The BCS Practitioner Certificate in Data Protection is a UK data protection certification from BCS, The Chartered Institute for IT, covering UK GDPR, the Data Protection Act 2018, EU GDPR, PECR and the Data (Use and Access) Act 2025. The exam has 40 multiple-choice questions in 90 minutes, it's closed book, and the pass mark is 26 out of 40 (65%). The current syllabus is v9.9 (2026).
The BCS Practitioner Certificate in Data Protection validates in-depth knowledge of UK data protection law and how to apply it in practice. It's designed for people with data protection responsibilities in an organisation, including Data Protection Officers (DPOs), and anyone who wants to show a broad understanding of the law.
It's written to UK law (UK GDPR and the DPA 2018), but it also covers the EU GDPR, so it's useful for international candidates too.
BCS updated the syllabus in 2026 to reflect the Data (Use and Access) Act 2025 (DUAA), the biggest change to UK data protection law since the UK GDPR. The new syllabus covers:
Recognised legitimate interests as a new lawful basis
Updated subject access request (SAR) guidance from the ICO (2026)
New rules on automated decision-making (Articles 22A–D)
The DUAA complaints framework
The ICO's transition to the Information Commission
AI and the processing of personal data (a new syllabus area)
Code : PDP9
Exam Name : BCS Practitioner Certificate in Data Protection
Awarding Body : BCS, The Chartered Institute for IT
Current Syllabus : Version 9.9 (2026)
Level : Practitioner
Number of Questions : 40 multiple choice
Duration : 90 minutes
Pass Mark : 26 out of 40 (65%)
Open Book : No (closed book, supervised)
Delivery : Invigilated online, digital or paper based
Total Qualification Time : 34 hours (22.5 guided learning hours)
Recommended First Step : BCS Foundation Certificate in Data Protection (not mandatory)
Syllabus Area : Accountability principle (DPIAs, RoPA, privacy notices, data protection by design, security, the DPO role)
Weight : 15%
Syllabus Area : Breaches, enforcement and liability (breach reporting, complaints, ICO sanctions, fines)
Weight : 12.5%
Syllabus Area : Obligations of controllers, joint controllers and processors
Weight : 10%
Syllabus Area : Application of data protection law in key areas of industry (employment, CCTV, cookies, data sharing)
Weight : 10%
Syllabus Area : Context of data protection legislation
Weight : 7.5%
Syllabus Area : The role of independent supervisory authorities and the ICO
Weight : 7.5%
Syllabus Area : Specific provisions relevant to public authorities
Weight : 7.5%
Syllabus Area : Principles of data protection and terminology
Weight : 5%
Syllabus Area : Lawful bases for processing personal data
Weight : 5%
Syllabus Area : Data subject rights
Weight : 5%
Syllabus Area : PECR (Privacy and Electronic Communications Regulations)
Weight : 5%
Syllabus Area : AI and the processing of personal data (new)
Weight : 5%
Syllabus Area : International data transfers under EU and UK GDPR
Weight : 2.5%
Syllabus Area : Processing children's personal data
Weight : 2.5%
BCS says the certificate particularly benefits people working in:
data protection and privacy, including DPOs
information governance, risk and compliance
data management
project management
director and senior management roles with data protection responsibilities
Want to strengthen your information security knowledge too? Explore our BCS CISMP practice exam.
The exam has 40 multiple-choice questions, and you have 90 minutes to complete it.
The pass mark is 26 out of 40 (65%).
No. The exam is closed book and supervised, and no materials can be taken into the exam.
The current syllabus is version 9.9, published by BCS in 2026. It was updated to reflect the Data (Use and Access) Act 2025.
Yes. The v9.9 syllabus includes DUAA changes such as recognised legitimate interests, updated subject access requests, automated decision-making and the new complaints framework.
Yes. The v9.9 syllabus includes a new area on AI and the processing of personal data, worth 5% of the exam.
No, it's not mandatory. However, BCS describes the Practitioner certificate as ideal for candidates who already hold the Foundation Certificate in Data Protection.
Yes. The syllabus covers the designation, position and tasks of the DPO under Articles 37 to 39 of the UK GDPR, which makes it well suited to DPOs.
Study anywhere with our portable PDF question bank
Simulate real exam conditions with our online engine
Everything you need to know about the BCS Practitioner Certificate in Data Protection Practice Exam certification
Showing 5 of 20 FAQs
3,570 Students Downloaded this exam
Updated September 22, 2026
Stay current with frequently updated content
We're confident in our materials' quality