Validates knowledge of European data protection law, GDPR requirements, data processing rules and organizational compliance and accountability.
CIPP/E tests whether you can apply European data protection law, mainly the GDPR, to realistic situations. Learn the framework domain by domain, read the key GDPR articles, then practise scenario questions until you can explain why one answer fits best.
Example scenario: A company wants to know why the GDPR applies directly across EU countries while an older directive did not. Which institutions and legal instruments explain the difference?
Example scenario: A customer asks an online retailer to delete their account, but the retailer must keep invoices for tax purposes. Which data can it erase, and what should it tell the customer?
Example scenario: A German company wants to send HR records to a payroll provider in a country without an adequacy decision. Which transfer options and checks apply?
Example scenario: A US app with no EU office targets French users with French-language ads. Does the GDPR apply, and which authority would supervise it?
Example scenario: An employer plans to monitor staff email for data loss. What must it assess and tell employees before starting?
Official CIPP/E Body of Knowledge and Exam Blueprint · Version 1.3.3, effective September 1, 2025
Choose the single best answer from the options.
An employer processes an employee's bank details to pay their salary under the employment contract. Which lawful basis most directly fits?
A. The processing is necessary to perform the contract with the employee; consent is rarely the right basis in employment because the employee cannot freely refuse.
Choose every correct answer; the question states how many to select, and there is no partial credit.
Which TWO of these must a controller provide when it collects personal data directly from the individual?
A and C. Transparency rules require the controller's identity and the purposes and lawful basis; revenue and other customers' names are not part of the notice.
Read a short passage describing an organization and its data practices, then answer several questions about it.
A Spanish online shop uses a cloud provider to host customer data, and the provider also uses the data to improve its own services. How should the shop view the provider's role?
A. A provider that decides to use data for its own purposes goes beyond the shop's instructions and takes on controller responsibilities for that use.
Buy the exam from the IAPP store, then schedule it with Pearson VUE from your MyIAPP account. Take it within one year of purchase.
Read the Body of Knowledge and try a few official practice questions to see which areas are new to you.
Most candidates spend 35–70 hours. Plan for the low end if you already work with the GDPR; plan for the high end if European data protection law is new to you.
Choose one main source that follows the Body of Knowledge, then read the GDPR articles it refers to.
Best official courseEuropean Data Protection (CIPP/E) Online Training
Best value courseCIPP/E course
Best low-cost courseCIPP E Certification Prep Course 2026Read the law itself. Scenario questions reward knowing how the GDPR articles fit together: who is the controller, which lawful basis applies and what the next obligation is.
Use the official practice exam as a checkpoint and a larger bank for repeated practice. Review every explanation, including questions you guessed right.
See all 5 CIPP/E practice tests →Schedule through your MyIAPP account with Pearson VUE at least 24 hours ahead. The name in MyIAPP must match your ID exactly.
A missed appointment counts as a no-show: the fee is forfeited and you need a new exam. After a failed attempt, you can retest after seven days.
One lawyer read the official textbook, scored poorly on the IAPP practice exam, then read the full GDPR text and revisited weak topics before scoring 76 of 90 on a second attempt and booking. They passed after two weeks of three hours a day.
A candidate who passed after three weeks found the EU history and institutions material heavy and memorization-based, and studied it last. They relied on practice questions, flashcards and EDPB guidance for scenario questions.
