The Complete Guide to the IIM CDPO Certification Exam in Nigeria (2026)

The IIM CDPO is Nigeria's NDPC-aligned Certified Data Protection Officer credential, issued by the Institute of Information Management. The exam has 60 questions over 150 minutes and a 70 percent pass threshold, covering the Nigeria Data Protection Act 2023 alongside GDPR and international standards. This guide covers the format, domains, eligibility, cost, and preparation.

This guide walks through the IIM CDPO certification exam end to end: format, domains, eligibility, cost, and preparation.

Search for "CDPO certification" from Nigeria and the results split four ways, none of them written for the credential most Nigerian data protection officers actually need. Course sellers rank. Wrong-credential prep pages rank. One widely-shared page even claims the IIM CDPO is run by the Indian Institute of Management, which it is not. This page is the correction and the reference: what the IIM-Africa CDPO is, who issues it, and exactly what the exam asks of you.

What is the IIM CDPO certification?

The IIM CDPO is the Certified Data Protection Officer credential issued by the Institute of Information Management (IIM), Africa. It certifies that the holder can carry out the duties of a data protection officer under Nigerian law: advising on compliance, running data protection impact assessments, handling breaches, and answering to the regulator.

The credential is built on the Nigeria Data Protection Act 2023 and aligned to GDPR, the Malabo Convention, Convention 108+, and ISO/IEC 27701. That alignment matters. A Nigerian DPO works to the NDPA at home and to GDPR the moment a client processes the data of anyone in the EU. The IIM CDPO is scoped to both.

One clarification settles most of the confusion around the name. The IIM here is the Institute of Information Management, not the Indian Institute of Management. The two share initials and nothing else.

Who issues the CDPO certification in Nigeria?

The Institute of Information Management is Nigeria's National Certification Body for data protection, licensed by the Nigeria Data Protection Commission (NDPC). The NDPC is the regulator established under the NDPA 2023; the IIM is the body it licenses to certify data protection professionals.

This is the single fact that separates the IIM CDPO from every other certification using the same three letters. It is the credential tied to Nigeria's own regulatory framework, issued by the body Nigeria's regulator licenses for that purpose. A DPO role advertised by a Nigerian bank, fintech, or public institution is far more likely to reference this credential than an international one.

Vantrel is a preparation resource for this exam. It is not the certifying body, and it does not issue the credential. The certification comes from the IIM; the exam is scheduled and sat through the IIM. What follows describes that exam.

Is the IIM CDPO the same as the PECB or EU-GDPR CDPO?

No. At least four separate credentials share the CDPO name, and they are not interchangeable.

• The IIM-Africa CDPO is issued by Nigeria's NDPC-licensed national certification body, and is anchored to the NDPA 2023.
• The PECB CDPO is an international certification with its own exam, its own fee, and no specific tie to Nigerian law.
• The EU-GDPR CDPO, offered through international training providers, is oriented to European regulation.
• The IAPP CDPO/FR is a French-market exam and unrelated to the Nigerian context.

Which one a candidate needs depends entirely on the role in front of them. A compliance officer at a Lagos bank and a privacy consultant serving EU clients are not preparing for the same credential. The full breakdown, including where each is recognised and what each costs, is set out in IIM vs PECB vs EU-GDPR: which CDPO a Nigerian DPO actually needs.

What is the IIM CDPO exam format?

The exam is 60 questions over 150 minutes, with a 70 percent pass threshold. The questions combine three formats: scenario-based, single-choice, and multiple-choice. The scenario-based questions are the ones most candidates under-prepare for, because they test applied judgement rather than recall.

A recall question asks what the NDPA says about lawful basis. A scenario question gives you a fact pattern — a processor in another country, a consent form that was never signed, a breach discovered three weeks late — and asks what a DPO should do next. The second kind is where marks are made and lost.

The exam is proctored. Full mechanics, including question types and delivery, are covered in the IIM CDPO exam format explained.

What does the CDPO exam cover?

IIM publishes five domains, labelled D1 to D5, each carrying a different weight:

• D1 — Legal and Regulatory Frameworks (30 percent)
• D2 — Data Protection Principles and Compliance (25 percent)
• D3 — Risk Management and DPIA (20 percent)
• D4 — Incident Response and Data Breaches (15 percent)
• D5 — Governance, Policies and Ethics (10 percent)

Between them they run from the NDPA 2023 foundations through to the operational duties a DPO performs on the job, including data protection impact assessments, breach response, and cross-border transfers as operationalised by the NDPC's General Application and Implementation Directive (GAID) 2025. The domains are not weighted equally, and studying them as though they were is one of the more common preparation errors. D1 carries three times the weight of D5. Candidates who allocate study time in proportion to those weights outperform those who give each domain equal hours. The complete domain-by-domain map is in the CDPO exam domains D1–D5.

How hard is the CDPO exam?

The difficulty does not sit in memorisation. It sits in application. Candidates who know the NDPA well still lose marks when a question asks them to apply it to a messy, realistic situation under time pressure.

The failure points cluster in three places: lawful basis for processing, cross-border transfers, and breach response. These are the areas where the correct answer depends on reading the scenario carefully and choosing between options that are all plausible. Preparation that stops at definitions leaves these exposed. A fuller account of where candidates lose marks, and how to close those gaps, is in how hard the CDPO exam really is.

Who is eligible for the IIM CDPO exam?

The IIM sets three qualifying routes. A candidate meets eligibility through any one of them:

1. Experience — around two years in data protection, compliance, or information security.
2. Accredited training — completion of a DPO training programme accredited by the IIM.
3. Recognised certification — a relevant professional certification the IIM accepts.

Two of these routes are stated by the IIM without a mandatory training course attached. One caveat is worth reading carefully: IIM's certification process overview also lists recognised training as an important step, so a candidate qualifying through experience or an existing certification should confirm with the IIM whether training still applies to their route. Registration is completed through the IIM, after which the candidate schedules the proctored exam. The certificate is valid for one year and renewed through CPD rather than by re-sitting. Eligibility criteria and fees are set by the IIM and can change, so confirm the current requirements before you register. The step-by-step process is in IIM CDPO eligibility and registration.

What is the CDPO pass mark?

The pass mark is 70 percent. Across 60 questions, that leaves a narrow margin. Because a portion of the exam is scenario-based, the threshold rewards applied competence spread across all five domains rather than strength in a few.

This is where cross-domain weakness quietly sinks otherwise strong candidates. A candidate can be excellent on the NDPA foundations and still fall below 70 percent because cross-border transfers and breach response were treated as afterthoughts. What the threshold actually requires, and how scenario questions factor into the score, is set out in the CDPO pass mark and scoring explained.

How much does the CDPO exam cost in Nigeria?

Cost depends on the pathway and on which CDPO credential a candidate chooses. Bundled training-and-exam programmes sit at one end; exam-prep-only routes, where the candidate pays the exam fee and prepares independently, sit at the other. The gap between them is wide, and it is not always about quality.

As of August 2026, IIM's storefront lists the CDPO certification at ₦250,000, though its main certification page directs candidates to confirm the fee by email and notes that changes are communicated in advance. Published figures change, and the fee is set by the IIM rather than by any preparation provider, so confirm the current amount before budgeting. A full, verified comparison across every pathway is in the CDPO exam cost in Nigeria, compared honestly.

How do you prepare for the CDPO exam?

Preparation works when it is domain-weighted: concentrate effort where marks concentrate, and on the applied scenario questions candidates most often fail. Counting hours studied measures effort, not readiness. Tracking readiness per domain measures the thing that decides the result.

That shift — from hours to measured readiness — is the point of preparing against the exam rather than against a textbook. A study plan built around it is set out in how to prepare for the CDPO exam, and you can see the exam's real scenario style through the open-access CDPO mock questions before committing to anything.

How Vantrel prepares candidates for the IIM CDPO

Vantrel is an exam-prep platform for the IIM-Africa CDPO. The question bank is mapped to domains D1 through D5 and written in the exam's scenario-based style. The Signal Engine selects questions adaptively, so time goes to weaker domains rather than to material already mastered. The Vantage Score projects readiness per domain, which means preparation ends when measured readiness is reached rather than when time runs out.

Vantrel does not issue the credential and holds no accredited or official status the IIM has not granted. What it offers is a clear view of where a candidate stands against a 60-question, 70 percent exam before they sit it.

See the CDPO domain-level readiness view → — open access, no card required.

Frequently asked questions

What is the IIM CDPO certification? The IIM CDPO is the Certified Data Protection Officer credential issued by the Institute of Information Management, Nigeria's NDPC-licensed national certification body for data protection. It is anchored to the Nigeria Data Protection Act 2023.

Is the IIM CDPO the same as the Indian Institute of Management? No. The IIM behind the Nigerian CDPO is the Institute of Information Management, not the Indian Institute of Management. The two are unrelated bodies that share initials.

How many questions are on the CDPO exam? The exam has 60 questions, combining scenario-based, single-choice, and multiple-choice formats.

What is the CDPO pass mark? The pass mark is 70 percent across the 60 questions.

Which domains does the CDPO exam cover? Five domains, D1 to D5: Legal and Regulatory Frameworks (30 percent), Data Protection Principles and Compliance (25 percent), Risk Management and DPIA (20 percent), Incident Response and Data Breaches (15 percent), and Governance, Policies and Ethics (10 percent).

Who is eligible to sit the IIM CDPO exam? Eligibility is met through any one of three routes: about two years of relevant experience, completion of IIM-accredited DPO training, or a recognised professional certification the IIM accepts.

Is the IIM CDPO the same as the PECB or EU-GDPR CDPO? No. These are separate, internationally-oriented credentials with different exams, fees, and recognition. Only the IIM-Africa CDPO is issued by Nigeria's national certification body for data protection.

---

Continue through this guide

• IIM CDPO exam format: 60 questions and 70 percent pass, explained
• Which CDPO does a Nigerian DPO actually need: IIM vs PECB vs EU-GDPR
• The CDPO exam domains D1–D5: a complete content map
• How hard is the CDPO exam: difficulty and failure points
• IIM CDPO eligibility and registration: requirements and process
• The CDPO pass mark and scoring: what 70 percent requires
• The NDPA 2023 for the CDPO exam: the law the exam tests
• How to prepare for the CDPO exam: a domain-weighted study plan
• CDPO exam cost in Nigeria: every pathway compared, honestly
• CDPO diagnostic: open-access sample exam questions