What a certification proves
The word certification is used for two very different things. A course certificate says you attended the classes and completed the hours. A certification credential says an institution assessed you and you passed an exam. The first records attendance. The second records performance.
At DPCert, the credential always comes from passing the certification exam, never from attending a course. We do not sell courses and no course is required: the exam measures what you know, not where you studied. That keeps those who teach and those who assess in separate places, which is what gives the result its value.
For people who work with personal data, the difference matters. A privacy team needs people who can apply the rules to a real case: identify the legal basis for processing, answer a data subject, decide whether an incident must be notified, assess a vendor. That is why our exams use application questions, with domains and weights published in the candidate handbook before any purchase.
A credential demonstrates knowledge. It does not make an organization compliant and it does not replace the accountability of those who process data. Put that way, it is clear, verifiable evidence for your résumé, for your team and for anyone who needs to trust your work.
Who each level is for
The DPCert catalogue has three levels and covers data protection, responsible AI, governance and audit. People in privacy usually look first at the Data Protection & AI Professional (DPAI), the specialist-level certification for privacy, legal and compliance teams and DPOs. It assesses GDPR and LGPD, data subject rights, accountability, breaches, international transfers, impact assessments and the use of personal data in AI.
If you are starting out, you can enter at the foundation level, which gives you the common vocabulary of risks, principles and roles, and move on to specialist later. If you already lead a program or carry out audits, the higher levels are for you, and they first require a specialist-level credential.
For those new to the field
Entry level. Proves the shared vocabulary of responsible AI and data protection: risks, principles, roles and the main rules.
For those who apply it day to day
Proves practice: applying AI responsibly in product, data, engineering and risk, or managing privacy and data protection in an organisation.
For those who lead, audit or oversee
Proves leadership of the AI governance programme, audit of AI systems and data, and executive oversight. Leadership and audit require a specialist-level credential first.
How the exam works
The certification exam is taken online, in the browser, with no scheduling. You pick the day and time when you are ready, open the exam with your voucher and answer it. It is available in English, Portuguese and Spanish, and the site works in the same three languages.
The result comes on the spot. When you finish, the screen shows your score and your performance in each domain assessed, with no board, marking queue or days of waiting. Even candidates who do not pass leave knowing exactly where to study.
To prepare, start with the candidate handbook, which lists the domains and the weight of each one. Then take an open assessment: its questions follow the style of the exam, come with answers and explanations, and are free. If you want support, pick whichever course or book you prefer. When you score comfortably and can explain why each answer is right, set aside a quiet time and open the exam.
The rules are simple and apply to everyone:
- The exam is individual and closed book, which includes any AI assistant.
- Time is controlled by the server and runs from the moment you open the exam. There is no pause.
- Questions are drawn afresh each time, so no two attempts are the same.
- Copying and text selection are disabled during the exam.
- There is no camera, microphone or screen recording. Protection lives in the exam itself, and an attempt with unusual signals is flagged for human review.
Price and what is included
You pay once per exam, and the price below appears in the currency of your region. There is no annual fee, no maintenance fee and no mandatory course. Your purchase creates a voucher that never expires, so nothing forces you to sit the exam before you are ready.
The price includes one attempt at the certification exam, the detailed result by domain and, when you pass, the full credential: a public verification code, a signed Open Badge and a PDF certificate with a QR code. If you change your mind, you can ask for a full refund within 14 days of purchase, as long as the voucher has not been used. If you do not pass, the next attempt is half price for 90 days.
Companies and institutions that need several exams can buy vouchers in bulk, track their use and get a volume discount.
From $100
| Certification | Questions | Minutes |
|---|---|---|
| RAIF | 50 | 60 |
| RAIP | 50 | 60 |
| RAIL | 50 | 150 |
| DPAI | 50 | 120 |
| AUDAI | 50 | 150 |
| RAI-X | 50 | 60 |
A permanent, verifiable credential
The credential does not expire. There is no renewal, no continuing education quota and no annual fee, so it stays on your résumé at no cost after the exam. It only stops being valid if it is revoked, as in a case of proven fraud.
Anyone can confirm a credential in seconds on the public verification page, using the code on the certificate or by scanning the QR code. People who choose a public profile can also be found by name. A recruiter does not need to write to the institution or trust an image.
The digital badge follows the Open Badges 3.0 standard and is signed by DPCert. That means the credential data travels with the badge and can be checked by any compatible system. You can also add the credential to your LinkedIn profile in a few clicks.
How to compare it with the alternatives
There are good paths for anyone who wants to grow in data protection, and they answer different needs. It helps to look at the format of each one:
Three questions help you decide. Do you want to learn the subject or prove what you already know? Does a job or tender you have in mind ask for a specific scheme? And how much will it cost to keep the credential over the coming years, adding up renewals and continuing education hours? Many people combine the paths: they study on a course and prove it in an exam.
- Course with a completion certificate: teaches the content and records the hours. It is a great way to learn, and it can come before an exam.
- Postgraduate and university programs: go deep over several months and give you an academic qualification, with more time and investment.
- Exam-based certification with periodic renewal: assesses by exam and keeps the credential active through continuing education hours and recurring fees.
- Accredited personnel certification schemes: follow a scheme assessed by a national body and often require prior training or experience. They may be requested in specific tenders or jobs.
- Exam-based certification with no renewal, like DPCert: assesses by online exam with no mandatory course, and the credential stays with you at no recurring cost.
Frequently asked questions
- Which data protection certification should I take first?
- If you already work in privacy, legal or compliance, the Data Protection & AI Professional (DPAI) is the natural starting point. If you are starting out, the Responsible AI Foundation (RAIF) gives you the basics of risks, principles and roles. The recommender on the site suggests a path in three questions.
- Do I need to take a course before the certification exam?
- No. No course is required and no course guarantees a pass. The candidate handbook lists the domains and weights assessed, and the free open assessments show the style of the questions, so you can study whichever way you prefer.
- Do I need a certification to be a DPO?
- No. Neither the GDPR nor the LGPD requires a certification for the role. What is expected is adequate knowledge, and a credential is one way to demonstrate it. It does not qualify anyone for the post: that decision belongs to the organization.
- Does the certification cover GDPR and LGPD?
- Yes. The DPAI assesses both regimes, with data subject rights, accountability, breaches, international transfers and impact assessments, plus the use of personal data in AI systems. The domains and weights are published on the certification page and in the candidate handbook.
- Does the credential expire?
- No. The credential has no expiry date, renewal, continuing education quota or annual fee. It only stops being valid if it is revoked, for example in a case of proven fraud.
- Is the exam online? Do I need to schedule it?
- It is online, with no scheduling. You take the exam in the browser when you are ready, in English, Portuguese or Spanish. The clock starts when you open it and there is no pause, so set aside the full time before you begin.
- What happens if I do not pass?
- You see your performance in each domain and know where to study. There is no waiting period and no limit on attempts, and each new attempt uses a new voucher. For paid exams, the next attempt is half price for 90 days.
- Is DPCert accredited?
- No. DPCert is not accredited and has no affiliation with data protection authorities, the European Union or ISO. The process is designed with reference to ISO/IEC 17024 principles: impartiality, separation of training and certification, and a documented scheme.
Next steps
Want to feel the level of the questions before deciding? The open assessment is free, comes with answers and explanations, and needs no account.