CIPM and CIPT Guide: Exam, Domains and Renewal

Knowing privacy law is not the same as running a privacy programme or building privacy into a system, and the IAPP's CIPM and CIPT certify those two operational skills. CIPM (Certified Information Privacy Manager) covers privacy programme governance and the operational life cycle; CIPT (Certified Information Privacy Technologist) covers privacy risk and controls in technology, from data collection to privacy engineering. This guide sets out what the IAPP publishes about both: exam format, body of knowledge domains and question ranges, cost, delivery and maintenance, plus a preparation plan and a way to choose. It is written for security engineers, architects, privacy and GRC leads. Facts are from iapp.org, the IAPP store and the IAPP's published PDFs, checked on 24 October 2026; confirm on the linked pages before you book.

Key takeaways

Manager versus technologist. CIPM tests whether you can establish, govern and sustain a privacy programme; CIPT tests whether you can minimise privacy risk in the systems and data flows engineers build.
Same exam mechanics. Both have 90 multiple-choice questions in 2.5 hours with a 15-minute break, are scored on a 100 to 500 scale with 300 to pass, and cost USD 550 for members and non-members.
New bodies of knowledge since September 2025. CIPM is on BoK version 4.2.0 and CIPT on version 4.0.0 (replacing 3.2.0), both effective 1 September 2025; CIPT names AI, dark patterns, LINDDUN and MITRE PANOPTIC.
No experience gate. Neither exam has formal prerequisites; the IAPP recommends at least 30 hours of study per certification.
Same two-year maintenance cycle. 20 CPE per certification per term and a USD 250 maintenance fee per term, covered by IAPP membership; relevant CPE counts across all your IAPP credentials.

Who the certification is for

CIPM: the IAPP describes it as certifying leadership in privacy programme administration across all stages of the operational life cycle. It fits privacy managers, DPO teams, GRC leads and security managers who own privacy controls, metrics and incident handling. See the Privacy Programme Guide for Security Teams.
CIPT: the IAPP says it shows you can use technical solutions to build data protection into products and services, covering privacy-friendly development, controls such as minimisation and encryption, and auditing infrastructure. It fits software, data and security engineers, architects and product owners. See the Privacy by Design Guide for Engineering Teams.
Not a law exam: both refer to legal requirements but do not test a jurisdiction's law in depth. Pair them with a CIPP if you need that; see the CIPP/E and CIPP/US Certification Guide.

Exam format and domains

Format at a glance

Item	CIPM	CIPT
Questions	90 multiple-choice	90 multiple-choice
Time	2.5 hours, with a 15-minute break	2.5 hours, with a 15-minute break
Scoring	Scale of 100 to 500, pass at 300	Scale of 100 to 500, pass at 300
Body of knowledge	Version 4.2.0, effective 1 September 2025	Version 4.0.0, effective 1 September 2025
Exam languages	English, French, German, Brazilian Portuguese, Simplified Chinese	English
Delivery	Pearson VUE test centre or OnVUE remote	Pearson VUE test centre or OnVUE remote
Price (IAPP store)	USD 550	USD 550
Validity of purchase	Schedule and sit within one year	Schedule and sit within one year

According to the candidate handbook (version 5.3.2), questions are multiple choice with one or more correct answers, some built on scenarios, and the break splits the exam into two halves with half the questions and half the time each. OnVUE remote exams must run on a personal computer, not a work-issued device. The IAPP accredits its credentials through ANAB under ISO/IEC 17024:2012, as the CIPM BoK states.

CIPM domains (BoK 4.2.0)

Domain	Questions (min to max)	Competencies
I. Privacy Program: Developing a Framework	14 to 18	Scope and strategy; vision and mission; in-scope laws, regulations and standards
II. Privacy Program: Establishing Program Governance	12 to 16	Policies across the life cycle; roles and responsibilities; privacy metrics for oversight; training and awareness
III. Operational Life Cycle: Assessing Data	12 to 16	Data governance systems; processors and third parties; physical and technical controls; mergers, acquisitions and divestitures
IV. Operational Life Cycle: Protecting Personal Data	9 to 13	Information security practices; Privacy by Design; data use guidelines and enforced technical controls
V. Operational Life Cycle: Sustaining Program Performance	7 to 9	Metrics; auditing; continuous assessment (PIA, DPIA, TIA, LIA, PTA)
VI. Operational Life Cycle: Responding to Requests and Incidents	10 to 14	Data subject access requests and rights (5 to 7); incident handling; evaluating the response plan

CIPT domains (BoK 4.0.0)

Domain	Questions (min to max)	Competencies
I. The privacy technologist's role in the context of the organisation	15 to 19	Legal and technical roles; privacy risk models and frameworks; data ethics
II. Data collection, use, dissemination and destruction	19 to 23	Minimising risk in collection (8 to 10), use and dissemination; anonymisation, pseudonymisation, differential privacy
III. Privacy risk management	17 to 21	Intrusion and decisional interference, including dark patterns; software security; tracking and surveillance; workplace technologies including AI; monitoring risk
IV. Privacy by design	7 to 9	Privacy by design principles; privacy risk in user experiences
V. Privacy engineering and privacy governance	9 to 11	NIST privacy engineering objectives (predictability, manageability, dissociability); managing privacy functions and controls

The CIPT BoK also names analysis models a technologist should recognise: Nissenbaum's contextual integrity, Calo's harm dimensions, FAIR, the FIPPs, the OECD principles, LINDDUN and MITRE PANOPTIC. If your study notes come from the 3.2.0 era, check them against this list. For background on the techniques themselves, see the Privacy-Enhancing Technologies Guide.

Where identity fits

Both bodies of knowledge touch identity directly: CIPM's technical controls and data use guidelines, CIPT's dissociability objective, workplace technologies and tracking. In practice that means access to personal data by service accounts, API keys and AI agents, not just staff. A privacy programme that inventories human access but not machine access to personal data has a blind spot. See the Identity Data Privacy and Consent Guide.

Prerequisites and experience

No formal prerequisite: the candidate handbook sets no general eligibility rules for the core exams.
Useful background for CIPM: exposure to policy writing, vendor assessment, DPIAs and incident response. The exam is scenario-led, so having run a process helps more than memorising definitions.
Useful background for CIPT: familiarity with system design, data pipelines, logging and web tracking technologies. Non-engineers can pass, but should allow extra time for domains II and III.
Activation: passing needs IAPP membership or a prepaid certification maintenance fee before the credential becomes active.
Next step: the Fellow of Information Privacy (FIP) builds on IAPP certifications including CIPM or CIPT, plus three years of privacy-related work (one year with a qualifying information security certification), three peer references and a personal statement. Check the handbook for the exact combination.

Preparation plan

The IAPP recommends at least 30 hours of training and study per certification and offers a body of knowledge, exam blueprint, free study guide with sample questions, training (online, live online, in person) and practice exams; the CIPT page notes its practice exam has 90 questions built from the same BoK.

Baseline: download the BoK and confirm the version (4.2.0 CIPM, 4.0.0 CIPT). Answer the free study guide's sample questions to find weak domains.
Map the BoK to your job: for each competency, note one real artefact you have seen: a privacy policy, a RoPA, a DPIA, a retention schedule, a consent flow. See the Data Mapping and ROPA Guide and the DPIA Guide.
Study by weight: CIPM: framework, governance and assessing data carry up to 50 questions between them. CIPT: data collection, use and dissemination plus risk management carry up to 44.
Practise the life cycle (CIPM): walk a DSAR and an incident end to end. See the DSAR Guide and the Data Breach Notification Checklist.
Threat-model a system (CIPT): run LINDDUN over a feature you know, and list where anonymisation, pseudonymisation or differential privacy would apply.
Timed practice: sit a 90-question practice exam in 2.5 hours; review every miss against its competency.
Book: schedule at least 24 hours ahead. A failed attempt needs a new purchase, and the handbook bars a re-sit sooner than seven days after the last.

Common mistakes: treating CIPM as a law exam; using CIPT notes from before BoK 4.0.0; neglecting metrics and audit (CIPM domain V); and only revising definitions of PETs without knowing when each fits.

Cost, renewal and continuing education

Item	What the IAPP states	Practical note
Exam	USD 550 each, members and non-members	Buying both is USD 1,100 before training
Maintenance fee	USD 250 per two-year term; covered by membership	Buy with the exam if not a member so the credential activates on passing
CPE	20 per certification per two-year term	Relevant credits apply across all IAPP credentials you hold
Adding a second credential	New certification aligns to the first one's term end; full 20 CPE if earned in year one, none that term if earned later	Time the second exam for early in year two
Carryover	Up to 10 CPE, earned in the last six months of the term	Do not front-load conferences
Caps	IAPP training 13; reading 5; non-IAPP training 12; instructing 16	Mix activity types
Audit and shortfall	Monthly random audit; shortfall suspends the credential; still suspended at term end means revocation and a re-sit	Keep evidence for every activity

Figures are from the IAPP CPE policy version 3.3.1, effective 7 April 2026, and the IAPP store exam pages.

Where it fits on the career path

Role or goal	Better first choice	Why
Privacy manager or DPO office	CIPM	Governance, metrics, DSARs and incident handling are the job
Security manager taking on privacy	CIPM	Maps to programme ownership; pairs with the CISM Certification Guide route
Engineer, architect or data scientist	CIPT	Privacy engineering, PETs and risk in system design
Privacy engineer wanting an alternative body	CIPT or CDPSE	Compare in the CDPSE Certification Guide
AI governance work	CIPT, then AIGP	CIPT covers AI in the workplace; see the IAPP AIGP (AI Governance Professional) Guide

A common route is a CIPP for the law, then CIPM or CIPT for the operational skill. Teams often aim for coverage across all three rather than one person holding everything. For measuring where a programme stands, see the Privacy Programme Maturity Model, and for the wider landscape the Cybersecurity Certifications Guide.

Practitioner checklist

Pick by job: programme ownership points to CIPM, system and data design to CIPT.
Confirm the BoK version (4.2.0 CIPM, 4.0.0 CIPT, effective 1 September 2025) before buying study material.
Budget at least 30 hours per certification, weighted by blueprint ranges.
Check language: CIPT was English only on the store page checked.
Buy the maintenance fee with the exam or hold membership so the credential activates.
Use a personal computer for OnVUE and run the system check early.
Plan 20 CPE per term and keep evidence for audit.
Apply one BoK competency per month at work, for example a DPIA, a LINDDUN review or a privacy metric.

CIPM and CIPT Certification Guide: Exam, Requirements and Preparation