or IT person who answers privacy questions
Nobody else on the team owns privacy, so the questions come to you. You want a solid basis for answering them, including when AI and analytics are involved.
Prerequisite
None. You can take the certification exam directly.
Certification exam format
- Questions
- 50
- Duration
- 120 min
- Pass mark
- 70%
- Languages
- English, Portuguese, Spanish
The pass mark is fixed: you pass with 70% correct answers, with no curve and no comparison with other candidates.
Domains and weights
Questions are drawn for every certification exam, always in this proportion. The weights are the same the exam engine uses.
| Domain | Questions | Weight | Where to study |
|---|---|---|---|
1. Data protection foundations Identifying personal and sensitive data, telling controller from processor, applying the principles and choosing a lawful basis under the GDPR and the LGPD, with a comparative view of CCPA/CPRA. | 10 | 20% | DPAI Syllabus, domain 1, Data protection foundations |
2. Data subject rights and requests Handling access, rectification, erasure, portability and objection requests end to end: verifying identity, applying exceptions, meeting deadlines and answering in language the person understands. | 8 | 16% | DPAI Syllabus, domain 2, Data subject rights and requests |
3. Accountability tools Keeping records of processing, deciding when a DPIA is needed and running it, embedding privacy by design and setting up a DPO function with real independence. | 10 | 20% | DPAI Syllabus, domain 3, Accountability tools |
4. Security and breaches Choosing technical and organizational measures proportionate to risk, assessing whether an incident is a notifiable breach and notifying the authority and data subjects within the required timelines. | 7 | 14% | DPAI Syllabus, domain 4, Security and breaches |
5. International transfers and vendors Selecting a transfer mechanism such as adequacy or standard contractual clauses, running a transfer assessment and writing processor contracts that hold vendors to the same standard. | 5 | 10% | DPAI Syllabus, domain 5, International transfers and vendors |
6. Privacy in AI and analytics Assessing profiling and automated decisions, using personal data to train models and telling anonymization from pseudonymization, including when re-identification risk brings data back into scope. | 7 | 14% | DPAI Syllabus, domain 6, Privacy in AI and analytics |
7. Governance and audit Measuring a privacy program, auditing it, preparing for interaction with the supervisory authority and understanding how sanctions are set. | 3 | 6% | DPAI Syllabus, domain 7, Governance and audit |
Certification exam rules
- Format
- Online certification exam, in your browser, with no scheduling and no exam centre. You can take the exam in English, Portuguese or Spanish. Questions describe work situations and ask for a decision. Every question has four options and exactly one correct answer.
- Time
- The clock runs on the server and starts when you open the certification exam. It does not pause: reloading the page, switching devices or closing the browser does not give time back. When time runs out, the exam is submitted with what you have answered.
- Navigation
- You can go back, change answers and flag questions for review. Before you finish, a screen shows what is answered, flagged and blank.
- Scoring
- Your score is compared with the pass mark, with no curve. A blank question counts as wrong, and there is no partial credit.
- Result
- Immediate, with your score for each domain. It is kept in your account and does not appear on the certificate or the public profile.
- Voucher
- Each voucher is worth one attempt and is used when the certification exam is opened. A voucher bought on the site never expires. Whoever types the code takes the exam, so treat the code like a ticket.
- New attempt
- There is no waiting period and no limit. Each attempt uses a voucher, and questions are drawn again, giving priority to ones you have not seen yet. If you do not pass, you get a 50% coupon for the same certification, valid for 90 days.
- Refund
- Within 14 days of purchase, if the voucher has not been used, through the same payment method.
- Technical problem
- Come back through the same address: the certification exam resumes with the same questions and the answers already saved. If a platform failure compromises your exam, a new attempt is released at no cost.
- Credential
- Issued when you pass, with a public verification code. It never expires: it is valid until revoked. There is no renewal, no continuing education (CPD) requirement and no annual fee.
- Revocation
- A credential can be revoked for fraud, disclosure of questions, false identity, misleading use or administrative error. The code remains searchable and shows the revocation.
- Integrity
- The certification exam is individual and closed book, including artificial intelligence assistants. There is no camera, microphone or screen recording. During the exam, copying, cutting and selecting the text of the questions are disabled, and leaving the exam window is not allowed. Each exit is recorded and flagged on screen; exits shorter than 3 seconds do not count. From the 9th exit, the credential, if you pass, may be reviewed and is issued within 3 business days, not immediately. On the 10th, the exam is ended and scored with the answers given so far. None of this appears on the certificate.
- Accessibility
- The certification exam screen works with keyboard and screen reader. Anyone with a disability or health condition that affects their reading or response time requests 25% extended time in the account, in Certification exams, before using the voucher, with a self-declaration. For another adjustment, write to [email protected].
Where to study
Study by domain, using the weights above and the frameworks listed on the certification page.
Short on time? Study by weight: the domains below are in the order of how much they count in the certification exam.
- Data protection foundations (20%)
- Accountability tools (20%)
- Data subject rights and requests (16%)
- Security and breaches (14%)
- Privacy in AI and analytics (14%)
- International transfers and vendors (10%)
- Governance and audit (6%)