Skip to content
DPCert.org
DPAI

Data Protection & AI Professional

For privacy, legal and compliance teams and DPOs: GDPR and LGPD, data subject rights, accountability, breaches, international transfers and privacy in AI.

Questions
50
Duration
120 min
Passing score
70%
Investment
$100
Exam language
English, Portuguese, Spanish
Validity
Does not expire

The pass mark is fixed: you pass with 70% correct answers, with no curve and no comparison with other candidates.

Test your knowledge

  • Changed your mind? Ask for a full refund within 14 days of purchase, if the voucher has not been used.
  • Your voucher never expires. Take the certification exam when you are ready.
  • If you do not pass, your next attempt is half price for 90 days.
  • The credential never expires: no renewal, no paid continuing education and no annual fee. You pay for the exam once.
Questions about payment and refunds

Who this is for

  • You work on a privacy or DPO team

    You handle requests, records of processing and DPIAs every day and want to show that you master the method, not just the routine.

  • You come from law or compliance and are moving into privacy

    You know regulation and contracts and need the operational side of the GDPR and the LGPD: rights handling, breaches, transfers and accountability.

  • You are the product or IT person who answers privacy questions

    Nobody else on the team owns privacy, so the questions come to you. You want a solid basis for answering them, including when AI and analytics are involved.

What you take with you

  • A permanent verification code

    Anyone confirms your credential at dpcert.org/verify, without having to ask you for anything.

  • Approval that does not expire

    A credential you earned does not lapse, asks for no annual renewal and charges no subscription.

  • LinkedIn and a public profile

    Add it to your licenses and certifications section, or share the link to your profile.

  • A certificate with your score by domain

    In PDF, showing how you performed in each area assessed.

What you need to know

Seven domains, drawn at random from a bank written for this certification exam. Read each one and see where you stand.

  • Data protection foundations

    10 questions · 20% of the exam

    Identifying personal and sensitive data, telling controller from processor, applying the principles and choosing a lawful basis under the GDPR and the LGPD, with a comparative view of CCPA/CPRA.

  • Data subject rights and requests

    8 questions · 16% of the exam

    Handling access, rectification, erasure, portability and objection requests end to end: verifying identity, applying exceptions, meeting deadlines and answering in language the person understands.

  • Accountability tools

    10 questions · 20% of the exam

    Keeping records of processing, deciding when a DPIA is needed and running it, embedding privacy by design and setting up a DPO function with real independence.

  • Security and breaches

    7 questions · 14% of the exam

    Choosing technical and organizational measures proportionate to risk, assessing whether an incident is a notifiable breach and notifying the authority and data subjects within the required timelines.

  • International transfers and vendors

    5 questions · 10% of the exam

    Selecting a transfer mechanism such as adequacy or standard contractual clauses, running a transfer assessment and writing processor contracts that hold vendors to the same standard.

  • Privacy in AI and analytics

    7 questions · 14% of the exam

    Assessing profiling and automated decisions, using personal data to train models and telling anonymization from pseudonymization, including when re-identification risk brings data back into scope.

  • Governance and audit

    3 questions · 6% of the exam

    Measuring a privacy program, auditing it, preparing for interaction with the supervisory authority and understanding how sanctions are set.

Candidate handbook, with weights and where to study each domain →

How the certification exams are builtIntegrityAbout DPCert

DPAI + RAIP

Privacy & AI Track

DPAI and RAIP together: data protection and applied AI governance, the pair that shows up in the same decisions. Both vouchers at once, and neither expires.

$170$200

You save $30 compared with buying both separately.

14-day refund if neither voucher has been used.

DPAI + AUDAI

Assurance Track

DPAI and AUDAI together: the data protection foundation and AI and data audit. DPAI also meets the AUDAI prerequisite. Both vouchers at once, and neither expires.

$170$200

You save $30 compared with buying both separately.

14-day refund if neither voucher has been used.

Test your knowledge with the Open Assessment

The Open Assessment has twenty questions at the level of the certification exam, with the result on the spot and a score for each domain. It is the honest way to decide whether you are ready.

Test your knowledge

See what the questions are like

Sample questions in the exam format: a work situation and a decision. The certification exam uses different questions.

  1. A university runs a page on a social network. The network places cookies on visitors' devices and gives the university statistics about the page's audience, such as age ranges and the times visitors are most active. Under the GDPR, as interpreted by the Court of Justice of the EU, what is the university's role in the collection of visitors' data for these statistics?

    1. ANone, because the university receives only aggregated statistics and never sees individual visitors' data
    2. BProcessor of the network, because it uses a service whose terms and tools are set entirely by the network
    3. CJoint controller with the network, because by creating the page and choosing its settings it helps determine that processing
    4. DSole controller, because it chose to open the page and so answers for everything the network does with visitor data
    Show answer and explanation

    Answer: C

    In Wirtschaftsakademie (C-210/16), the Court of Justice held that the administrator of a page on a social network is a joint controller with the platform for the collection of visitor data used to produce page statistics: by creating the page and setting parameters such as the target audience, the administrator takes part in determining purposes and means. Controllership does not require access to the raw data, so receiving only aggregates does not remove the role. The university is not a processor, because it does not act on the network's behalf or under its instructions. Nor is it sole controller: joint controllership covers the stages it helps decide, not everything the network does with the data for its own purposes.

  2. An insurer receives an access request from a former policyholder covering ten years of claims files, call recordings and email. Three weeks in, the privacy team sees that it cannot gather everything within the GDPR's standard one-month period. What should it do?

    1. AInform the requester, within the first month, that the period is being extended by up to two further months, and explain why
    2. BSend the records found so far and close the request, inviting the requester to submit a new one for the remaining material
    3. CCharge a reasonable fee to cover the additional search effort, since the request covers an unusually long period
    4. DTell the requester that the period will start again once the archive search is complete, so that the reply can be full
    Show answer and explanation

    Answer: A

    Article 12(3) allows the one-month period to be extended by two further months where necessary, taking into account the complexity and number of requests, provided the controller informs the data subject of the extension, with the reasons, within the first month. Sending part of the data and closing the request leaves the rest unanswered and shifts the burden to the requester. A fee is allowed only for further copies or for manifestly unfounded or excessive requests, and a broad request is not excessive in itself. The GDPR has no mechanism for restarting the period at the controller's convenience.

Frameworks and concepts covered

The glossary terms linked to this certification, each with its definition.

Study from the source of the certification exam

Practise the topic with a free tool

No sign-up tools on subjects of this certification, to apply at work what the certification exam assesses.

See all tools

No course is required

The certification exam is the same for everyone, and how you prepare is your call: a course, a book, or the experience you already carry from the job.

I already have a voucher
  • Changed your mind? Ask for a full refund within 14 days of purchase, if the voucher has not been used.
  • Your voucher never expires. Take the certification exam when you are ready.
  • If you do not pass, your next attempt is half price for 90 days.
  • The credential never expires: no renewal, no paid continuing education and no annual fee. You pay for the exam once.

No prerequisite: this certification can be your starting point, with no other credential required. It also meets the prerequisite of Responsible AI Leader (RAIL) and Responsible AI Auditor (AUDAI).

Your access to the certification exam arrives by email as soon as the payment clears, and it does not expire. Payment is handled by Stripe.

Sample credential

DPAI

Data Protection & AI Professional

Holder
Emily Katherine Thompson
Credential IDIssued March 12, 2026

DPAI-X87N-WG2C

Verified credentialdpcert.org/verify
Example of the certificate

Frequently asked questions about the certification exam

›What does the DPAI cover: GDPR or LGPD?

Both, plus a comparative view. The DPAI covers the foundations shared by data protection laws (personal data, controller and processor, principles and lawful bases) through the GDPR and the LGPD, compared with laws such as the CCPA/CPRA. It also covers data subject rights, accountability tools such as records of processing and DPIAs, security and breaches, international transfers, privacy in AI and analytics, and programme governance and audit.

›What is the DPAI exam like?

There are 50 questions in 120 minutes, and you pass with 70%. There is no prerequisite, the exam is online, in English, Portuguese or Spanish, and costs USD 100. Questions describe real situations, such as handling a data subject request, assessing a breach or choosing a transfer mechanism. The DPAI is also part of two discounted bundles: with the RAIP and with the AUDAI.

›Does the DPAI qualify me as a DPO?

No, because no certification does that: neither the GDPR nor the LGPD requires certification for the DPO role. The choice belongs to the organisation, based on expertise and independence. The DPAI is verifiable evidence that you have that expertise. In Spain there is an official DPO certification scheme linked to the AEPD; the DPAI is not that scheme.

›Who is the DPAI for?

For people whose main responsibility involves personal data: privacy analysts and managers, DPOs and their teams, legal and compliance professionals, and also information security, product and data people when they handle personal data. It is a good first paid step for people from a legal background who want to go on to the RAIL or the AUDAI.

›How does the DPAI compare with the CIPP/E or CIPM?

The IAPP CIPP/E centres on European law, and the IAPP CIPM on running a privacy programme; both have a renewal cycle. The DPAI combines GDPR and LGPD foundations with a comparative view, programme practice and a domain on privacy in AI, never expires and costs USD 100. It is not equivalent to either. CIPP/E and CIPM are trademarks of IAPP, and DPCert is not affiliated with it; check current terms on IAPP official website.

›What is the certification exam like? Is it online?

Yes, it is an online multiple-choice exam, taken in your own browser, with no scheduling and no exam centre. Questions describe work situations and ask for a decision, rather than testing memorised definitions, and the RAIL and the AUDAI also have a case analysis domain. Every question has four options and exactly one correct answer. All exams have 50 questions; the duration and the passing score of each are on the certification page.

›How hard is the exam, and what is the passing score?

The passing score is 70% for the RAIF, RAIP, DPAI and RAI-X, and 72% for the RAIL and the AUDAI, which are higher-level. There is no curve and no comparison with other candidates, and every question has exactly one correct answer. On difficulty: we do not publish pass rates yet, because DPCert is new and we will only publish figures with a large enough sample. Questions ask for decisions in real situations, so studying from the syllabus makes a difference.

›Can I retake a paid exam? Do I have to wait?

You can retake it, and for paid certifications there is no waiting period and no limit on attempts. Each new attempt requires a new voucher, because each voucher is worth one attempt. Questions are drawn afresh each time you open an exam, so a retake does not repeat the previous paper. If you do not pass, you receive a coupon to buy the new attempt at the same certification for half the price, valid for 90 days. For a RAIF taken at no cost under the Black Friday flash promotion, the rule is different: a free retake within 7 days of the result.

›Does the voucher expire?

A voucher bought on the site does not expire. Vouchers issued to an organisation in bulk may carry a deadline set at issuance, and in that case the date is shown with the code. If you lost the email, the code is also in your account, under Certification exams, once your address is confirmed.

›What is the refund policy? Can I cancel my purchase?

Yes, within 14 days of purchase, as long as the voucher has not been used. Write to [email protected] from the same email used in the purchase, saying you want a refund. We return the full amount through the same payment method and cancel the voucher at the same time. A voucher already used is not refundable, even within the 14 days, because the attempt is consumed when the exam is opened. For a bundle, the refund covers the whole bundle and only applies if none of its vouchers has been used. After 14 days, the voucher is still yours and never expires, but it is no longer refundable.

›Does the DPCert credential expire? Do I need to renew it?

No and no. A DPCert credential does not expire: there is no expiry date, no periodic retesting, no continuing education quota (CPE/CPD), no renewal fee and no annual dues. You sit the exam once, and the credential stays valid unless revoked. Revocation is an administrative act with a recorded reason, not an automatic expiry. No renewal fees. No CPE quotas. Many certifications on the market charge periodic upkeep; this one does not.

Questions about the certification exam →All frequently asked questions →