CIPT Study Guide: How to Pass the IAPP Exam

If you're sitting for the IAPP CIPT, here's what you're walking into: 90 multiple-choice questions, 150 minutes, and a passing score of 300 on IAPP's 100 to 500 scale. The exam costs $550. You sit it at a Pearson VUE center, or remotely through OnVue.

What's on the CIPT exam

The CIPT is built around the IAPP Body of Knowledge and Exam Blueprint, version 4.0.0, effective September 1, 2025. It splits into five domains:

Only 75 of those 90 questions count. The other 15 are trial questions IAPP is testing for future exams, and nothing marks them out, so answer all 90 as if they score. That's why the ranges above don't add up to 90.

Two domains carry roughly half the exam between them:

• Domain II follows personal data across its whole life — collection, use, sharing, destruction.
• Domain III is privacy risk management, close behind it.

That's where the hours go. The other three are smaller, not optional:

• Domain I — what the privacy technologist is actually responsible for inside an organisation.
• Domain IV — privacy by design as a discipline rather than a slogan.
• Domain V — privacy engineering and governance, where principles turn into controls somebody maintains.

How hard the CIPT is and how long to prepare

Difficulty depends almost entirely on where you're starting.

If you already build systems and have brushed against privacy work, three to five weeks of focused evening study is usually enough. Most of that effort goes into learning IAPP's vocabulary for things you already do, plus the governance material, which engineers reliably under-read.

If you're coming from policy or compliance, give yourself eight weeks or more. The technical assumptions in Domains II and V run deep and the blueprint doesn't spell them out.

The trap for strong engineers is treating security as the whole exam. Encryption and access control matter, but the question is always what a privacy technologist should do — and the documented, defensible answer usually beats the cleverest technical one.

Is the CIPT worth it

Yes, and the market is unusually tight. One 2025 analysis put privacy engineering at the highest ratio of open positions to qualified candidates of any software engineering specialization — roughly 3.8 openings per qualified candidate (stealthcloud.ai, December 2025). Treat that as one datapoint rather than a guarantee, but the direction is clear: there are more roles than people trained to fill them, and the CIPT is the credential that says you're one of them.

How to study for the CIPT

Start with the current blueprint. The official CIPT Body of Knowledge and Exam Blueprint, version 4.0.0, plus the free study guides on IAPP's certification site. Check the version number on anything else you pick up.

Then watch for the habits that cost points.

• Don't memorise definitions in isolation. Questions hand you a scenario and ask which control fits, and the wrong answers are real techniques that just don't match the situation. Flashcards will let you recognise every option and still pick wrong.
• Learn where in the data life cycle each risk lives. Domain II is the largest on the exam and it's organised around exactly that sequence.
• Read the governance material properly. It's the part engineers skip, and it's the part that separates a privacy technologist from a security engineer.

Switch to questions early. Don't wait until you feel ready. You want to be answering scenarios while there's still time to go back and fix whatever the misses expose.

Review every miss. Work out why the right answer is right, not just that it was.

Finish with a mock exam. Full length, timed. You get 150 minutes for 90 questions. Do a few before the real thing.

You can practice with realistic CIPT exam-style questions on Cert Made Easy. Hand written exam-style questions that match the domains.

We have mock exams as well.

CIPT FAQ