2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

How to Pass the IAPP CIPP/E in 2026: Format, Cost, Domains and Study Plan

IAPP CIPP/E: 90 questions in 2.5 hours, US$550, a pass mark of 300 on a 100 to 500 scale, five European data protection domains and a seven week plan.

Guides › Exam guides

Updated 4 Nov 2026 · 6 min read

On this page
  1. What the IAPP CIPP/E is and who it is for
  2. IAPP CIPP/E at a glance
  3. What is on the exam
  4. Why people fail it
  5. A study plan that fits the exam
  6. On exam day
  7. Frequently asked questions
  8. Sources

What the IAPP CIPP/E is and who it is for

The Certified Information Privacy Professional/Europe (CIPP/E) is the IAPP's certification for European data protection law. The IAPP says it proves you understand pan-European and national data protection laws, key privacy terminology, and the practical concepts of protecting personal data and trans-border data flows. It is accredited by ANAB under the ISO 17024:2012 standard.

It is relevant to anyone whose work involves handling personal data under European law, whether in a legal, compliance, privacy, security or marketing role.

The exam follows the CIPP/E Body of Knowledge version 1.3.3, which took effect on 1 September 2025. The IAPP updates its exams every year, changing roughly 10% to 15% of the content, and announces each update at least 90 days before it applies. Check the CIPP/E page on iapp.org for the version in force on your exam date.

IAPP CIPP/E at a glance

Item Detail
Exam code CIPP/E
Questions 90 multiple-choice questions, some with more than one correct answer, including scenario questions
Time allowed 2.5 hours, with an optional 15-minute break halfway
Passing score 300 on a scale of 100 to 500
Exam fee US$550, with a discounted price for retakes and for holders of another IAPP certification
Languages English, French and German
Where you sit it Pearson VUE, at a test centre or online through OnVUE
Certification valid for Two-year terms: 20 CPE hours per term, plus a US$250 maintenance fee or IAPP membership

What is on the exam

Five domains. The IAPP gives a minimum and maximum number of questions for each, not a percentage. Domain II carries the most questions and Domain III the next most.

Introduction to European data protection (7 to 13 questions). The history behind modern European privacy law: human rights law, the OECD Guidelines, Convention 108 and 108+, the Treaty of Lisbon, and the push for a harmonised approach, including challenges such as Brexit. It covers the roles of the EU institutions and the Council of Europe, the earlier directives (95/46/EC, the ePrivacy Directive and the E-Commerce Directive), and the goals of the GDPR and related law such as the NIS and NIS 2 Directives and the EU AI Act.

European data protection law and regulation (18 to 28 questions). The core GDPR concepts: personal data, special categories, pseudonymous against anonymous data, controller, processor and data subject. Security of processing, breach notification, vendor management and sharing data with third parties. Then every data subject right: access, rectification, erasure, restriction, objection, consent and its withdrawal, automated decision-making and profiling, portability, and the limits on those rights.

European data processing (13 to 21 questions). The processing principles, the lawful bases and special category data, transparency and privacy notices. A large part is international transfers: adequacy, the history of Safe Harbor and Privacy Shield and the Schrems decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses, Binding Corporate Rules, codes of conduct, derogations and transfer impact assessments.

European data protection: scope and accountability (8 to 18 questions). Territorial and material scope, including establishment in the EU. Accountability for controllers, joint controllers and processors, data protection by design and by default, documentation, DPIAs and mandatory DPOs. Then supervision and enforcement: the EDPB, the EDPS, supervisory authorities and the lead authority, fines, class actions and compensation.

Compliance with European data protection law and regulation (8 to 16 questions). Applying the law in practice: employee data, workplace monitoring, BYOD and works councils. Surveillance by public authorities, CCTV, geolocation and biometrics. Direct marketing and online behavioural targeting. And internet technology: cloud computing, cookies, social media and dark patterns, search engine marketing, and AI.

Why people fail it

The first reason is memorising articles without applying them. Some questions set out a scenario and ask which lawful basis applies, whether a transfer is allowed, or whether a breach must be reported. Knowing the text of the GDPR is not enough on its own.

The second is the guidance layer. The Body of Knowledge refers to European Data Protection Board guidelines and opinions again and again, on access, erasure, breach notification, transfers, lead authority, establishment and more. Candidates who study only the regulation miss the questions that turn on how the EDPB reads it.

The third is transfers. Adequacy, SCCs, BCRs, derogations, transfer impact assessments and the Schrems history form one of the most detailed parts of the outline, and the options are easy to confuse.

The last is question format. Some questions have more than one correct answer and say how many to select. You must pick exactly that number of correct options to score, with no partial credit.

A study plan that fits the exam

This seven week plan gives the most time to Domains II and III, which carry the most questions. The IAPP itself suggests at least 30 hours of study. Before week 1, try the free CIPP/E practice questions to find your starting point, and download the Body of Knowledge from iapp.org.

  1. Week 1, foundations: Domain I. The human rights background, Convention 108, the EU institutions, the earlier directives and where the GDPR, NIS 2 and the AI Act fit.
  2. Week 2, GDPR concepts and security: personal and special category data, pseudonymisation and anonymisation, controllers and processors, security measures, breach notification and vendor management.
  3. Week 3, data subject rights: each right in turn, with its conditions, exceptions and the related EDPB guidance. Domain II carries the most questions, so it gets two weeks.
  4. Week 4, processing: the principles, the lawful bases, special category data and transparency and notices.
  5. Week 5, international transfers: adequacy, the Schrems decisions, the Data Privacy Framework, SCCs, BCRs, derogations and transfer impact assessments.
  6. Week 6, scope, accountability and compliance: Domains IV and V. Establishment, DPIAs, DPOs, enforcement and fines, then employment, surveillance, marketing, cookies, cloud and AI.
  7. Week 7, timed runs: sit sets of 90 questions in 2.5 hours, review every miss against the Body of Knowledge, and go back to your weakest domain. The CertStash CIPP/E pack has 319 questions with explanations, enough for three full runs.

On exam day

You sit the CIPP/E with Pearson VUE, at a test centre or remotely through OnVUE, and you must take it within one year of buying it. For OnVUE, use a personal computer rather than a work device, do not use a VPN, and expect a system check of your microphone, webcam and internet speed when you check in. Check-in opens 30 minutes before your appointment.

The exam splits into two halves, each with half the questions and half the time. Halfway through you are offered a 15-minute break. Whether or not you take it, you must submit the first half before moving on, and you cannot go back to it. That gives you 75 minutes for each set of 45 questions, so review your first half answers before you submit them. If you take the French or German exam, an IAPP translation dictionary is available on screen.

Your result appears on screen as pass or fail with your score on the IAPP's 100 to 500 scale, and you receive an email explaining how to see a breakdown by section.

Frequently asked questions

Can I retake the CIPP/E if I fail?

Yes. You can buy a new exam once your result appears in your MyIAPP profile, at a discounted retake price. You cannot book a retake for a date sooner than seven days after your previous attempt.

What happens after I pass?

You become certified once you hold IAPP membership or have paid the certification maintenance fee. To keep the certification you need 20 hours of continuing professional education in each two-year term, plus either the US$250 maintenance fee for the term or IAPP membership at US$295 a year.

Can I take the exam in another language?

Yes. The CIPP/E is available in French and German as well as English, translated from the English exam without machine translation, and the Body of Knowledge is available in both languages.

Is the practice pack enough on its own?

No. It is practice, not a course. The 319 questions show you how the CIPP/E frames scenarios and where your gaps are, but you still need to study the GDPR, the EDPB guidance named in the Body of Knowledge, and a textbook or course. Use the pack to test and sharpen what you have learned.

When you are ready to practise at full length, get the complete IAPP CIPP/E practice pack.

Sources

The official pages the facts in this guide were checked against.

What people say about this pack

Passed my Certified Information Privacy Professional certification exam today with 96% marks. Studied using the exam dumps at CertStash. Highly recommended to all taking this exam.
ArthurCIPP/E
Passed today in IAPP CIPP-E dump material is still valid but there were 7 to 8 new questions in the exam.
BaldwinCIPP/E