Certified Information Privacy Professional/United States credential artwork

Certified Information Privacy Professional/United States (CIPP/US) Exam Guide

Validates knowledge of US privacy law, covering regulators, federal laws, government data access, workplace privacy and state laws.

CIPP/US tests whether you know the main US privacy laws and can apply them to workplace and business scenarios. Learn the legal framework and the sector laws, then practise fact-heavy questions until you can pick the best action, not just a true statement.

Understand the exam

Syllabus

IThe U.S. privacy environment27–33 questions
  1. I.AUnderstand the U.S. legal framework
  2. I.BUnderstand the enforcement framework for U.S. privacy and security laws
  3. I.CUnderstand the principles of information management from a U.S. perspective

Example scenario: A retailer’s privacy notice promises it never shares data, but its app sends location data to an ad partner. Which regulator could act, and on what basis?

IIFederal privacy laws15–19 questions
  1. II.AUnderstand how the Federal Trade Commission addresses consumer protection in regard to privacy and security
  2. II.BUnderstand how healthcare and medical privacy is regulated
  3. II.CUnderstand how financial sector privacy is regulated
  4. II.DUnderstand how education sector privacy is regulated
  5. II.EUnderstand how privacy is regulated in telecommunications and marketing activities

Example scenario: A bank wants to share customer data with an affiliated insurer for marketing. Which notice and opt-out rules apply?

IIIGovernment and court access to private-sector information3–5 questions
  1. III.AUnderstand the relationship between law enforcement and privacy issues
  2. III.BUnderstand the relationship between national security and privacy
  3. III.CUnderstand issues regarding civil litigation and privacy

Example scenario: A company receives a subpoena for a customer’s account records. What should it check before handing over any data?

IVWorkplace privacy4–6 questions
  1. IV.AUnderstand the issues involved in workplace privacy
  2. IV.BUnderstand workplace privacy issues that arise before, during and after employment

Example scenario: A company wants to run credit checks on job applicants through a screening vendor. What must it do before and after the check?

VState privacy laws17–21 questions
  1. V.AUnderstand concepts of authority governing state privacy laws
  2. V.BUnderstand the key concepts and principles of state data privacy and security laws
  3. V.CUnderstand the key principles of state data breach notification laws

Example scenario: A breach exposes customer records in several states. How would you work out whom to notify, and when?

Official CIPP/US Body of Knowledge and Exam Blueprint · Version 2.6.1, effective September 1, 2025

Format

Questions
90
Duration
2h 30m
Passing score
300 / 500
Delivery
Test centre or online
Languages
English

Question types

Choose the single best answer from the options.

CertUp example

A health plan loses an unencrypted laptop holding member records. Which US law sets the federal breach notification duties for the plan?

  1. HIPAA, as strengthened by the HITECH Act
  2. The Video Privacy Protection Act
  3. The Family Educational Rights and Privacy Act
  4. The Driver’s Privacy Protection Act
Show answer

A. HIPAA and HITECH cover health plans and require breach notification; the other laws govern video rentals, student records and motor vehicle records.

Eligibility and booking

Buy the exam from the IAPP store, then schedule it with Pearson VUE from your MyIAPP account. Take it within one year of purchase.

Buy the CIPP/US examIAPP candidate handbook

Make a study plan

Read the Body of Knowledge and try a few official practice questions to see which laws are new to you.

Most candidates spend 40–80 hours. Plan for the low end if you already work in US privacy or are a lawyer; plan for the high end if US privacy law and the sector laws are new to you.

7 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.32 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.17 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h

Learn the core concepts

Choose one main source that follows the Body of Knowledge. The sector laws and state laws carry many of the questions.

Best official textbookU.S. Private-Sector Privacy, 4th editionPeter Swire and DeBrae Kennedy-Mayo / IAPP · $75 · $65 for IAPP members · $95 printBest official courseU.S. Private-Sector Privacy (CIPP/US) Online TrainingIAPP · $1,195 · $995 for IAPP membersBest all-in-one packageCIPP/US coursePrivacy Bootcamp · $499 · lifetime access
See all 6 CIPP/US courses →

Track each law’s scope. For every law, note who it covers, what it requires and who enforces it. Many questions turn on whether a law applies at all.

Practice with mock exams

Use the official practice exam as a checkpoint and a larger bank for repeated practice. Review every explanation, including questions you guessed right.

CIPP/US Practice Exam DigitalIAPP · $55 · $45 for IAPP members · PDFCIPP/US Certification MasterclassDr. Kyle David · $239.99 · lifetime accessCIPP/US Complete Certification Preparation PackagePrivacy Bootcamp · $499 · lifetime access
See all 5 CIPP/US practice tests →

Are you ready?

  • You can say which federal or state law applies to a scenario, and why.
  • You can choose the first action in a scenario when several options are legally true.
  • You score consistently on questions you have not seen before.
  • You can work through 45 questions in 75 minutes without rushing.

Prepare for exam day

Schedule through your MyIAPP account with Pearson VUE at least 24 hours ahead. The name in MyIAPP must match your ID exactly.

At a Pearson VUE test centre

  • Bring two forms of ID that meet Pearson VUE’s test-centre requirements.
  • Arrive 15 minutes early. Arriving late can count as a no-show.
  • Leave phones, devices and notes outside the testing room. The clock keeps running if you step out outside the scheduled break.
  • Reschedule or cancel at least 48 hours before the appointment.
Pearson VUE: IAPP exams

A missed appointment counts as a no-show: the fee is forfeited and you need a new exam. After a failed attempt, you can retest after seven days.

IAPP candidate handbook

Advice from exam takers

Prepare for “first step” questions.

A foreign-trained attorney found few questions on exact notification deadlines and many asking for the very first action when several options were legally true. Preemption, GLBA and breach handling featured heavily in their exam.

r/cippPass report: foreign-trained attorney (Feb 2026)

Expect nuanced fact patterns.

A recent CISSP holder found the official practice exam harder than CISSP practice and noticed gaps in their video course. One reply said third-party practice questions were more general than the real exam’s detailed facts.

r/cippOfficial practice exam discussion (July 2026)