IAPP
CIPP/E Study Guide: How to Pass the IAPP GDPR Exam
CIPP/E study guide: what the exam costs, the Body of Knowledge, passing score, jobs and salary, and how to prepare for the IAPP GDPR exam.
If you're sitting for the IAPP CIPP/E, here's what you're walking into: 90 multiple-choice questions, 150 minutes, and a passing score of 300 on IAPP's 100 to 500 scale. The exam costs $550. You sit it at a Pearson VUE center, or remotely through OnVUE, in English, French or German.
The CIPP/E is the GDPR exam. The CIPP/US covers US law instead, and the CIPM covers running a privacy program.
How much does the CIPP/E cost?
The exam is $550 for members and non-members alike, but retakes and keeping the credential add to that:
| What | Price |
|---|---|
| CIPP/E exam | $550 |
| Retake, or first attempt if you hold another IAPP certification | $375 |
| Certification maintenance fee | $250 per two-year term |
| IAPP membership (covers the maintenance fee) | $295 a year |
| IAPP's official practice exam (PDF, 90 questions) | $55, or $45 for members |
What's in the CIPP/E Body of Knowledge
The CIPP/E is built around the IAPP Body of Knowledge and Exam Blueprint (the "BoK"), version 1.3.3, effective September 1, 2025. It's a free PDF on IAPP's site. It splits into five domains:
| Domain | Questions |
|---|---|
| I. Introduction to European Data Protection | 7 to 13 |
| II. European Data Protection Law and Regulation | 18 to 28 |
| III. European Data Processing | 13 to 21 |
| IV. European Data Protection: Scope and Accountability | 8 to 18 |
| V. Compliance with European Data Protection Law and Regulation | 8 to 16 |
Only 75 of those 90 questions count. The other 15 are trial questions IAPP is testing for future exams, and nothing marks them out, so answer all 90 as if they score. That's why the ranges above don't add up to 90.
- Introduction (I). The history: Convention 108, the 1995 Directive, the ePrivacy Directive. The EU institutions and what each one does. It's the domain people skim, but the blueprint also puts the principles of the NIS 2 Directive and the EU AI Act here.
- Law and Regulation (II). The biggest domain. Personal data versus special categories, pseudonymous versus anonymous, controller versus processor. Security measures, breach notification and vendor management. Then data subject rights, which are a competency on their own worth 8 to 12 questions: access, rectification, erasure, restriction, objection, portability, and the rules on automated decision-making.
- Data Processing (III). The processing principles, the six lawful bases, privacy notices, and international transfers: adequacy, Standard Contractual Clauses, Binding Corporate Rules, derogations, transfer impact assessments, and the Schrems history behind the EU-US Data Privacy Framework.
- Scope and Accountability (IV). When the GDPR applies to a company outside the EU, DPIAs, when a DPO is mandatory, the EDPB and lead supervisory authority, and what fines and compensation look like.
- Compliance (V). The applied domain. Employee data and workplace monitoring, CCTV and biometrics, direct marketing and behavioural targeting, cookies, cloud, dark patterns on social media, and AI.
The exam tests judgment with scenarios. It gives you a situation and asks what the controller should do. Quoting an article number is not enough.
How hard the CIPP/E is and how long to prepare
Difficulty depends on how much of the GDPR you already use at work.
If you're a lawyer, DPO or privacy manager in Europe, the content is familiar and the job is learning the IAPP's framing. Plan on three to five weeks of evening study. The trap for experienced people is answering from their own regulator's habits. The blueprint keeps saying "including EDPB guidelines and opinions on the subject", and that is where the expected answers come from.
If you hold a CIPP/US or work in privacy outside Europe, give it five to seven weeks. The concepts map, but the machinery is different. One regulation instead of a patchwork. A lead supervisory authority. Rights that go further than anything in US law.
If you're coming in cold, plan on eight weeks or more. The rights, the lawful bases and the transfer mechanisms all have to be learned before the scenarios make sense.
Two mechanics worth knowing. The 150 minutes are split into two halves with an optional break in between, and once you submit the first half you can't go back. Some questions are multi-select with no partial credit.
Is the CIPP/E worth it? Jobs and salary
The CIPP/E fits roles like data protection officer, privacy counsel, privacy analyst and privacy consultant, anywhere a company handles EU personal data.
The verified pay data we have is for US roles. PayScale puts a Privacy Analyst at $89,639 and a Privacy Officer at $116,027 (both June 2026). LinkedIn listed 590 US Data Protection Officer postings and 7,000+ Privacy Counsel postings in June 2026. We don't have verified figures for European salaries, so we won't guess at them.
One cost fact that matters if you already hold an IAPP certification: your CIPP/E exam is $375, not $550. The same price applies to a retake. After that it's a $250 maintenance fee per two-year term, or IAPP membership at $295 a year, plus 20 CPE hours per term. If your work is drifting toward AI, the AIGP is the usual next step, and we compared the AI certifications separately.
How to study for the CIPP/E
Read the blueprint first. The official CIPP/E Body of Knowledge and Exam Blueprint, plus the free study guides on IAPP's certification site. Check the version: 1.3.3, superseding 1.3.2.
Then watch for the habits that cost points.
- Learn the rights and the lawful bases cold. These are the highest-count competencies on the exam, and the scenarios assume you know them before they test anything else.
- Learn which transfer mechanism fits which situation. Adequacy, SCCs, BCRs and derogations each solve a different problem, and the wrong answers are always the other three.
- Know who's who. EDPB, EDPS, a national supervisory authority, the lead supervisory authority, the CJEU and the European Court of Human Rights all appear, and they are not interchangeable.
- Don't over-study fines. Consequences for violations is 1 to 3 questions. Put that time into Domain V, where the workplace and marketing scenarios are practical and easy to drop.
Switch to questions early. Don't wait until you feel ready. You want to be answering scenarios while there's still time to go back and fix whatever the misses expose.
Review every miss. Work out why the right answer is right, not just that it was. Plenty of questions have two defensible answers, and EDPB guidance decides which one wins.
Finish with a mock exam. Full length, timed. 90 questions in 150 minutes, in two halves. Do a few before the real thing.
You can practice with realistic CIPP/E exam-style questions on Cert Made Easy. Hand written exam-style questions that match the domains.
We have mock exams as well.
FAQ
Is there a CIPP/E practice exam PDF?
Yes. IAPP sells the CIPP/E Practice Exam Digital, 90 questions in a PDF, for $55 ($45 for members). A PDF won't time you or show which domain is weak, so use it as a final check after practicing online.
Are there prerequisites for the CIPP/E?
IAPP publishes none. The documented first step is buying the exam.
What does the CIPP/E cost?
$550, or $375 if you already hold another IAPP certification or are retaking. You buy it at the IAPP store, then schedule with Pearson VUE within one year of purchase.
How long is the CIPP/E valid?
Two years. Keeping it active takes 20 CPE hours per term plus the $250 maintenance fee, or an IAPP membership.
What is the passing score for the CIPP/E?
IAPP converts raw results to a common scale that runs from 100 to 500 and sets the cut at 300 for every one of its exams. That works out to roughly 65% to 80% correct, depending on the exam form. Our mock exams target the upper bound.
Is the CIPP/E a GDPR or DPO certification?
It's IAPP's exam on the GDPR, which is why it comes up when people search for either. The GDPR itself doesn't certify people. Its certification schemes cover processing operations, and it doesn't require a DPO to hold any certificate, only expert knowledge of data protection law and practice.
CIPP/E or CIPM?
The CIPP/E tests what the law says. The CIPM tests how to run a privacy program. Many DPOs hold both, and the second exam is cheaper once you have the first.
Ready to start practicing?
Practice CIPP/E exam-style questions →
