- Overview of privacy as a discipline and its importance in modern organizations.
- Key concepts of data protection, including personal data and sensitive information.
- Evolution of privacy laws and their impact on global business practices.
- Role of the CIPP certification in advancing privacy professionalism.
IAPP CIPP exam preparation
IAPP CIPP Certified Information Privacy Professional Certification Training Course
A comprehensive understanding of privacy principles as outlined by the IAPP. Align privacy initiatives with business objectives, manage risks, and navigate organizational compliance requirements.
Course focus: Privacy laws and regulations, data governance, stakeholder engagement, and privacy program management.
Course Overview
Privacy law and program skills for compliance, governance, and data protection.
The IAPP Certified Information Privacy Professional (CIPP) Training Course with Accumentum is designed to provide a comprehensive understanding of privacy principles as outlined by the IAPP. The training begins with an introduction to privacy management, highlighting its critical role in achieving organizational compliance and safeguarding data. Key modules cover privacy laws and regulations, data governance, stakeholder engagement, and privacy program management. Participants will learn to align privacy initiatives with business objectives, manage risks, and navigate organizational compliance requirements.
The course combines interactive lectures, real-world privacy case studies, and group activities to promote practical application of concepts. It also includes exam preparation strategies with mock tests to familiarize learners with the CIPP certification exam format. This thorough approach ensures participants are well-equipped to address the complexities of privacy management in their professional settings.
Course Objectives
What you will be able to do as a privacy professional.
01
Master privacy laws
Equip participants with a comprehensive understanding of privacy laws, regulations, and global frameworks to ensure organizational compliance.
02
Build privacy programs
Develop skills to design and implement effective privacy programs aligned with business objectives and stakeholder needs.
03
Govern data and risk
Provide practical knowledge for managing data governance, risk assessment, and mitigation strategies in diverse professional settings.
04
Prepare for CIPP certification
Prepare participants for the CIPP certification exam through targeted strategies, mock tests, and real-world case studies.
Who Should Attend
- Privacy Professionals: Individuals responsible for managing data privacy, compliance, or governance within their organizations.
- Legal and Compliance Officers: Professionals seeking to deepen their understanding of global privacy laws and regulations.
- Data Protection Officers: Those tasked with overseeing data protection strategies and ensuring regulatory compliance.
- Aspiring Privacy Experts: Individuals preparing for the CIPP certification to advance their careers in privacy management.
Prerequisites
- Basic Understanding of Privacy Concepts: Familiarity with fundamental privacy principles or data protection practices is recommended but not mandatory.
- Professional Experience: At least one year of experience in privacy, compliance, legal, or data governance roles is preferred.
- Interest in Privacy Regulations: A strong interest in learning about global privacy laws and frameworks, such as GDPR or CCPA.
- No Prior Certification Required: No formal certifications are needed, though a background in law, IT, or business is beneficial.
Pathway Map
Ten modules from privacy foundations to cross-border data transfers.
Each module builds the privacy knowledge assessed on the CIPP exam, including global laws, data governance, data subject rights, and incident response.
1
Introduction to Privacy and Data Protection
2
Global Privacy Laws and Frameworks
3
Data Governance and Management
4
Privacy Program Development
5
Risk Assessment and Mitigation
6
Stakeholder Engagement and Communication
7
Data Subject Rights and Obligations
8
Incident Response and Breach Management
9
Cross-Border Data Transfers
10
Exam Preparation and Privacy Case Studies
Course Content
- In-depth study of major privacy regulations, including GDPR, CCPA, and PIPEDA.
- Comparison of regional privacy laws and their jurisdictional applications.
- Emerging privacy legislation and trends in data protection worldwide.
- Practical implications of compliance with international privacy standards.
- Principles of effective data governance frameworks for privacy compliance.
- Strategies for data inventory, classification, and mapping.
- Implementing data retention and deletion policies aligned with regulations.
- Tools and technologies for managing personal data securely.
- Steps to design and implement a comprehensive privacy program.
- Aligning privacy initiatives with organizational goals and stakeholder expectations.
- Establishing policies, procedures, and documentation for compliance.
- Measuring and reporting on privacy program effectiveness.
- Conducting privacy impact assessments (PIAs) and data protection impact assessments (DPIAs).
- Identifying and prioritizing privacy risks within organizational processes.
- Developing risk mitigation strategies to address vulnerabilities.
- Monitoring and auditing privacy risks to ensure ongoing compliance.
- Strategies for engaging internal and external stakeholders on privacy matters.
- Communicating privacy policies and practices to employees and customers.
- Managing privacy-related inquiries and complaints effectively.
- Building a privacy-aware culture within the organization.
- Understanding data subject rights under major privacy regulations (e.g., access, erasure, portability).
- Processes for handling data subject requests in a timely and compliant manner.
- Balancing organizational obligations with data subject expectations.
- Case studies on resolving complex data subject rights scenarios.
- Developing an effective incident response plan for data breaches.
- Legal and regulatory requirements for breach notification and reporting.
- Steps for investigating and mitigating privacy incidents.
- Real-world examples of breach management and lessons learned.
- Legal mechanisms for transferring personal data across jurisdictions (e.g., Standard Contractual Clauses, Binding Corporate Rules).
- Challenges and risks associated with international data flows.
- Compliance with regional restrictions on cross-border data transfers.
- Practical approaches to managing global data transfer requirements.
- Overview of the CIPP certification exam structure and question types.
- Strategies for effective exam preparation, including time management and key focus areas.
- Analysis of real-world privacy case studies to apply learned concepts.
- Practice with mock exams to build confidence and familiarity with the test format.
Course Features
Interactive CIPP exam preparation with Accumentum.
Interactive Learning
Engage with expert instructors and peers through training sessions, discussions, and practical exercises.
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Real-World Applications
Work on real-life case studies and scenarios to apply effective Information Privacy concepts.
Certification Preparation
Receive guidance and tips to successfully pass the IAPP CIPP certification exam.
Certification Exam
Prepare for the official IAPP CIPP exam.
CIPP Exam Readiness
Accumentum CIPP training prepares learners for the IAPP Certified Information Privacy Professional exam.
Upon completing the IAPP Certified Information Privacy Professional (CIPP) Training Course with Accumentum, you will be fully prepared to take the CIPP certification exam. This certification validates your expertise in global privacy laws, data protection principles, and privacy program management, demonstrating your ability to align privacy initiatives with organizational objectives, navigate complex stakeholder requirements, and apply best practices for compliance and risk management. Earning the CIPP certification will significantly advance your career, positioning you for leadership roles in overseeing privacy programs and managing data protection initiatives.
CIPP Concentrations
Which CIPP fits your region?
The IAPP recommends CIPP if you're responsible for legal, compliance, information management, data governance and/or human resources. The CIPP designations "verify your understanding of data protection laws, regulations and standards in your jurisdiction or discipline." There's a concentration for each region: CIPP/A (Asia), CIPP/AU (Australia), CIPP/C (Canada), CIPP/CN (China), CIPP/E (Europe) and CIPP/US (United States). You choose the one that matches where you work.
Most of our students sit CIPP/US or CIPP/E, so we've published both blueprints in full below. If you need CIPP/A, CIPP/AU, CIPP/C or CIPP/CN, talk with us first and we'll point you to the matching IAPP body of knowledge.
Exam Blueprint
What the IAPP says CIPP/US covers.
The IAPP CIPP/US Body of Knowledge and Exam Blueprint (version 2.6.1, effective 1 Sept. 2025) has 5 domains, 16 competencies and 70 performance indicators. The IAPP says no question will be on the exam that isn't covered by the body of knowledge, so we've copied every line below in the IAPP's own wording. The numbers show the minimum and maximum questions the blueprint sets for each area.
Domain I: The U.S. Privacy Environment (27 to 33 questions)
Domain I, The U.S. Privacy Environment identifies the legal concepts necessary for a foundational understanding of U.S. law and its relationship to privacy issues. The domain covers the privacy responsibilities of the major regulatory authorities and their roles in the enforcement framework. It also provides an overview of the principles of information management from a U.S. perspective, including issues of data subject rights, accountability and compliance in regard to domestic data management and international data transfers.
I.A Understand the U.S. legal framework (3 to 5 questions)
- Identify the branches of government and know their roles and functions.
- Understand the various sources of law, including constitutions, legislation, regulations and rules, case law, common law and contract law.
- Know the key concepts involved in analyzing and applying laws, such as scope and application, jurisdiction, preemption, and private right of action.
- Know the roles and functions of, and the documents issued by, major regulatory authorities such as the Federal Trade Commission (FTC), the Federal Communications Commission (FCC), the Department of Commerce (DoC), the Department of Health and Human Services (HHS), banking regulators such as the Federal Reserve Board and the Comptroller of the Currency, state attorneys general and state departments of insurance.
- Understand self-regulatory models
I.B Understand the enforcement framework for U.S. privacy and security laws (5 to 7 questions)
- Know general theories of legal liability (contract, tort, civil enforcement), and understand the differences between criminal and civil liability.
- Understand the concept of fiduciary duty.
- Understand negligence and unfair and deceptive acts and practices (UDAP) laws.
- Understand the purpose of federal and state enforcement actions and enforcement authorities (for example federal agencies, Department of Justice, state attorneys general, the California Privacy Protection Agency (CPPA)).
- Understand cross-border enforcement issues, including the role played by the Global Privacy Enforcement Network (GPEN).
- Understand the principles of self-regulatory enforcement efforts (PCI, Trust Marks).
I.C Understand the principles of information management from a U.S. perspective (18 to 22 questions)
- Know the practices and controls for managing personal information including data inventory, data classification, data flow mapping and data sharing and transfers.
- Know the basics of privacy program development, and understand the roles played by workforce training, vendor risk management, data processing agreements, requirements for cloud computing, third-party data sharing, and incident response programs (for example for cyber threats such as ransomware attacks and vendor incidents).
- Understand the importance of accountability and what ensures due diligence in determining data accountability.
- Know the requirements for managing user preferences, data and records retention and disposal, and the effective use of privacy notices.
- Identify privacy issues unique to the online environment (for example tracking and profiling).
- Understand the common requirements of international data transfers and how these have been shaped by the Schrems decisions.
- Adhere to the principles of accepted international data transfer mechanisms such as Standard Contractual Clauses and the EU-U.S.
- Data Privacy Framework.
- Adhere to key privacy considerations affecting U.S.-based multinational companies (for example GDPR requirements, APEC principles), and understand what is involved in resolving multinational compliance conflicts (for example EU data protection versus e-discovery).
- Understand the ways in which U.S. privacy laws intersect with non-U.S. privacy laws such as the GDPR and FADP.
Domain II: Federal Privacy Laws (15 to 19 questions)
Domain II, Federal Privacy Laws covers the role of the Federal Trade Commission in consumer privacy protection, including the acts and regulations it oversees, and the enforcement actions it has brought regarding privacy infringements. The domain also identifies privacy issues specific to federal sectors (healthcare and medical, finance, education, and telecommunications/marketing), including the major pieces of U.S. privacy legislation governing these sectors.
II.A Understand how the Federal Trade Commission addresses consumer protection in regard to privacy and security (3 to 5 questions)
- Know the major acts and regulations overseen by the FTC, such as the Federal Trade Commission Act and the Children’s Online Privacy Protection Act of 1998 (COPPA).
- Understand the purpose of the FTC’s privacy and security enforcement actions.
- Identify priority areas in future federal enforcement (for example data brokers, IoT, AI, biometrics, unregulated data).
II.B Understand how healthcare and medical privacy is regulated (3 to 5 questions)
- Understand the basics of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the HIPAA privacy rule, the HIPAA security rule, and the use of online tracking technologies by HIPAA-covered entities and business associates.
- Understand how HIPAA was strengthened by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.
- Understand other laws and regulations governing the healthcare/medical sector, such as the 21st Century Cures Act and the Confidentiality of Substance Use Disorder Patient Records Rule (including 42 CFR Part 2).
II.C Understand how financial sector privacy is regulated (3 to 5 questions)
- Understand the requirements of the Fair Credit Reporting Act of 1970 (FCRA) and the Fair and Accurate Credit Transactions Act of 2003 (FACTA).
- Understand the basics of the Financial Services Modernization Act of 1999 (“Gramm-Leach-Bliley”), including the GLBA privacy rule, the GLBA safeguards rule and the various exemptions to these that exist under state laws.
- Know the Red Flags Rule and its role in the detection, prevention and mitigation of identity theft.
- Understand the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.
- Understand the roles and functions of the Consumer Financial Protection Bureau (CFPB).
- Understand the unique privacy issues involved in online banking, such as biometric data use, third-party tracking and data security.
- Understand the privacy issues involved in mergers, acquisitions and divestitures.
II.D Understand how education sector privacy is regulated (1 to 3 questions)
- Know the basics of the Family Educational Rights and Privacy Act of 1974 (FERPA).
- Understand the risks involved in the implementation and use of educational technologies, and the role privacy regulations play in mitigating them.
II.E Understand how privacy is regulated in telecommunications and marketing activities (2 to 4 questions)
- Understand the major rules and acts governing telecommunications and marketing, such as the Telemarketing Sales Rule (TSR) and the Telephone Consumer Protection Act of 1991 (TCPA), Combating the Assault of Non-solicited Pornography and Marketing Act of 2003 (CAN-SPAM), the Junk Fax Prevention Act of 2005 (JFPA), the Telecommunications Act of 1996, the Cable Communications Policy Act of 1984, and the Video Privacy Protection Act of 1988 (VPPA) (including the Amendments Act of 2012 (H.R. 6671)), and the Driver’s Privacy Protection Act.
- Understand the role of the Do-Not-Call registry (DNC) and the Wireless Domain Registry in preventing unsolicited telemarketing calls and messages.
- Understand the privacy implications of digital advertising.
- Understand the privacy issues involved in web scraping activities.
- Understand the role of data ethics in telecommunications and marketing practices.
Domain III: Government and Court Access to Private-sector Information (3 to 5 questions)
Domain III, Government and Court Access to Private-sector Information focuses on privacy issues that emerge in response to subpoenas, court orders or law enforcement requests for private-sector data that includes personal information. It covers the key laws and acts regulating government access to communications, financial records and other sensitive data, and describes the privacy issues involved in civil litigation.
III.A Understand the relationship between law enforcement and privacy issues (1 to 2 questions)
- Understand the laws and acts regulating access to financial data, including the Right to Financial Privacy Act of 1978 and the Bank Secrecy Act of 1970 (BSA).
- Understand the laws and acts regulating access to communications (for example through wiretaps, subpoenas and warrants), such as the Electronic Communications Privacy Act (ECPA) and the Communications Assistance to Law Enforcement Act (CALEA).
III.B Understand the relationship between national security and privacy (1 to 3 questions)
- Understand the basics of the Foreign Intelligence Surveillance Act of 1978, including Amendments Act: Section 702 (2008) and how it governs wiretaps, access to emails and stored records, and national security letters.
- Understand the role of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (or USA-PATRIOT Act) and the USA Freedom Act of 2015.
- Understand the role of the Cybersecurity Information Sharing Act of 2015.
III.C Understand issues regarding civil litigation and privacy (1 to 2 questions)
- Understand the privacy issues involved in the compelled disclosure of media information, and the role played by the Privacy Protection Act of 1980.
- Understand the role of electronic discovery in civil litigation.
Domain IV: Workplace Privacy (4 to 6 questions)
Domain IV, Workplace Privacy focuses on key concepts in workplace privacy in the U.S., the significant laws governing employee rights and the agencies tasked with enforcing them. The domain identifies workplace privacy issues in terms of pre-employment (for example automated employment decision tools and background screening), employment (for example employee monitoring) and post-employment (for example records retention).
IV.A Understand the issues involved in workplace privacy (1 to 3 questions)
- Understand workplace privacy concepts and the laws governing them, including notice, appropriate expectations of privacy and anti-discrimination laws (for example the Civil Rights Act of 1964, Americans with Disabilities Act, and the Genetic Information Nondiscrimination Act (GINA)).
- Understand how workplace privacy in the U.S. is regulated, especially through agencies such as the Federal Trade Commission, the Department of Labor, the Equal Employment Opportunity Commission, the National Labor Relations Board (NLRB) and the Occupational Safety and Health Administration.
IV.B Understand workplace privacy issues that arise before, during and after employment (2 to 4 questions)
- Understand privacy issues related to the period prior to employment, such as automated employment decision tools (and their potential for bias), and employee background checks, including screening methods such as personality and psychological evaluations, polygraph testing, drug and alcohol testing, and social media monitoring, including unionized worker issues related to these practices.
- Understand privacy issues related to employee monitoring, especially as it relates to the use of technologies such as computer usage (including social media), biometrics, location-based services (LBS), wellness programs, mobile computing, email and postal mail, photography, telephony and video.
- Understand employer requirements under the Electronic Communications Privacy Act of 1986 (ECPA).
- Understand privacy issues related to internal investigations (for example employee misconduct), including data collection and handling, the use of third parties, documenting performance issues and balancing the rights of multiple individuals.
- Understand post-employment privacy issues, including those related to termination, transition management, records retention and reference requests.
Domain V: State Privacy Laws (17 to 21 questions)
Domain V, State Privacy Laws focuses on the role of U.S. state privacy laws and their relationship to federal legislation. The domain primarily involves topics common to state data privacy and security laws (for example the observance of data subject rights, the implementation of data protection agreements), and also requires an understanding of the distinguishing characteristics of significant laws and acts in various states (for example California, Virginia, Colorado). Additionally, the domain also covers state laws governing specific areas of focus, such as health data rules, cookie regulations and AI bias laws.
V.A Understand concepts of authority governing state privacy laws (1 to 2 questions)
- Understand the relationship between federal and state authority in state privacy issues, including the roles played by state attorneys general and the California Privacy Protection Agency (CPPA).
V.B Understand the key concepts and principles of state data privacy and security laws (13 to 17 questions)
- Identify the key requirements of data privacy and security laws at the state level, including concepts of applicability (for example number of state residents, annual revenue), available exemptions and data subject rights (for example access, deletion/correction, portability, opt-out, consent and verifiable parental consent).
- Identify the key components and requirements of customer-based documents such as privacy notices.
- Understand common data protection requirements and best practices, including data protection assessments and risk assessments, data retention and destruction, issues involved in the selling and sharing of personal information, and data protection agreements.
- Understand common state data security requirements.
- Understand the purpose and common principles of state health data rules (for example geofencing bans and restrictions), and know the key components of significant recent health data legislation (for example Washington’s My Health, My Data (MHMD) Act (2023), the Nevada Consumer Health Data Privacy Act (SB 370) (2023)), and the privacy class actions based on the Illinois Genetic Privacy Information Act (GIPA 2023).
- Understand basic state enforcement concepts (for example cure periods, penalties for non-compliance).
- Understand state privacy and security laws specific to the online environment, including cookie and online tracking regulations.
- Identify facial recognition use restrictions, and assess the applicability of biometric privacy regulations (including those stipulated by acts and laws in Illinois, Washington, Texas and others).
- Understand the AI bias framework and related documents and laws, including the NAIC AIS Governance Guidelines, the NYC Automated Employment Decision Tool law and other major automated decision-making rules and regulations (for example California, Colorado), and Colorado’s Protecting Consumers from Unfair Discrimination in Insurance Practices law.
- Know the basics of important comprehensive state privacy laws, including the California Consumer Privacy Act (CCPA) (2018) as amended by the California Privacy Rights Act (CPRA) (2020), the California Age-Appropriate Design Code Act (A.B. 2273) (2022), and the Delete Act (SB 362) (2023).
- Know the key provisions of other major state acts and laws that have a significant impact on the U.S. privacy landscape.
V.C Understand the key principles of state data breach notification laws (2 to 4 questions)
- Know the common elements of state data breach notification laws, including the definitions of relevant terms (personal information, security breach), the conditions for notification (who, when, how), and the rights afforded to data subjects (credit monitoring, private right of action).
- Identify key differences between states’ breach notification regulations and practices.
- Know significant developments in state data breach notification laws, such as Pennsylvania SB 696, and the Utah S.B. 127 Cybersecurity Amendments.
Exam Blueprint
The full CIPP/E body of knowledge.
The IAPP CIPP/E Body of Knowledge and Exam Blueprint (version 1.3.3, effective 1 Sept. 2025) has 5 domains, 18 competencies and 62 performance indicators. The IAPP says no question will be on the exam that isn't covered by the body of knowledge, so we've copied every line below in the IAPP's own wording. The numbers show the minimum and maximum questions the blueprint sets for each area.
Domain I: Introduction to European Data Protection (7 to 13 questions)
Domain I, Introduction to European Data Protection focuses on the historical context for modern European privacy law and the GDPR. It highlights human rights laws and early data protection laws and the influence they have had on the development of a harmonized approach to contemporary European data protection. The domain also identifies the European regulatory structure and the institutions involved in defining and maintaining it, as well as the principles and goals of significant European data protection legislation.
I.A Understand the origins and historical context of European data protection laws (1 to 3 questions)
- Know the historical rationale for data protection.
- Know relevant human rights laws and early data protection laws and regulations such as the OECD Guidelines, the Treaty of Lisbon, and Convention 108, and understand the ways in which some of these laws have been updated (for example Convention 108+).
- Understand how the need for a harmonized European approach to data protection developed, and know the challenges involved in implementing this approach (for example Brexit).
I.B Understand the roles and functions of significant European Union institutions (1 to 2 questions)
- Know the roles and functions of the European Union institutions such as the Council of Europe, the European Court of Human Rights, European Parliament, the European Commission, the European Council and the Court of Justice of the European Union.
I.C Understand the legislative framework underpinning the principles of European data protection (5 to 8 questions)
- Understand early pieces of data protection legislation, such as the Council of Europe Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data of 1981 (the CoE Convention), the EU Data Protection Directive (95/46/EC), the EU Directive on Privacy and Electronic Communications (2002/58/EC) (ePrivacy Directive), as amended, and the EU Directive on Electronic Commerce (2000/31/EC).
- Understand the main principles and goals of significant data protection legislation, such as the General Data Protection Regulation (GDPR) (EU) 2016/679 and related legislation, the NIS/NIS 2 Directives, and the EU Artificial Intelligence Act.
Domain II: European Data Protection Law and Regulation (18 to 28 questions)
Domain II, European Data Protection Law and Regulation covers key data protection concepts and the requirements for maintaining security for the protection of personal data. The domain includes topics that highlight the importance of following the principles of European data protection laws and complying with the rights of data subjects.
II.A Understand basic GDPR data protection concepts (3 to 5 questions)
- Know the concepts of personal data, sensitive personal data, and special categories of personal data.
- Understand the concepts of pseudonymous and anonymous data and the differences between them.
- Know the key principles of lawful processing.
- Know the concepts of controller and processor, and understand European Data Protection Board guidelines and opinions on the subject.
- Understand the concept of data subject.
II.B Understand the requirements involved in maintaining the security of personal data (7 to 11 questions)
- Understand what appropriate technical and organizational measures are (for example protection mechanisms such as encryption and access controls) and how they should be defined.
- Know what is required for breach notification (for example risk reporting requirements), and understand EDPB guidelines and opinions on the subject.
- Understand the principles of effective and responsible vendor management.
- Know the key principles and requirements of sharing personal data with third parties.
II.C Understand data subjects’ rights (8 to 12 questions)
- Understand the right of access, including EDPB guidelines and opinions on the subject.
- Understand the right of rectification.
- Understand the right of erasure/the right to be forgotten (RTBF), including EDPB guidelines and opinions on the subject.
- Understand the rights of restriction and objection.
- Understand the concept of consent, including the right of withdrawal.
- Understand the rights related to automated decision-making, including profiling.
- Understand the right of data portability.
- Know the restrictions on data subjects’ rights and understand the principles regarding them set forth by EDPB guidelines.
Domain III: European Data Processing (13 to 21 questions)
Domain III, European Data Processing covers key GDPR-based data processing concepts and highlights the importance of adhering to lawful processing criteria. The domain requires an understanding of the principles of international data transfers, and how they must be conducted through legitimate mechanisms in accordance with current regulations and fundamental Court of Justice of the European Union case law.
III.A Understand the principles of European data processing (2 to 4 questions)
- Understand the data processing concepts of fairness and lawfulness, purpose limitation, proportionality, accuracy, storage limitation (retention), and integrity and confidentiality.
III.B Know what constitutes a lawful processing basis (3 to 5 questions)
- Understand lawful processing bases (consent, contractual necessity, legal obligation/vital interests/ public interest and legitimate interest), including European Data Protection Board guidelines and opinions on the subject.
- Understand processing of special categories of personal data.
III.C Understand information provision obligations (4 to 6 questions)
- Understand the transparency principle.
- Know the key components of privacy notices.
- Understand the purpose of layered privacy notices.
III.D Understand the principles of, and the risks involved in, international data transfers (4 to 6 questions)
- Understand the rationale for prohibiting transfers, including EDPB guidelines and opinions on the subject.
- Know the concept of adequate jurisdiction.
- Understand the historical importance of Safe Harbor and Privacy Shield (including the implications of the Schrems decisions regarding them) and know the basics of the EU-US Data Privacy Framework.
- Understand the content, purpose and use of Standard Contractual Clauses and Binding Corporate Rules (BCRs).
- Understand the role of codes of conduct and certifications, including EDPB guidelines and opinions on the subject.
- Understand the rationale for, and role of, derogations, including EDPB guidelines and opinions on the subject.
- Understand the goal of transfer impact assessments (TIAs), including EDPB guidelines and opinions on the subject.
Domain IV: European Data Protection: Scope and Accountability (8 to 18 questions)
Domain IV, European Data Protection: Scope and Accountability focuses on rules of supervision and enforcement, outlining the obligations of data processors and the legal consequences for GDPR violations. The domain requires an understanding of how to implement the data protection measures necessary for assessing and mitigating various privacy risks while complying with applicable laws.
IV.A Understand issues related to the territorial and material scope of the GDPR (2 to 4 questions)
- Understand what constitutes establishment and non-establishment in the EU, including European Data Protection Board guidelines and opinions on the subject.
- Understand the GDPR’s scope of processing, as well as the exemptions it allows.
IV.B Understand the various accountability requirements under the GDPR (4 to 8 questions)
- Understand the accountability requirements of controllers, joint controllers and processors, including those related to data protection by design and by default.
- Understand the importance of documentation and cooperation with regulators.
- Understand the role of data protection impact assessments (DPIAs) and know the established criteria for conducting them.
- Understand the requirement for mandatory data protection officers Understand the role that auditing plays in privacy programs.
IV.C Understand the European data protection supervision and enforcement structure (1 to 3 questions)
- Understand the roles and powers of the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS).
- Understand the roles and powers of other supervisory authorities.
- Understand the concept of lead supervisory authority, including EDPB guidelines and opinions on the subject.
IV.D Understand the consequences for GDPR violations (1 to 3 questions)
- Know the procedures related to GDPR violations, and the fines that may be imposed as a result of infringements.
- Understand the conditions under which class actions involving GDPR violations may be filed.
- Understand the types and amounts of compensation due to data subjects stemming from GDPR violations.
Domain V: Compliance with European Data Protection Law and Regulation (8 to 16 questions)
Domain V, Compliance with European Data Protection Law and Regulation focuses on compliance issues involving the handling of personal data in the areas of employment, surveillance, direct marketing and technology, stressing the unique data protection challenges posed by each.
V.A Understand how to comply with European data protection laws and regulations in the workplace, specifically as they relate to employment relationships (3 to 5 questions)
- Know the legal basis for processing employee data, the issues related to the storage of personnel records and the risks involved in handling employee data.
- Understand the role of, and the risks involved in, workplace monitoring and data loss prevention.
- Understand the pros and cons of bring your own device (BYOD) programs.
- Understand the role of EU Works Councils and whistleblowing systems.
V.B Understand how to comply with European data protection laws and regulations related to surveillance activities (1 to 3 questions)
- Understand the compliance issues related to surveillance conducted by public authorities.
- Understand the laws regarding the interception of communications.
- Understand the compliance issues related to technologies such as closed-circuit television (CCTV), geolocation and biometrics/facial recognition, and know European Data Protection Board guidelines and opinions on the subject.
V.C Understand how to comply with European data protection laws and regulations related to direct marketing (2 to 4 questions)
- Understand the compliance issues and requirements related to the processing of personal data for marketing activities.
- Understand the compliance issues related to online behavioral targeting, including EDPB guidelines and opinions on the subject.
V.D Understand how to comply with European data protection laws and regulations related to internet technology and communications (2 to 4 questions)
- Understand the compliance issues related to cloud computing.
- Understand the compliance issues related to the use of web cookies.
- Understand the compliance issues related to social media platforms (for example the use of dark patterns), and know EDPB guidelines and opinions on the subject.
- Understand the compliance issues related to search engine marketing (SEM).
- Understand the compliance issues and ethical issues related to artificial intelligence (AI), including machine learning.
Who It Is For
Who gets the most out of CIPP.
Pick the concentration for the laws you work with day to day. U.S. counsel, compliance staff and HR teams usually start with CIPP/US. Anyone handling GDPR work starts with CIPP/E.
Holding a CIPP plus an AIGP, CIPM or CIPT is also one step toward the IAPP's Fellow of Information Privacy designation, which also asks for three years of work experience where privacy is at least half the job, three peer references and a personal statement.
Exam Format
CIPP at a glance.
Exam details
- Questions: 90
- Time: 2.5 hours
- Question types: multiple choice, and some are scenario-based
- Multi-select items tell you exactly how many responses to pick, with no partial credit
- Delivery: Pearson VUE test centers or OnVUE online proctoring
- Score scale: 100 to 500, with 300 or above to pass
- Results: shown on screen right after the exam, with a section breakdown by domain
- Purchase window: schedule and take the exam within one year of buying it
The IAPP says scores are based only on the total number of scored questions you answer correctly. There's no weighting and no minimum per section. The cut score comes out of beta testing and psychometric review, and it's set to 300 on the scale. The IAPP is clear that 300 doesn't represent 60%.
Your section breakdown shows the percentage you got right in each blueprint domain. You can't average those to get a total, because the domains don't carry the same number of questions. The IAPP also won't show you which questions you missed.
Language note from the IAPP: the CIPP/E and CIPM exams are available in French and German, and CIPM is also offered in Chinese and Brazilian Portuguese.
The IAPP says the CIPP/E, CIPP/US credentials are accredited by the ANSI National Accreditation Board under ISO standard 17024:2012.
Study Plan
How we prepare you for CIPP.
The IAPP tells candidates to plan for at least 30 hours of study, even if you've passed other certification exams. Here's how we spread that time across the blueprint.
We start with Domain I, The U.S. Privacy Environment. The blueprint sets 27 to 33 questions here across 3 competencies, so we work each performance indicator with a short scenario.
Next we cover Domain II, Federal Privacy Laws. The blueprint sets 15 to 19 questions here across 5 competencies, so we work each performance indicator with a short scenario.
Then we move to Domain III, Government and Court Access to Private-sector Information. The blueprint sets 3 to 5 questions here across 3 competencies, so we work each performance indicator with a short scenario.
After that comes Domain IV, Workplace Privacy. The blueprint sets 4 to 6 questions here across 2 competencies, so we work each performance indicator with a short scenario.
We wrap up with Domain V, State Privacy Laws. The blueprint sets 17 to 21 questions here across 3 competencies, so we work each performance indicator with a short scenario.
Domain I has the highest question range, so it gets the most review time. In the last week we run timed practice at the real pace, review your weakest domains, then reread the body of knowledge line by line. The IAPP says the body of knowledge should be your core resource.
Exam Policies
What to know before you book CIPP.
You buy the exam in the IAPP store, then schedule through your MyIAPP profile with Pearson VUE. Schedule at least 24 hours ahead. Before you book, make sure the name in MyIAPP matches your government-issued ID exactly.
Test center appointments can be rescheduled or canceled up to 48 hours ahead. OnVUE appointments can be changed up to 15 minutes past the scheduled start. A missed appointment counts as a no-show and uses up the attempt.
OnVUE exams have to run on a personal computer, not a work device, with no VPN and no external monitors. You get a scheduled 15-minute break. Leaving the webcam view at any other time gets the exam revoked.
If you don't pass, you can buy a new exam once your result shows in MyIAPP, and you can't book a date sooner than seven days after your last attempt. The IAPP offers a discounted retake price. Accommodations such as extra time start with the IAPP's Special Testing Accommodation Request Form, which a licensed health care provider completes in part.
Passing isn't the last step. To activate and keep the credential, you meet the IAPP's CPE requirements and either pay the certification maintenance fee of USD250 for a certification term or hold IAPP membership at USD295 a year.
Career Outlook
Where CIPP can take you.
CIPP is common among privacy analysts, compliance specialists and counsel who need to show they know the law. BLS doesn't track privacy roles on their own, so we use the closest technology occupation as a reference.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you have been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for CIPP training.
Paying on your own? CIPP prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page lists every other way to pay, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
CIPP with Accumentum and IAPP: audience, prerequisites, delivery, and enrollment.
The IAPP Certified Information Privacy Professional (CIPP) validates expertise in global privacy laws, data protection principles, and privacy program management.
Privacy Professionals: Individuals responsible for managing data privacy, compliance, or governance within their organizations. Legal and Compliance Officers: Professionals seeking to deepen their understanding of global privacy laws and regulations. Data Protection Officers: Those tasked with overseeing data protection strategies and ensuring regulatory compliance. Aspiring Privacy Experts: Individuals preparing for the CIPP certification to advance their careers in privacy management.
Basic Understanding of Privacy Concepts: Familiarity with fundamental privacy principles or data protection practices is recommended but not mandatory. Professional Experience: At least one year of experience in privacy, compliance, legal, or data governance roles is preferred. Interest in Privacy Regulations: A strong interest in learning about global privacy laws and frameworks, such as GDPR or CCPA. No Prior Certification Required: No formal certifications are needed, though a background in law, IT, or business is beneficial.
Ten modules: privacy and data protection, global privacy laws, data governance, privacy program development, risk assessment, stakeholder engagement, data subject rights, incident response, cross-border data transfers, and exam-ready case studies.
Interactive lectures, real-world privacy case studies, group activities, and exam preparation with mock tests.
Earning CIPP positions you for leadership roles in overseeing privacy programs and managing data protection initiatives.
Not through us right now. Accumentum is an Army CA and Air Force COOL Approved Vendor for courses from AWS, Cisco, CompTIA, EC-Council, HRCI, ISACA, ISC2, Microsoft, PMI and SHRM. IAPP courses aren't part of that approval. PathPay can spread the cost into monthly payments. It's a payment plan, not a loan.
Register through Accumentum's registration page. Select Certified Information Privacy Professional (CIPP) Training, your funding option, and how you discovered Accumentum.
The IAPP lists 90 questions with 2.5 hours to finish. Some are scenario-based, and multi-select items tell you how many answers to pick.
300 or higher on the IAPP's 100 to 500 scale. The IAPP notes that 300 doesn't equal 60%.
You can buy a new exam once your result posts in MyIAPP, and you can't schedule sooner than seven days after your last attempt. Retakes get a discounted price.
Yes. Test center appointments can be changed up to 48 hours ahead, and OnVUE appointments up to 15 minutes past the start time. You still need to test within one year of purchase.
Meet the IAPP CPE requirements and either pay the USD250 certification maintenance fee for a term or keep an IAPP membership at USD295 a year.
The IAPP recommends at least 30 hours of study time, even for people who have passed other certification exams.
Yes. CIPP prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee, and longer terms add 5% to 15%.
Enrollment
Enroll in CIPP Certification Training with Accumentum.
Enroll in the IAPP Certified Information Privacy Professional (CIPP) Training Course with Accumentum to advance your privacy management expertise and earn a globally recognized credential. This course is your gateway to becoming a certified privacy professional aligned with IAPP standards. For detailed information and to secure your spot, visit Accumentum's registration page linked below.
Start CIPP and build privacy professional expertise.
IAPP Certified Information Privacy Professional training for privacy professionals, legal and compliance officers, and data protection officers.