CIPP/E and CIPP/US Guide: Exam, Domains and Renewal

Security and privacy teams increasingly need people who can read a law and turn it into a control, and the IAPP's CIPP/E and CIPP/US are the two most common ways to prove that knowledge for Europe and the United States. This guide sets out what the IAPP publishes about both credentials: the exam format, the body of knowledge domains and their question ranges, cost, delivery, and the two-year maintenance cycle. It adds a preparation plan, a way to choose between the two, and where they sit next to security and privacy management certifications. It is written for security practitioners, privacy analysts, lawyers and GRC staff. All facts are from iapp.org pages, the IAPP store and the IAPP's published PDFs, checked on 24 October 2026; the IAPP updates its bodies of knowledge and fees, so confirm on the linked pages before you book.

Key takeaways

Same format, different law. Both exams have 90 multiple-choice questions in 2.5 hours with a 15-minute break, are scored on a 100 to 500 scale with 300 to pass, and cost USD 550 for members and non-members alike.
Current bodies of knowledge date from September 2025. CIPP/E is on BoK version 1.3.3 and CIPP/US on version 2.6.1, both effective 1 September 2025; study material older than that may miss topics such as NIS2, the EU AI Act or newer US state laws.
The weight is in different places. CIPP/E puts the most questions on GDPR concepts, security and data subject rights; CIPP/US puts the most on the US privacy environment and information management, then on state and federal laws.
No experience gate. The IAPP sets no general prerequisites for these exams and recommends at least 30 hours of training and study per certification.
Maintenance is 20 CPE and a fee every two years. Each certification needs 20 continuing privacy education credits per two-year term and a USD 250 certification maintenance fee, which IAPP membership covers.

Who the certification is for

CIPP stands for Certified Information Privacy Professional. It is a family of jurisdiction-specific credentials (the IAPP also offers CIPP/A, CIPP/C and CIPP/CN); this guide covers the European and US variants. Both are ANAB-accredited according to the IAPP's certification pages.

CIPP/E: the IAPP describes it as proving an understanding of pan-European and national data protection laws, key privacy terminology and practical concepts for protecting personal data and trans-border data flows. It suits anyone handling personal data of people in the EU or EEA, including UK teams, since the UK regime is derived from the GDPR. See the GDPR Compliance Guide for Security Teams and the UK GDPR and Data Protection Act 2018 Guide.
CIPP/US: covers US privacy laws and regulations, and the legal requirements for transferring personal data to and from the United States, the EU and other jurisdictions. It suits teams working under US sectoral federal law and the growing set of state privacy laws. See the US State Privacy Laws Guide.
Security practitioners: CISOs, security architects and incident responders who keep being asked "is this a notifiable breach?" or "can we log this?" gain a working legal vocabulary. The CIPP tests law, not controls, so it complements rather than replaces a security credential.
Weaker fit: engineers who build privacy controls into systems, and managers who run a privacy programme, may get more from the CIPM and CIPT Certification Guide track.

Exam format and domains

Format at a glance

Item	CIPP/E	CIPP/US
Questions	90 multiple-choice	90 multiple-choice
Time	2.5 hours, with a 15-minute break	2.5 hours, with a 15-minute break
Scoring	Scale of 100 to 500, pass at 300	Scale of 100 to 500, pass at 300
Body of knowledge	Version 1.3.3, effective 1 September 2025	Version 2.6.1, effective 1 September 2025
Exam languages	English, French, German	English
Delivery	Pearson VUE test centre or OnVUE remote	Pearson VUE test centre or OnVUE remote
Price (IAPP store)	USD 550	USD 550
Validity of purchase	Schedule and sit within one year	Schedule and sit within one year

The candidate handbook (version 5.3.2) says questions are multiple choice with one or more correct answers, some built around a scenario, and that the break falls halfway, splitting the exam into two halves with half the questions and half the time each. The store pages describe the break slightly differently ("including" for CIPP/E, "plus" for CIPP/US), so check your booking confirmation for exact timing. Remote OnVUE exams must be taken on a personal computer, not a work-issued device.

CIPP/E domains (BoK 1.3.3)

Domain	Questions (min to max)	What it covers
I. Introduction to European Data Protection	7 to 13	Origins of European data protection, EU institutions, the legislative framework (Convention 108 and 108+, Directive 95/46/EC, ePrivacy Directive 2002/58/EC, NIS and NIS2, the EU AI Act)
II. European Data Protection Law and Regulation	18 to 28	GDPR concepts, security of personal data (7 to 11 questions), data subject rights (8 to 12 questions)
III. European Data Processing	13 to 21	Processing principles, lawful bases, information provision, international transfers including Schrems, Privacy Shield and the EU-US Data Privacy Framework
IV. Scope and Accountability	8 to 18	Territorial and material scope, accountability requirements, supervision and enforcement, consequences of violations
V. Compliance with European Data Protection Law	8 to 16	Workplace, surveillance, direct marketing, internet technology and communications

CIPP/US domains (BoK 2.6.1)

Domain	Questions (min to max)	What it covers
I. The U.S. Privacy Environment	27 to 33	US legal and enforcement framework; principles of information management (18 to 22 questions on their own)
II. Federal Privacy Laws	15 to 19	FTC Act, HIPAA and HITECH, GLBA, FCRA and FACTA, FERPA, COPPA, TCPA, CAN-SPAM, Telemarketing Sales Rule
III. Government and Court Access to Private-sector Information	3 to 5	Law enforcement (ECPA, CALEA), national security (FISA including Section 702, USA PATRIOT and USA Freedom Acts), civil litigation
IV. Workplace Privacy	4 to 6	Privacy before, during and after employment
V. State Privacy Laws	17 to 21	CCPA as amended by CPRA, the California Delete Act, Washington My Health My Data, biometric laws (Illinois, Washington, Texas), state breach notification laws

Use the blueprint as a revision budget. In CIPP/E, domain II alone can carry up to 28 questions, so GDPR security obligations (Art. 32 to 34) and rights (Art. 12 to 22) deserve the most hours. In CIPP/US, the information management competency (18 to 22 questions) outweighs the government access and workplace domains combined (7 to 11). Where identity work meets privacy, for example access logging, consent records and identity data minimisation, see the Identity Data Privacy and Consent Guide.

Prerequisites and experience

No formal prerequisite: the candidate handbook sets no general eligibility requirements for the core exams. Anyone can buy and sit them.
Useful background: some exposure to handling personal data, contracts or incident response makes the scenario questions easier. Lawyers usually find the doctrine easier and the technical security items harder; security staff the reverse.
Activation needs membership or a fee: passing does not by itself make you certified. The handbook and store pages say an IAPP membership or a prepaid certification maintenance fee (CMF) is needed for the certification to become active.
Going further: the Fellow of Information Privacy (FIP) builds on IAPP certifications and, per the handbook, adds three years of privacy-related work experience (one year with a qualifying information security certification), three peer references and a personal statement. Check the handbook for the exact certification combination required.

Preparation plan

The IAPP recommends a minimum of 30 hours of training and study per certification, and points candidates to the body of knowledge, the exam blueprint, a free study guide with sample questions, its own training (online, live online or in person) and paid practice exams. A workable eight-week plan for a working practitioner:

Week 1, baseline: download the current BoK and blueprint for your exam and confirm the version (1.3.3 for CIPP/E, 2.6.1 for CIPP/US). Request the free study guide and answer its sample questions cold to find your weak domains.
Weeks 2 to 4, core law: CIPP/E: read the GDPR text itself, chapters I to V, alongside your textbook. CIPP/US: build a one-page sheet per federal law (scope, regulator, key obligation, penalty).
Week 5, the heavy domains: CIPP/E: transfers (adequacy, SCCs, BCRs, derogations) and lawful bases. CIPP/US: state laws, including breach notification triggers. See the Data Breach Notification Checklist.
Week 6, applied scenarios: walk real processes at work through the law, for example a DSAR or a vendor onboarding. See the DSAR Guide and the DPIA Guide.
Week 7, timed practice: sit a full 90-question practice exam in 2.5 hours, then review every wrong answer against the BoK competency it maps to.
Week 8, book and close gaps: schedule at least 24 hours ahead (in-person exams can be moved up to 48 hours before). If you fail, the handbook says you can buy a new exam once results appear, and sit no sooner than seven days after the previous attempt.

Common mistakes: studying from pre-September 2025 material; learning GDPR articles by number but not the scenario logic; underweighting CIPP/US state law; and forgetting that a remote exam on a locked-down work laptop can fail the OnVUE system check.

Cost, renewal and continuing education

Item	What the IAPP states	Practical note
Exam	USD 550, same for members and non-members	Each attempt is a new purchase
Certification maintenance fee	USD 250 per two-year term; covered by IAPP membership	Non-members are encouraged to buy it with the exam so the credential activates on passing
CPE	20 hours per certification per two-year term	Credits can apply to every IAPP credential you hold where relevant
Carryover	Up to 10 CPE, only if earned in the last six months of the term	Plan conference attendance near term end
Caps	For example IAPP training up to 13, reading up to 5 (1 per 40 pages or 10,000 words), non-IAPP training up to 12	Mix activity types; reading alone cannot renew you
Audit	Monthly random audit; 30 days to supply further documentation	Keep certificates of attendance; submitting CPE for activities not done means permanent revocation
Shortfall	Certification suspended; deficit is earned in the next term on top of its 20	Still suspended at term end means revocation and a re-sit

A term starts when you pass and the CMF is paid (or membership is active), and ends on the last day of the month two years later. If you add CIPP/US to an existing CIPP/E, the CPE policy (version 3.3.1, effective 7 April 2026) aligns the new certification to the first one's end date; earned in the first year of that term, it needs the full 20 CPE, earned later, none until the next term.

Where it fits on the career path

If you are	Start with	Then consider
Security practitioner in a UK or EU organisation	CIPP/E	CIPM and CIPT Certification Guide, or CDPSE Certification Guide for privacy engineering
Security or GRC lead in a US business	CIPP/US	CIPM for programme ownership; CISM Certification Guide for security management
Global or multinational team	Both CIPP/E and CIPP/US	CIPM to run the programme across jurisdictions
Working on AI systems	CIPP for your jurisdiction	IAPP AIGP (AI Governance Professional) Guide; see the AI and Privacy Guide

The common pairing is one CIPP for the law plus CIPM for the programme, and the FIP described above builds on such combinations plus experience. For security staff, a CIPP next to a security credential such as the CISSP (see the CISSP Certification Guide) signals that you can speak to both the CISO and the DPO. For the wider landscape, see the Cybersecurity Certifications Guide.

Practitioner checklist

Decide which jurisdiction drives your work: EU/UK data subjects point to CIPP/E, US sectoral and state law to CIPP/US.
Download the current BoK and confirm version 1.3.3 (CIPP/E) or 2.6.1 (CIPP/US) before buying study material.
Budget at least 30 hours of study, weighted by the blueprint's question ranges.
Buy the exam only when you can sit within a year; unused purchases expire and fees are forfeited.
Buy the CMF with the exam, or hold membership, so the credential activates on passing.
For OnVUE, use a personal computer and run the system check in advance.
Track 20 CPE per term per certification, with evidence, and time surplus CPE for the last six months.
Apply the law at work: map a DSAR, transfer or breach process to the relevant articles or statutes.

CIPP/E and CIPP/US Certification Guide: Exam, Requirements and Preparation