CIPP Certification Study Guide (CIPP/US)

If you're sitting for the IAPP CIPP/US, here's what you're walking into: 90 multiple-choice questions, 150 minutes, and a passing score of 300 on IAPP's 100 to 500 scale. The exam costs $550. You sit it at a Pearson VUE center, or remotely through OnVue.

What's on the CIPP/US exam

The CIPP/US is built around the IAPP Body of Knowledge and Exam Blueprint, version 2.6.1, effective September 1, 2025. It splits into five domains:

Only 75 of those 90 questions count. The other 15 are trial questions IAPP is testing for future exams, and nothing marks them out, so answer all 90 as if they score. That's why the ranges above don't add up to 90.

Three things in that table should shape your plan:

• Domain I is about a third of the exam. It reads like background. It isn't.
• Domains I and V together outweigh the federal sector laws — which is exactly where most people spend their time.
• Domain III is three to five questions. Don't over-prepare it.

The exam tests whether you understand the shape of US privacy law. It isn't one statute like the GDPR. It's a patchwork:

• Federal sector laws — HIPAA for health, GLBA for finance, FCRA for credit, COPPA for kids, TCPA and CAN-SPAM for marketing.
• State laws, a stack that keeps growing.

For any situation, you need to know which law applies, who enforces it, and what it requires.

How hard the CIPP/US is and how long to prepare

Difficulty depends on how much US law you already carry around.

If you work in privacy, compliance, or legal and already deal with HIPAA or GLBA, plan on four to six weeks of focused evening study. Most of the work is filling in the sectors you don't touch and getting current on state law, which moves faster than any textbook.

If you're coming in cold, or from outside the US, give yourself eight to ten weeks. The sheer number of statutes is the obstacle, and none of it is intuitive until you can see the sectoral structure underneath.

The trap is studying laws as isolated facts. The exam asks which law governs a situation, so what you need is a decision procedure: who's holding the data, what kind is it, what sector are they in.

Is the CIPP certification worth it

Yes. It's the standard credential for US privacy work. Reported pay for privacy analysts runs from roughly $66,000 to $128,000, with averages cited between $88,714 (PayScale, 2026) and $169,487 (Indeed) depending on seniority — signposts, not a number to expect. A 2024 TrustArc survey found 42% of privacy professionals seeing rising demand at their own companies, and AI governance work is adding roles on top of that.

How to study for the CIPP/US

Start with the current blueprint. The official CIPP/US Body of Knowledge and Exam Blueprint, version 2.6.1, plus the free study guides on IAPP's certification site. Check the version on anything else you use, because state law churns.

Then watch for the habits that cost points.

• Weight your time to the table, not to your interests. Domain I and Domain V are the two heaviest, and they're the two people treat as background reading.
• For each law, learn four things: who it covers, what data it protects, what it requires, and who enforces it. If you can answer those four, you can answer the question.
• Don't over-study government and court access. It's three to five questions.

Switch to questions early. Don't wait until you feel ready. You want to be answering scenarios while there's still time to go back and fix what the misses expose.

Review every miss. Work out why the right answer is right, not just that it was. Plenty of questions have two defensible answers, and the one that wins is the one the statute actually covers.

Finish with a mock exam. Full length, timed. You get 150 minutes for 90 questions.

You can practice with exam-style CIPP/US questions on Cert Made Easy. Hand written exam-style questions that match the domains.

We have mock exams as well.

FAQ