Home › Knowledge Hub › Certifications

Knowledge Hub

Privacy & data protection certifications

The individual credentials privacy and data protection professionals hold — from BCS, IAPP, ISACA, PECB, EXIN and others — grouped by awarding body, each described in plain English with a link to the official page. Where a credential is vendor-specific or tied to one jurisdiction, we flag it so you can weigh it in context.

Compiled & maintained by VulaPri Limited, a UK privacy consultancy · PDP and IBITGQ entries verified 31 August and 15 September 2026; the remaining entries 5 July 2026

BCS, The Chartered Institute for IT (UK)

  • BCS Foundation Certificate in Data Protection

    BCS · entry level · UK

    What it covers: An entry-level UK certificate covering UK GDPR, the Data Protection Act 2018 and EU GDPR — a common starting credential for UK data protection practitioners.

    Note: The legacy ISEB Certificate in Data Protection was the historical name for the BCS data protection certificates; holders' credentials remain valid.

    View on the BCS site →

  • BCS Practitioner Certificate in Data Protection

    BCS · practitioner level · UK

    What it covers: A practitioner-level UK certificate for those applying data protection law in practice, descended from the ISEB Practitioner Certificate first offered in 1999.

    View on the BCS site →

PDP (UK)

  • Practitioner Certificate in Data Protection (PC.dp.)

    PDP · practitioner level · UK

    What it covers: A UK practitioner qualification for working data protection professionals: five days’ tuition (four compulsory courses — Essential Knowledge Levels 1–2, Data & Cyber Security, Handling Subject Access Requests — plus one elective), study of course materials and an online examination held twice yearly. The syllabus includes the Data (Use and Access) Act 2025. An independent Examination Board sets the syllabus; qualified practitioners appear on a public register and must attend one designated course a year to maintain the qualification.

    Note: PDP also awards a Foundation Certificate in Data Protection (FC.dp.), and parallel practitioner certificates in freedom of information and records management. The awarding company, PDP Companies Ltd, is listed in Law, Consultancy & Training.

    View on the PDP site →

IAPP (International Association of Privacy Professionals)

  • AIGP — AI Governance Professional

    IAPP · global

    What it covers: AI systems and their impacts, responsible-AI principles and the law applicable to AI governance — the IAPP's dedicated AI-governance credential.

    View on the IAPP site →

  • CIPM — Certified Information Privacy Manager

    IAPP · global · ANAB-accredited

    What it covers: Privacy programme management and operations — building and running a privacy programme rather than the law itself.

    View on the IAPP site →

  • CIPP — Certified Information Privacy Professional

    IAPP · global · five concentrations

    What it covers: The IAPP's law-and-regulation credential, offered in five regional concentrations. CIPP/E (Europe) is the primary route for UK and EU practitioners; the others are CIPP/US, CIPP/C, CIPP/A and CIPP/CN.

    View on the IAPP site →

  • CIPT — Certified Information Privacy Technologist

    IAPP · global · ANAB-accredited

    What it covers: Privacy engineering and privacy-by-design — how to build privacy into systems and products. The technologist counterpart to the CIPP and CIPM.

    View on the IAPP site →

  • FIP — Fellow of Information Privacy

    IAPP · global · designation

    What it covers: A senior designation, not a separate exam, awarded to holders of a CIPP plus either the CIPM or the CIPT — recognising breadth across law, management and technology.

    View on the IAPP site →

  • US-only jurisdiction

    Privacy Law Specialist (PLS)

    IAPP · United States · ABA-accredited specialty

    What it covers: A US legal-specialty credential for practising lawyers, accredited through the American Bar Association route.

    Flag: Jurisdiction-specific — it is a US legal specialty and is not a general or UK/EU credential. Relevant mainly to US-qualified lawyers.

    View on the IAPP site →

IBITGQ (International Board for IT Governance Qualifications)

  • IBITGQ GDPR qualifications (EU GDPR F / EU GDPR P / C DPO)

    IBITGQ · foundation to practitioner level · global · exams via GASQ

    What it covers: The International Board for IT Governance Qualifications (a non-profit personnel-certification body established 2011) awards a GDPR Foundation (EU GDPR F), GDPR Practitioner (EU GDPR P) and Certified Data Protection Officer (C DPO) qualification, with exams administered by GASQ, its principal examination body. Training is optional — candidates may sit the exam directly. IBITGQ also awards ISO/IEC 27701 PIMS Lead Implementer and Auditor, BS 10012 PIMS, privacy-by-design and CPRA credentials. These are the qualifications attached to certificated GDPR courses from providers such as IT Governance (listed in Law, Consultancy & Training).

    Note: IBITGQ states that it is accredited to ISO/IEC 17024:2012 by IAS, with the accreditation scope covering its Certified ISO 27001 ISMS Lead Implementer and Lead Auditor schemes; the GDPR qualifications are not listed within that scope. Most IBITGQ certifications do not expire (per GASQ); certificates are verifiable through GASQ’s register.

    View on the IBITGQ site →

ISACA

  • CDPSE — Certified Data Privacy Solutions Engineer

    ISACA · global

    What it covers: Technical privacy-by-design across governance, architecture and the data life cycle — aimed at those implementing privacy in systems. Certification requires relevant work experience.

    View on the ISACA site →

PECB

  • PECB Certified Data Protection Officer (GDPR)

    PECB · global

    What it covers: The role and responsibilities of a GDPR data protection officer, offered at provisional and full tiers (the full tier requiring relevant experience). PECB also offers a GDPR Foundation credential.

    View on the PECB site →

  • PECB Certified ISO/IEC 27701 Lead Implementer

    PECB · global

    What it covers: Implementing a privacy information management system (PIMS) under ISO/IEC 27701.

    View on the PECB site →

  • PECB Certified ISO/IEC 27701 Lead Auditor

    PECB · global

    What it covers: Auditing a privacy information management system (PIMS) against ISO/IEC 27701.

    View on the PECB site →

EXIN

  • EXIN Privacy & Data Protection Foundation

    EXIN · global

    What it covers: GDPR fundamentals at foundation level.

    View on the EXIN site →

  • EXIN Privacy & Data Protection Practitioner

    EXIN · global

    What it covers: Applied GDPR at practitioner level, building on the Foundation credential.

    View on the EXIN site →

  • EXIN Data Protection Officer (DPO)

    EXIN · global · career-path title

    What it covers: A career-path designation awarded on completing a defined set of EXIN credentials, rather than a single exam.

    View on the EXIN site →

APMG International

  • Certified Data Protection Foundation & Practitioner (GDPR)

    APMG International · UK-based · delivered via accredited partners

    What it covers: A combined GDPR foundation-and-practitioner credential delivered through APMG's network of accredited training partners.

    Note: The direct link points to APMG's GDPR category page; confirm the current product on that page, as APMG delivers through partners.

    View on the APMG site →

University & national DPO schemes

  • ECPC-B EU DPO Certification

    Maastricht University (ECPC) · Netherlands / EU

    What it covers: A university professional certificate for EU DPOs (not an academic degree), valid for two years with a continuing-professional-development requirement to renew.

    View on the Maastricht University site →

  • France-specific

    CNIL DPO Certification (France)

    Delivered by CNIL-approved certification bodies · France

    What it covers: A France-specific recognition of DPO competence. The CNIL (the French supervisory authority) does not certify individuals itself; instead it approves independent certification bodies that assess candidates against CNIL-set criteria and issue the "certified DPO" credential.

    Flag: Jurisdiction-specific to France, and often expected for French public-sector DPO roles. The list of CNIL-approved bodies changes over time, so we link to the CNIL's official register of approved bodies rather than name a list that may go out of date.

    See the CNIL's official list of approved bodies →

  • Europrivacy Implementer / Auditor

    European Centre for Certification and Privacy (ECCP) · Luxembourg / EU

    What it covers: Individual qualifications tied to the Europrivacy scheme — an Implementer credential (preparing processing for certification) and an Auditor credential (conformity assessment, which requires the introductory and implementer stages first).

    Note: These are the individual credentials; the Europrivacy scheme itself (the EDPB-adopted European Data Protection Seal) is covered in our Codes & certification schemes directory.

    View on the Europrivacy site →

Vendor certification

  • Vendor / product-specific

    OneTrust Certified Privacy Professional

    OneTrust · global · product certification

    What it covers: Competence in using OneTrust's privacy technology.

    Flag: A vendor product certification, not a vendor-neutral credential — it demonstrates skill with OneTrust's platform rather than data protection knowledge in general. Some courses carry IAPP continuing-education credit. Useful if you work with the tooling; not a substitute for a neutral credential.

    View on the OneTrust site →

This directory is curated for authority over volume and expanding. Think a credential is missing, or spot a detail to fix? Flag it for the curation team — curated lists take tip-offs, not self-listings. Listing is not an endorsement, and general reference only — always confirm current details on the official page.