EXIN • PDPF • GDPR • Edition 202512
CERTIFICATION GUIDE
PDPF Certification Guide: Privacy & Data Protection Foundation Syllabus, sample questions and a study plan for the EXIN GDPR foundation exam All five exam topics with EXIN’s official weightings down to each sub-topic, the exam fact sheet, who the certification is written for and the three career paths it feeds, what the AI sub-topic added to the syllabus, the reading and study hours EXIN expects, a five-step route to exam day, and ten real sample questions with a full answer key.
40
60
65%
$295
5
QUESTIONS
MINUTES
PASS MARK
EXAM FEE
EXAM TOPICS
Prepared by CertFun • www.certfun.com
www.certfun.com
EXIN PDPF
SECTION 01
Exam Overview The PDPF EXIN Privacy and Data Protection Foundation exam is EXIN’s entry-level GDPR certification: 40 multiple-choice questions in 60 minutes, 26 correct to pass, nothing on the desk with you. Everything below is taken from EXIN’s own Preparation Guide, Edition 202512, cross-checked against CertFun’s PDPF exam syllabus and the official EXIN certification page. Certification
EXIN Privacy & Data Protection Foundation (PDPF.EN)
Exam code
PDPF
Preparation guide edition
202512
Question type
Multiple choice
Number of questions
40
Pass mark
65% (26 of 40)
Exam duration
60 minutes
Open book / notes / aides
No, no and no
Bloom levels tested
1 and 2 - remembering and understanding
Recommended contact hours
14
Indicated study effort
56 hours (2 ECTS)
Exam fee
USD 295
Languages
English, Dutch, Portuguese, Chinese
Two numbers set the tone. Bloom levels 1 and 2 means you are being asked to remember and to understand - not to apply judgement to a messy scenario, which is what the Professional-level exam does. And 56 hours of study effort against only 14 contact hours tells you where the work sits: most of it is reading, on your own, after the course. SECTION 02
What the Certification Covers, and Who Sits It EXIN’s scope statement is deliberately plain: the certification “confirms that the professional understands the basic concepts and principles of data protection in the context of the General Data Protection Regulation.” That is the whole exam - the GDPR, Regulation (EU) 2016/679 itself, read as an organisation would have to apply it.
EXIN Privacy & Data Protection Foundation (PDPF.EN)
1
www.certfun.com
EXIN PDPF
EXIN’s own target group for PDPF Data protection officers (DPOs) Compliance officers and security officers HR staff, who handle employee data every day Process and project managers designing systems that touch personal data
Note who is not on that list: lawyers. This is not a legal qualification and it does not try to be. It is the shared vocabulary an organisation needs so that the people collecting, storing and deleting personal data recognise a lawful basis, a data subject right and a personal data breach when they see one. The current edition also reflects where the pressure now is. EXIN notes that “with the enormous increase in use of artificial intelligence (AI), there is more demand for the use of personal data to train the algorithms,” and the syllabus carries a dedicated AI sub-topic because of it. ISO/IEC 27701:2025 gets a mention too, as the standard organisations use to show GDPR compliance. The rest of the EXIN catalogue sits on the CertFun EXIN vendor page. SECTION 03
The Five Topics, by Official Weight EXIN publishes weightings down to the sub-topic, which makes this exam unusually easy to plan for. Two blocks carry 62.5%% of the paper between them - principles of data processing, and risk assessment and mitigation. If your revision time is short, that is where it goes. 1 GDPR scope
12.5% 37.5%
2 Principles of data processing 3 Practice of data processing
10%
4 International personal data transfers 5 Risk assessment and mitigation
15% 25%
Official topic weightings, EXIN Preparation Guide Edition 202512. The sub-topics follow with their own weights, in EXIN’s wording. The single heaviest sub-topics are rights of the data subjects and personal data breaches, at 12.5%% each - between them a quarter of the exam, so know the eight rights and the notification obligation cold.
EXIN Privacy & Data Protection Foundation (PDPF.EN)
2
www.certfun.com
EXIN PDPF
1 GDPR scope — 12.5% 1.1 Privacy and data protection (5%) • Define privacy • Relate privacy to personal data and data protection • Describe the context of European Union (EU) and EU Member State law
1.2 Scope of the GDPR (7.5%) • Define personal data according to the GDPR • Define processing of personal data that falls within the scope of the GDPR • Make a distinction between personal data and special categories of data
2 Principles of data processing — 37.5% 2.1 Stakeholder roles, rights, and obligations (7.5%) • List the roles, responsibilities and stakeholders in the GDPR • Describe the process and activities required to comply with the GDPR • List the different types of administration (GDPR Article 28 and Article 30)
2.2 Data protection by design and by default (5%) • Describe the seven principles of data protection by design • Describe the benefits of data protection by design and by default
2.3 Legitimate grounds for processing (5%) • List the six legitimate grounds for processing • Describe the requirements for lawful data processing
2.4 Rights of the data subjects (12.5%) • Describe the right to transparent information, communication, and modalities • Describe the right of access, to data portability, to rectification and to erasure • Describe the right to restriction of processing • Describe the right to object and the right to lodge a complaint with the supervisory authority • Describe rights regarding automated decision-making
2.5 Principles of processing personal data (7.5%) • Describe lawfulness, fairness, and transparency • Describe purpose specification and purpose limitation • Describe data minimization and storage limitation • Describe accuracy, integrity, and confidentiality of personal data
EXIN Privacy & Data Protection Foundation (PDPF.EN)
3
www.certfun.com
EXIN PDPF
3 Practice of data processing — 10% 3.1 Data governance (2.5%) • Describe the purpose of data lifecycle management (DLM)
3.2 Processing online (2.5%) • Describe the definition, functionality, and purpose of a cookie • Describe the right to object to processing for direct marketing, including profiling
3.3 Using artificial intelligence (AI) (5%) • Identify challenges to GDPR compliance when using AI • Describe conditions for compliance with the GDPR when using AI
4 International personal data transfers — 15% 4.1 Cross-border transfers within the EEA (10%) • Describe the regulations that apply to data transfers inside the EEA • Describe the concept of binding corporate rules (BCR) • Describe how data protection is formalized in BCR between controller and processor • Describe the clauses of BCR
4.2 Cross-border transfers outside the EEA (5%) • Describe the regulations that apply to data transfers outside the EEA • Describe the regulations that apply to transfers between the EEA and the U.S.
5 Risk assessment and mitigation — 25% 5.1 DPIA and prior consultation (7.5%) • Outline what a DPIA covers and when to do a DPIA • List the eight objectives of a DPIA • List the topics of a DPIA report
5.2 Personal data breaches and related procedures (12.5%) • Define a personal data breach • Describe the difference between a data breach (incident) and a personal data breach • Give examples of personal data breaches • List relevant stakeholders that should be informed in case of a personal data breach • Describe the personal data breach notification obligation laid down in the GDPR
5.3 Supervisory authorities (5%) • Describe the responsibilities of supervisory authorities and how they enforce
EXIN Privacy & Data Protection Foundation (PDPF.EN)
4
www.certfun.com
EXIN PDPF
SECTION 04
What the Credential Is Worth PDPF is a foundation certificate, and its value comes from being the entry point to three of EXIN’s career paths rather than from standing alone: Data Protection Officer, Information Security Officer and newest, and the reason this exam is worth a second look - Artificial Intelligence Compliance Officer, which EXIN describes as preparing professionals “to comply with the most relevant artificial intelligence (AI) and data protection regulations.” Where it actually helps It is vendor-neutral: the GDPR is the subject, not a product. It is the common language for DPO, security and AI-compliance tracks alike. A day of exam time buys a defensible baseline for anyone handling personal data. For teams, it is the cheapest way to make privacy training auditable.
Set expectations honestly, though. A foundation certificate confirms understanding, not practice - it will not by itself qualify you as a DPO, and it is European law, so its weight outside the EEA depends on whether your employer processes EU residents’ data. Where it does, it travels well. The wider privacy profession gathers at the IAPP community. SECTION 05
Getting Certified, Step by Step 1
Start from the exam literature Besemer, Privacy and Data Protection based on the GDPR, 2nd edition (2025).
2
Budget the hours EXIN indicates 56 hours of study effort, 14 of them contact hours if you take a course.
3
Learn the lists, because the exam asks for them Six legitimate grounds, seven design principles, eight data subject rights, eight DPIA aims.
4
Weight your revision, do not spread it evenly Principles 37.5% and risk 25% first; data governance and cookies are 2.5% each.
5
Sit it closed book Forty questions in 60 minutes - 90 seconds each, no notes, no calculator, no phone.
That fourth step is where most preparation goes wrong: people read the regulation front to back and give a 2.5% sub-topic the same evening as a 12.5% one. CertFun’s PDPF practice exam is built to the same weightings as the real paper, so a mock score tells you where the gap is.
EXIN Privacy & Data Protection Foundation (PDPF.EN)
5
www.certfun.com
EXIN PDPF
SECTION 06
PDPF Sample Questions These ten come from CertFun’s PDPF sample questions page, shown in shuffled order, and all are single-answer - which is the real format. They are a fair sample of the Bloom 1 and 2 mix: some ask you to recall a definition, others give you a short situation and ask which right, principle or legal instrument applies. Answers follow the set. Q1. The GDPR describes the principle of data minimization. How can organizations comply with this principle? a) By applying the concept of least privilege to the personal data collected, stored or otherwise processed b) By limiting access rights to staff who need the personal data for the intended processing operations c) By limiting file sizes, through saving all personal data that is processed in the smallest possible format d) By limiting the personal data to what is adequate, relevant and necessary for the processing purposes Q2. The GDPR refers to the principles of proportionality and subsidiarity. What does subsidiarity mean? a) Personal data shall be collected for specified, explicit and legitimate purposes and not further processed. b) Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary. c) When processing personal data, a controller will only gather data which is necessary for the purpose. d) When processing personal data, the means to be used shall be the least infringing upon privacy as possible. Q3. According to the GDPR, what is the definition of processing of personal data? a) Any operation that can be performed on personal data b) Any operation that can be performed on personal data, except erasing and destroying c) Only operations in which the personal data is shared or transferred in any way d) Only operations in which the personal data is used for the purposes for which it was collected
EXIN Privacy & Data Protection Foundation (PDPF.EN)
6
www.certfun.com
EXIN PDPF
Q4. Further processing, after the original objective is fulfilled, is allowed in a few specific cases, provided that appropriate safeguards for the rights and freedoms of the data subjects are taken. For which purpose is further processing not allowed? a) For archiving purposes in the public interest b) For direct marketing and commercial purposes c) For generalized statistical purposes d) For scientific or historical research purposes Q5. What is a description of data protection by design and by default? a) An approach that implements data protection from development b) An indication of timeframes if processing relates to erasure c) Data may only be collected for explicit and legitimate purposes d) Not holding more data than is strictly required for processing Q6. In the legal system of the European Union (EU), different tools are used to reach various goals. Some of these tools are binding, while others let EU Member States decide how to use them, offering them flexibility. Does the GDPR allow this flexibility? a) Yes, because it is a directive, which sets goals for EU Member States and sets out national measures. b) Yes, because it is a recommendation that gives advice without further specific legal obligations. c) No, because it is a decision that is binding only for specific parties and not for all EU Member States. d) No, because it is a regulation, that applies to all EU Member States and is directly applicable. Q7. A person regularly receives offers from a store where he purchased something five years ago. He wants the company to stop sending offers and to delete his personal data. Which of the data subjects' rights is he exercising? a) The right of access b) The right to object c) The right to rectification d) The right to restriction of processing Q8. What is the main use of a persistent cookie? a) To ensure that the user's personal data are stored securely on the server b) To personalize the user's experience of the website during a next visit c) To record every keystroke made by a computer user to find out passwords d) To save the pages a user has bookmarked in the user's browser history
EXIN Privacy & Data Protection Foundation (PDPF.EN)
7
www.certfun.com
EXIN PDPF
Q9. Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Which data processing principle is described here? a) Accuracy b) Data minimization c) Lawfulness, fairness, and transparency d) Purpose limitation Q10. How does the GDPR define personal data? a) Any information relating to a resident of the European Economic Area (EEA) b) Data that directly relate to an identified or identifiable natural person c) Any information relating to an identified or identifiable natural person d) Data that reveal someone's racial or ethnic background, religious views, health, sex life or sexual orientation
Q1
Q2
Q3
Q4
Q5
Q6
Q7
Q8
Q9
Q10
d
d
a
b
a
d
b
b
d
c
Answer key
SECTION 07
Where to Go Next Check the edition before you start reading. EXIN revises the preparation guide - this guide follows Edition 202512 - and the AI sub-topic is recent enough that older study material will not cover it. The official certification page always carries the current one. After PDPF, the natural next step is Privacy & Data Protection Professional, which moves from understanding to application. Quick reference Official certification page and preparation guide - exin.com GDPR full text - eur-lex.europa.eu Syllabus, sample questions and practice test - certfun.com/exin Privacy profession community - iapp.org
EXIN Privacy & Data Protection Foundation (PDPF.EN)
8
www.certfun.com
EXIN PDPF
Before you book — the guide in one card Questions
40 multiple choice
Duration
60 minutes
Pass mark
65% (26 of 40)
Exam fee
USD 295
Open book
No - no notes or aides
Bloom levels
1 and 2
Then
Risk assessment (25%)
Heaviest topic
Principles of data processing (37.5%)
Heaviest
Data subjects' rights and
sub-topics
breaches (12.5% each)
Study effort
56 hours (2 ECTS)
Lightest Contact hours
Data governance, cookies (2.5%) 14
Good luck. The GDPR reads like a wall of articles, but the exam is testing something simpler: whether you can look at any handling of personal data and say who is responsible, on what lawful ground it happens, what the person it describes may demand, and what has to happen when it goes wrong.
EXIN Privacy & Data Protection Foundation (PDPF.EN)
9