Certified Information Privacy Manager credential artwork

Certified Information Privacy Manager (CIPM) Exam Guide

Validates knowledge of running a privacy program, including governance, data assessment, data protection, performance measurement and incident response.

CIPM tests whether you can make sound decisions as a privacy program manager: set up governance, assess and protect data, measure the program and respond to requests and incidents. Learn the program life cycle, then practise scenario questions where you choose the best next step.

Understand the exam

Syllabus

IPrivacy program: Developing a framework14–18 questions
  1. I.ADefine program scope and develop a privacy strategy.
  2. I.BCommunicate organizational vision and mission statement.
  3. I.CIndicate in-scope laws, regulations and standards applicable to the program.

Example scenario: A fast-growing company has privacy tasks spread across legal, IT and marketing. Which governance model would you propose, and how would you get leadership support?

IIPrivacy program: Establishing program governance12–16 questions
  1. II.ACreate policies and processes to be followed across all stages of the privacy program life cycle.
  2. II.BClarify roles and responsibilities.
  3. II.CDefine privacy metrics for oversight and governance.
  4. II.DEstablish training and awareness activities.

Example scenario: Customer complaints are handled differently by each team. What policy and roles would you set up so every complaint follows the same route?

IIIPrivacy program operational life cycle: Assessing data12–16 questions
  1. III.ADocument data governance systems.
  2. III.BEvaluate processors and third-party vendors.
  3. III.CEvaluate physical and environmental controls.
  4. III.DEvaluate technical controls.
  5. III.EEvaluate risks associated with shared data in mergers, acquisitions and divestitures.

Example scenario: Marketing wants to use a new analytics vendor that stores data abroad. What would you assess before approving it?

IVPrivacy program operational life cycle: Protecting personal data9–13 questions
  1. IV.AApply information security practices and policies.
  2. IV.BIntegrate the main principles of Privacy by Design (PbD).
  3. IV.CApply organizational guidelines for data use and ensure technical controls are enforced.

Example scenario: A product team plans to collect birth dates "just in case". How would you apply privacy by design before the feature is built?

VPrivacy program operational life cycle: Sustaining program performance7–9 questions
  1. V.AUse metrics to measure the performance of the privacy program.
  2. V.BAudit the privacy program.
  3. V.CManage continuous assessment of the privacy program.

Example scenario: Leadership asks whether the privacy program is working. Which metrics would you report, and how would you link them to program goals?

VIPrivacy program operational life cycle: Responding to requests and incidents10–14 questions
  1. VI.ARespond to data subject access requests and privacy rights.
  2. VI.BFollow organizational incident handling and response procedures.
  3. VI.CEvaluate and modify current incident response plan.

Example scenario: An employee emails a customer list to the wrong recipient. What are your first steps, and who do you involve?

Official CIPM Body of Knowledge and Exam Blueprint · Version 4.2.0, effective September 1, 2025

Format

Questions
90
Duration
2h 30m
Passing score
300 / 500
Delivery
Test centre or online
Languages
English, French, German, Chinese, Portuguese

Question types

Choose the single best answer from the options.

CertUp example

A privacy manager learns that a vendor has changed where it stores customer data. What should the manager do first?

  1. Review the vendor contract and assess the new transfer risk
  2. Delete the vendor’s account
  3. Wait for the next annual audit
  4. Tell customers the vendor is unreliable
Show answer

A. The manager first needs to know whether the contract and transfer rules still hold; the other options act before the facts are known or wait too long.

Eligibility and booking

Buy the exam from the IAPP store, then schedule it with Pearson VUE from your MyIAPP account. Take it within one year of purchase.

Buy the CIPM examIAPP candidate handbook

Make a study plan

Read the Body of Knowledge and try a few official practice questions to see how the exam frames program decisions.

Most candidates spend 30–60 hours. Plan for the low end if you already run or support a privacy program or hold a CIPP; plan for the high end if privacy program management is new to you.

7 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.29 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.15 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h

Learn the core concepts

Choose one main source that follows the Body of Knowledge. The official textbook is the standard reference.

Best official textbookPrivacy Program Management, 3rd editionRussell Densmore / IAPP · $75 · $65 for IAPP members · digital bookBest video courseCIPM Certification MasterclassDr. Kyle David · $240 · lifetime accessBest official coursePrivacy Program Management (CIPM) Online TrainingIAPP · $1,195 · $995 for IAPP members
See all 6 CIPM courses →

Think like the program owner. For each topic, ask who owns the decision, what the policy says should happen next and how you would measure it.

Practice with mock exams

Use the official practice exam as a checkpoint and a larger bank for repeated practice. Group your mistakes by decision type, not just by domain.

CIPM Practice Exam DigitalIAPP · $55 · $45 for IAPP members · PDFCIPM Certification MasterclassDr. Kyle David · $239.99 · lifetime accessCIPM Complete Certification Preparation PackagePrivacy Bootcamp · $499 · lifetime access
See all 5 CIPM practice tests →

Are you ready?

  • You can explain why one action is the best next step when two options look reasonable.
  • You can tell when a situation calls for a PTA, a PIA or vendor due diligence.
  • You score consistently on questions you have not seen before.
  • You can work through 45 questions in 75 minutes without rushing.

Prepare for exam day

Schedule through your MyIAPP account with Pearson VUE at least 24 hours ahead. The name in MyIAPP must match your ID exactly.

At a Pearson VUE test centre

  • Bring two forms of ID that meet Pearson VUE’s test-centre requirements.
  • Arrive 15 minutes early. Arriving late can count as a no-show.
  • Leave phones, devices and notes outside the testing room. The clock keeps running if you step out outside the scheduled break.
  • Reschedule or cancel at least 48 hours before the appointment.
Pearson VUE: IAPP exams

A missed appointment counts as a no-show: the fee is forfeited and you need a new exam. After a failed attempt, you can retest after seven days.

IAPP candidate handbook

Advice from exam takers

Learn the decision patterns behind wrong answers.

A candidate who scored 470/500 took a video course, read the textbook three times and scored 65/90 on the first official practice exam. They then grouped mistakes by decision type, such as when to notify versus investigate, and drilled those patterns.

r/cippPass report: 470/500 study breakdown (Nov 2025)

Expect to choose between two plausible answers.

A December 2025 passer prepared for about a month with Dr. Kyle David’s course and the official practice paper. Many questions came down to two answers that both seemed right.

r/cippPass report: one month of study (Dec 2025)