Save 15% on 2 packs BUY2 · 20% on 3+ BUY3

Skip to content

Exam guide

How to Pass the IAPP CIPP/US in 2026: Format, Cost, Domains and Study Plan

Guides › Exam guides

Updated 13 Nov 2026 · 6 min read

On this page
  1. What the IAPP CIPP/US is and who it is for
  2. IAPP CIPP/US at a glance
  3. What is on the exam
  4. Why people fail it
  5. A study plan that fits the exam
  6. On exam day
  7. Frequently asked questions
  8. Sources

What the IAPP CIPP/US is and who it is for

The Certified Information Privacy Professional/United States (CIPP/US) is the IAPP's certification for U.S. privacy law. The IAPP says the credential proves you have a strong understanding of U.S. privacy laws and regulations, and its exam also covers the legal requirements for transferring sensitive personal data to and from the United States, the EU and other jurisdictions.

It suits anyone who applies federal and state privacy rules at work, such as privacy, compliance and legal staff and people who run vendor or marketing programmes.

The exam follows the CIPP/US Body of Knowledge version 2.6.1, approved on 3 March 2025 and effective from 1 September 2025. The IAPP reviews each Body of Knowledge every year and announces changes at least 90 days before the new content appears in the exam. We found no later version announced on the CIPP/US page on iapp.org on 27 October 2026, but check the page for the version in force on your exam date.

IAPP CIPP/US at a glance

Item Detail
Exam code CIPP/US
Questions 90 multiple-choice questions, including scenario and case study questions, some with more than one correct answer
Time allowed 2.5 hours, with a 15-minute break halfway
Passing score 300 on a scale of 100 to 500
Exam fee US$550 for members and non-members
Languages English
Where you sit it Pearson VUE, at a test centre or online through OnVUE
Certification valid for Two-year terms: 20 CPE hours per term, plus a US$250 maintenance fee or IAPP membership

What is on the exam

Five domains. The IAPP does not give percentages. Its exam blueprint gives a minimum and maximum number of questions for each domain, which is the best guide to where your time should go. Domain I carries the most questions and Domains V and II come next.

Domain I, The U.S. privacy environment (27 to 33 questions). The legal foundations: the branches of government, sources of law, preemption and private rights of action, and the roles of regulators such as the FTC, FCC, HHS and state attorneys general. It also covers the enforcement framework, including unfair and deceptive practices. The blueprint puts 18 to 22 questions on information management: data mapping, vendor risk, incident response, notices, retention and international transfers shaped by the Schrems decisions and the EU-U.S. Data Privacy Framework.

Domain II, Federal privacy laws (15 to 19 questions). The sector laws. That means the FTC Act and COPPA, then HIPAA and HITECH for healthcare, FCRA, FACTA, Gramm-Leach-Bliley and the Red Flags Rule for finance, FERPA for education, and the telemarketing and marketing laws such as the TCPA, CAN-SPAM and the Video Privacy Protection Act.

Domain III, Government and court access to private-sector information (3 to 5 questions). Small but specific: the Right to Financial Privacy Act, the Bank Secrecy Act, ECPA and CALEA, FISA, the USA PATRIOT Act and electronic discovery in civil litigation.

Domain IV, Workplace privacy (4 to 6 questions). Anti-discrimination laws such as the ADA and GINA, the agencies that enforce them, and privacy issues before, during and after employment, including automated employment decision tools, background checks and employee monitoring.

Domain V, State privacy laws (17 to 21 questions). The CCPA as amended by the CPRA and the other comprehensive state laws, applicability thresholds, exemptions and data subject rights, state health data rules such as Washington's My Health, My Data Act, biometric and facial recognition rules, AI bias laws, cookie and tracking rules, and state breach notification laws.

Why people fail it

The first reason is breadth. The Body of Knowledge names many statutes, each with its own scope, regulator and exemptions. Candidates who know the headline of each law but cannot say which applies to a hospital, a lender, a school or a marketing team lose marks on scenario questions.

The second is state law detail. Domain V carries 17 to 21 questions and asks about applicability (for example, the number of state residents or annual revenue), exemptions, enforcement concepts such as cure periods, and the differences between states. The outline also names specific laws from 2023, so an older textbook edition can leave gaps.

The third is the level of the questions. The IAPP says its questions range from recalling facts to applying and analysing the options to pick the best answer, so knowing what a law says is not enough.

The last is question format. Multi-select questions tell you how many answers to choose. You must select exactly that number of correct options to score, with no partial credit.

A study plan that fits the exam

This seven week plan gives the most time to Domains I, II and V, which carry the bulk of the questions. The IAPP advises planning for a minimum of 30 hours of study. Before week 1, download the Body of Knowledge and study guide from iapp.org, then try the free CIPP/US practice questions to find your starting point.

  1. Week 1, the legal framework: Domain I, sections A and B. Sources of law, preemption, the regulators and the enforcement framework.
  2. Week 2, information management: Domain I, section C. Data inventories, vendor management, incident response, retention, notices and international transfers.
  3. Week 3, FTC and healthcare: the FTC Act, COPPA, HIPAA and HITECH, and the other health sector rules.
  4. Week 4, finance, education and marketing: FCRA, FACTA, GLBA, the Red Flags Rule, FERPA, then the TCPA, CAN-SPAM and the other telecommunications and marketing laws.
  5. Week 5, state privacy laws: the CCPA and CPRA, the other comprehensive state laws, health data, biometric and AI rules, and what differs between states.
  6. Week 6, breach notification, government access and workplace: state breach laws from Domain V, then Domains III and IV, which are small but specific, so learn the list of statutes.
  7. Week 7, timed runs: sit sets of 90 questions in 2.5 hours, review every miss against the Body of Knowledge, and go back to your weakest domain. The CertStash CIPP/US pack has 285 questions with explanations, enough for three full runs.

On exam day

You sit the CIPP/US with Pearson VUE, either at a test centre or online through OnVUE, and you must take it within one year of buying it. For OnVUE, use a personal computer rather than a work device, do not use a VPN, and expect a system check of your microphone, webcam and internet speed. The "Begin" button for check-in appears 30 minutes before your appointment, and you will photograph yourself and a government-issued ID.

The exam splits into two halves, each with half the questions and half the time. Halfway through you are offered a 15-minute break. Whether you take it or not, you must submit the first half before moving on, and you cannot go back to it. That gives you 75 minutes for each set of 45 questions, so review your first half answers before you submit them.

Your result appears on screen as pass or fail with your score on the 100 to 500 scale, and an email explains how to see a breakdown by domain.

Frequently asked questions

Can I retake the CIPP/US if I fail?

Yes. You can buy a new exam once your result appears in your MyIAPP profile. You cannot book a retake for a date earlier than seven days after your previous attempt.

What happens after I pass?

You become certified once you hold IAPP membership or have paid the certification maintenance fee. To keep the certification you need 20 hours of continuing privacy education in each two-year term, plus either the US$250 maintenance fee for the term or IAPP membership at US$295 a year.

Is a 300 the same as 60 percent?

No. The IAPP converts raw scores to a common 100 to 500 scale and states that the 300 pass mark does not represent 60%. It also advises against averaging the section percentages in your score report to work out an overall result.

Is the practice pack enough on its own?

No. It is practice, not a course. The 285 questions show you how scenarios are framed and where your gaps are, but you should also study the statutes, the Body of Knowledge and the textbook that the IAPP study guide calls the authoritative reference for the exam.

Try the free questions first, then get all 285 CIPP/US practice questions with full explanations for US$39, pass or your money back: get the CIPP/US pack.

Sources

The official pages the facts in this guide were checked against.