GRC and assurance professionals
Governance, risk, compliance and internal-audit professionals building their privacy foundation.
Foundational privacy certification
CPGA
Certified Privacy
Governance Associate
Build your foundation in privacy governance and India’s DPDP framework.
In development — register your interestPaid certification in development. Fees and launch arrangements will be announced when finalised.
Proposed credential by DPCI · In development
From understanding to contribution
Privacy governance starts
with a strong foundation.
CPGA is a foundational privacy competency credential being developed by the Data Privacy Council (DPCI), an initiative of Paryoma Foundation.
Designed for governance, risk and compliance professionals and those entering privacy-related roles, CPGA will assess understanding of privacy principles, India’s DPDP framework, organisational accountability and foundational implementation practices.
Why privacy governance?
Effective privacy governance connects legal obligations with organisational responsibilities, risk decisions, policies, controls and oversight. CPGA is designed to help candidates understand how these elements work together and how they can contribute to responsible personal-data practices.
Its proposed focus combines knowledge with scenario-based judgement: recognising relevant requirements, understanding responsibilities, identifying control gaps and determining when specialist support is needed.
Read the DPDP Act guideWho CPGA is for
For people who contribute
to privacy decisions.
These are intended audiences. Formal eligibility requirements have not been finalised.
Legal, technology and operational teams
People in legal operations, cybersecurity, HR, procurement and data-governance roles who contribute to privacy processes.
Career entrants and students
Students and professionals exploring privacy responsibilities and preparing for further learning.
The foundation framework
Ten proposed competency domains.
Scenarios run throughout the proposed syllabus, connecting knowledge with everyday organisational decisions.
Privacy foundations and statutory roles
Explain core concepts and distinguish Data Principal, Data Fiduciary, Data Processor, Consent Manager and DPO roles.
DPDP framework, commencement and applicability
Identify relevant instruments, distinguish present and future requirements, and recognise scope and conditional exemptions.
Notice, consent and certain legitimate uses
Recognise processing grounds, notice requirements, consent withdrawal and common errors in routine scenarios.
Individual rights, duties and grievance redressal
Understand request handling, nomination, grievance routes and Data Principal responsibilities.
Organisational obligations and data lifecycle
Understand accountability, accuracy, data inventories, retention, erasure and the purpose of implementation evidence.
Children, guardians and additional obligations
Recognise child-data and lawful-guardian considerations, conditional exemptions and the additional framework for notified Significant Data Fiduciaries.
Security safeguards and breach response
Recognise basic safeguards, incident escalation, notification responsibilities and evidence preservation.
Processors, contracts and cross-border processing
Understand processor oversight, contractual controls, data flows and conditional transfer requirements.
Privacy governance and risk management
Understand ownership, policies, risk identification, escalation, management reporting and ethical judgement.
Compliance monitoring, evidence and audit readiness
Distinguish policies from operating evidence, recognise control gaps and understand remediation tracking and assurance boundaries.
This is a proposed syllabus, not a statement that every legal duty applies to every organisation or is already in force. Learning materials will distinguish statutory requirements, commencement and applicability conditions from DPCI-recommended practices. Explore the legal framework and sources
Intended learning outcomes
Know what your learning
is intended to support.
Explain the framework
Use privacy terminology accurately and distinguish the responsibilities of different participants.
Reason through a scenario
Identify the relevant question, recognise an appropriate next step and flag uncertainties for specialist review.
Recognise controls and evidence
Connect a privacy responsibility with a basic process, control or record and identify obvious gaps.
Contribute within your role
Communicate findings, support implementation activity and recognise the limits of an associate-level credential.
Proposed assessment approach
Knowledge, judgement
and a separate certification decision.
Assessment design and administrative arrangements are being developed.
Build your foundation
Study against the published syllabus when available. Preparation options and any eligibility requirements will be explained before applications open.
Apply knowledge to scenarios
The proposed assessment will address foundational knowledge and judgement in defined privacy situations. Question count, format, duration and pass criteria are not yet confirmed.
Meet the published requirements
Credential award will depend on a separate assessment and certification decision. Attending or completing a course will not automatically award CPGA.
DPCI intends to publish assessment, integrity, conflict-management, reasonable-adjustment, review and appeals arrangements before applications open. Renewal and continuing-development requirements remain to be finalised. Training and certification decisions are intended to have distinct responsibilities.
CPGA and CPIP
A foundation. A deeper practice.
Choose the level that fits the capability you want to develop. Both programmes are in development.
CPGA
Certified Privacy Governance Associate
Build foundational privacy knowledge and scenario-based judgement for GRC and privacy-related roles.
In development — register your interest
Explore CPGACPIP
Certified Privacy Implementation Professional
Develop deeper implementation capability through a proposed assessment pathway and practical evidence.
In development — register your interest
Explore CPIP| Dimension | CPGA · Foundation | CPIP · Advanced |
|---|---|---|
| Core question | Can you understand a requirement and recognise an appropriate response? | Can you design, implement and explain a workable response? |
| Intended evidence | Knowledge and judgement in defined scenarios. | Deeper implementation work and supporting evidence. |
| Assessment direction | Proposed knowledge and scenario-based assessment. | Proposed examinations and practical assessment; final arrangements pending. |
CPGA may provide a foundation for further study. It is not currently a stated mandatory prerequisite for CPIP. Entry and award requirements will be published separately for each credential.
CPGA FAQs
Before you express interest.
What is CPGA?
CPGA stands for Certified Privacy Governance Associate. It is a foundational privacy competency credential being developed by DPCI, focused on privacy governance, India’s DPDP framework and scenario-based judgement.
Is CPGA free?
No. CPGA is being developed as a paid certification. Fees have not been finalised. It is separate from any free awareness assessment DPCI may introduce.
Is CPGA open for enrolment?
Not yet. The programme is in development. Online enquiry submissions are also not connected. You can prepare and download an unsent enquiry draft below; it does not register you with DPCI or reserve a place.
What are the eligibility, examination and renewal requirements?
Eligibility, question count, assessment format, duration, pass criteria, examination dates and renewal requirements are not yet finalised. Confirmed arrangements will be published before applications open.
Does course completion automatically award CPGA?
No. Learning participation and certification are distinct. CPGA will require meeting the separately published assessment and certification requirements.
How does CPGA differ from CPIP?
CPGA focuses on foundational privacy governance knowledge and judgement. CPIP is the more advanced proposed credential focused on implementation capability and evidence. CPGA is not currently a stated mandatory prerequisite for CPIP.
Does CPGA authorise legal practice or certify organisational compliance?
No. CPGA is an individual competency credential in development. It does not authorise legal practice, qualify a holder automatically as an independent privacy auditor, certify organisational compliance or guarantee employment. No government approval or accreditation is claimed.
Your next step
Prepare your CPGA enquiry.
Tell us about your professional context and interest in CPGA. Online submissions are not yet open; this form only prepares a local, unsent enquiry draft.
An expression of interest is not an application, admission offer or award of certification.
Online enquiries are not yet open. You can prepare and download your enquiry below; nothing will be sent to DPCI.