Exam guide
How to Pass the IAPP CIPM in 2026: Format, Cost, Domains and Study Plan
Updated 10 Nov 2026 · 6 min read
On this page
What the IAPP CIPM is and who it is for
The Certified Information Privacy Manager (CIPM) is the IAPP's certification for running a privacy programme. The IAPP describes the ANAB-accredited designation as saying that you are a leader in privacy program administration, equipped with the knowledge to establish, maintain and manage a privacy program across all stages of its life cycle. Its candidate handbook adds that the CIPM attests to your understanding of how to implement data privacy regulations into day-to-day operations.
It suits people who build, run or support a privacy programme inside an organisation and turn legal requirements into policies, roles, assessments, training and incident handling.
The exam follows the CIPM Body of Knowledge version 4.2.0, which took effect on 1 September 2025 and replaced version 4.1.0. The IAPP reviews it every year and announces changes at least 90 days before new content appears, so check the CIPM page on iapp.org for the version in force on your exam date.
IAPP CIPM at a glance
| Item | Detail |
|---|---|
| Exam code | CIPM |
| Questions | 90 multiple-choice questions, some with more than one correct answer, including scenario questions |
| Time allowed | 2.5 hours, with a 15-minute break halfway |
| Passing score | 300 on a scale of 100 to 500 |
| Exam fee | US$550, the same for members and non-members |
| Languages | English, French, German, Chinese and Brazilian Portuguese |
| Where you sit it | Pearson VUE, at a test centre or online through OnVUE |
| Certification valid for | Two-year terms: 20 hours of continuing professional education per term, plus a US$250 maintenance fee or IAPP membership at US$295 a year |
What is on the exam
Six domains. The IAPP does not give percentages. Its exam blueprint gives a minimum and a maximum number of questions for each domain, so the weights below are ranges of questions out of 90.
Domain I, Privacy program: developing a framework (14 to 18 questions). The foundations. You define the scope of the programme and a privacy strategy, choose a governance model, structure the privacy team and identify stakeholders. You also work out which laws, regulations and standards apply, including the privacy risks posed by the use of AI.
Domain II, Privacy program: establishing program governance (12 to 16 questions). How requirements are implemented across the organisation. It covers policies and processes, plans for breach management, complaints, data subject rights and retention, roles and responsibilities, privacy metrics, audits, and training and awareness.
Domain III, Operational life cycle: assessing data (12 to 16 questions). Finding and reducing privacy risk. You map data inventories and flows, run gap analyses, evaluate processors and vendors, review physical and technical controls, and assess shared data risks in mergers, acquisitions and divestitures.
Domain IV, Operational life cycle: protecting personal data (9 to 13 questions). Controls in use. It covers data classification and access controls, privacy by design in the system development life cycle, and checking that secondary use guidelines and technical controls are followed.
Domain V, Operational life cycle: sustaining program performance (7 to 9 questions). Keeping the programme working. You choose metrics, audit and monitor compliance, and manage continuous assessment, including assessment types such as PIA, DPIA, TIA, LIA and PTA.
Domain VI, Operational life cycle: responding to requests and incidents (10 to 14 questions). Handling data subject requests, following incident procedures from assessment through containment and remediation, keeping an incident register, and running post-incident reviews.
Why people fail it
The first reason is treating it as a memory test. The IAPP says that no question will be on the exam that is not covered by the Body of Knowledge, but it also says exams are not a reflection of your ability to recall the preparation materials, and that you may be asked to apply knowledge to different situations.
The second is uneven preparation. Even the smallest domain has at least 7 questions.
The third is the question format. Some questions have more than one correct answer and say so on the question. The IAPP states that you must select the exact number of correct responses indicated to receive credit, with no partial credit.
The fourth is misreading the score. A passing score of 300 does not represent 60%, and you cannot average your section percentages to find your overall score, because the domains do not hold equal numbers of questions.
A study plan that fits the exam
This seven week plan gives the most time to the domains with the most questions. The IAPP recommends a minimum of 30 hours of study time. Before week 1, read the Body of Knowledge on iapp.org and try the free CIPM practice questions to find your starting point.
- Week 1, Domain I: programme scope, strategy, governance models, team structure, stakeholders, the applicable laws and the privacy risks of AI.
- Week 2, Domain II: policies and processes, breach, complaint and retention plans, roles and responsibilities, metrics, audits and training.
- Week 3, Domain III: data inventories and flows, gap analysis, vendor assessment, physical and technical controls, and mergers and acquisitions.
- Week 4, Domain VI: data subject requests, incident response, the incident register and post-incident reviews.
- Week 5, Domains IV and V: security practices, privacy by design, secondary use, metrics, auditing and the assessment types (PIA, DPIA, TIA, LIA, PTA).
- Week 6, weak areas: redo the sections you missed. The IAPP's section breakdown after a real attempt shows the percentage correct per domain, and you can use the same approach on practice sets.
- Week 7, timed runs: sit sets of 90 questions in 2.5 hours and review every miss against the Body of Knowledge. The CertStash CIPM pack has 361 questions with explanations, enough for several full runs without repeats.
On exam day
You sit the CIPM with Pearson VUE, either at a test centre or remotely through OnVUE. Schedule at least 24 hours in advance and make sure the name in your MyIAPP profile matches your ID. You must schedule and take the exam within one year of purchase, and expired exams are closed with the fee forfeited.
For OnVUE, use a personal computer rather than a work device and do not use a VPN. Check-in opens 30 minutes before your appointment with a system check of your microphone, webcam and internet speed, then photos of yourself and your government-issued ID. At a test centre, the IAPP encourages you to arrive 15 minutes early, and the timer does not stop if you leave the room.
The exam splits into two halves, each with half the questions and half the time, with a 15-minute break offered in the middle. Whether you take it or not, you must submit the first half before moving on and you cannot return to it, so review those answers first. When you finish, the screen shows pass or fail with your score on the 100 to 500 scale, and an email explains how to see the breakdown by section.
Frequently asked questions
Can I retake the CIPM if I fail?
Yes. You buy a new exam once your result appears in your MyIAPP profile. A retake cannot be scheduled for a date sooner than seven days after your previous attempt. You cannot review the questions you got wrong, but the section breakdown shows which domains to revisit.
What happens after I pass?
To make your certification valid you need either IAPP membership or a certification maintenance fee. To keep it, you then need 20 hours of continuing professional education in each two-year term, plus either the US$250 maintenance fee for the term or membership at US$295 a year.
Can I take the CIPM in another language?
Yes. The IAPP offers the exam in French, German, Brazilian Portuguese and Chinese as well as English. The translations used no machine translation, and the Body of Knowledge is available in Chinese, French and German.
Is the practice pack enough on its own?
No. It is practice, not a course. The 361 CIPM questions show you how scenarios are framed and where your gaps are, but you still need to learn the material from the Body of Knowledge and a textbook or course. Use the pack to test what you have learned.
When you are ready to practise at full length, get the complete IAPP CIPM practice pack for US$39, with a pass or money back guarantee.
Sources
The official pages the facts in this guide were checked against.
What people say about this pack
Passed CIPM with the Cert Stash file in Germany. I can confirm that is accurate.
