CIPM
What is on the IAPP CIPM exam, and where should your study hours go?
The IAPP's CIPM exam is 90 multiple-choice questions in 2.5 hours, scored from 100 to 500 with 300 to pass. Its Body of Knowledge, version 4.2.0, effective 1 September 2025, splits the exam into six domains, and unlike the CIPP exams no single domain dominates: the largest has 14 to 18 questions and the smallest 7 to 9.
The facts below come from the IAPP's Privacy Candidate Handbook, version 5.3.2, its certification FAQs, the CIPM page and its Body of Knowledge, and the IAPP Store, all read on 2 October 2026. The study hours are ours.
How is the CIPM exam structured?
90 questions in 2.5 hours averages 1 minute 40 seconds each. Halfway through you are offered a 15-minute break, which splits the exam into two halves of 45 questions and 75 minutes; once you submit the first half, you cannot return to it.
All IAPP exams are multiple choice with one or more correct answers. A multi-select question says how many to choose, such as "Select 3 of the 5 options below", and there is no partial credit. Some questions follow a scenario. Scores run from 100 to 500, 300 passes, and the IAPP's FAQ says 300 "does not represent 60%".
IAPP Privacy Candidate Handbook v5.3.2; IAPP Certification FAQs
The CIPM comes in more languages than the CIPP/E, CIPP/US or CIPT: the IAPP Store lists English, French, German, Chinese and Brazilian Portuguese. You sit at a Pearson VUE test center or online through OnVUE, and the result shows on screen when you finish, with the percentage you scored in each domain.
Which CIPM domains carry the most questions?
| Domain | Questions |
|---|---|
| I. Privacy Program: Developing a Framework | 14 to 18 |
| II. Privacy Program: Establishing Program Governance | 12 to 16 |
| III. Operational Life Cycle: Assessing Data | 12 to 16 |
| IV. Operational Life Cycle: Protecting Personal Data | 9 to 13 |
| V. Operational Life Cycle: Sustaining Program Performance | 7 to 9 |
| VI. Operational Life Cycle: Responding to Requests and Incidents | 10 to 14 |
Below the domains sit 21 competencies, each with its own range. The largest is II.A, creating the policies and processes followed across the privacy program life cycle, with 6 to 8 questions. Next come in-scope laws, regulations and standards (I.C) and responding to data subject requests and privacy rights (VI.A), at 5 to 7 each. At the other end, evaluating physical and environmental controls (III.C) has a range of 0 to 2, so it may not appear on your form at all. One caution: the IAPP's competency ranges for the CIPM do not add up to its domain ranges, so read each figure as printed.
What does the current Body of Knowledge name?
Version 4.2.0 asks you to "understand the privacy risks posed by the use of AI in the business environment", under the in-scope laws competency. Continuous assessment (V.C) names five assessment types by their initials: PIA, DPIA, TIA, LIA and PTA. Mergers, acquisitions and divestitures appear twice, once as a data risk to evaluate (III.E) and once as a reason to reassess the program (V.C). The metrics competency gives examples you can practice with: PIAs performed, rights request response rates, complaints volume and data breach metrics.
The CIPM is a management exam, so a framework helps you hold it together. The NIST Privacy Framework covers the same ground from governance to response, and the FTC's Protecting Personal Information guide is a short read on the protection domain. The exam tests the IAPP's Body of Knowledge, so use them to understand it, not in place of it.
How should you split your CIPM study hours?
The IAPP recommends at least 30 hours. Split them by the midpoint of each domain's range; the midpoints add up to 75, so on 30 hours each is worth 24 minutes.
| Domain | Midpoint | 30-hour plan |
|---|---|---|
| I. Developing a Framework | 16 | 6 h 30 min |
| II. Establishing Program Governance | 14 | 5 h 30 min |
| III. Assessing Data | 14 | 5 h 30 min |
| IV. Protecting Personal Data | 11 | 4 h 30 min |
| V. Sustaining Program Performance | 8 | 3 h 15 min |
| VI. Responding to Requests and Incidents | 12 | 4 h 45 min |
| Total | 75 | 30 h |
Each figure is rounded to the nearest quarter hour, and the column still adds up to 30. The planner has the same split for 45 and 60 hours and a checklist of all 21 competencies. Our suggestion: start with II.A, I.C and VI.A, which can supply up to 22 questions between them.
CIPM study planner
IAPP CIPM: study planner
Question ranges come from the IAPP CIPM Body of Knowledge, version 4.2.0, effective 1 September 2025, read on 2 October 2026. The 30-hour minimum is the IAPP's recommendation (IAPP Certification FAQs). The hours are our suggestion: each domain gets a share in proportion to the midpoint of its published range. Check the IAPP's CIPM page before you start in case the Body of Knowledge has changed.
Hours by domain
The midpoints add up to 75, so on 30 hours each midpoint question is worth 24 minutes.
| Domain | Range | Midpoint | 30 hours | 45 hours | 60 hours |
|---|---|---|---|---|---|
| I. Privacy Program: Developing a Framework | 14 to 18 | 16 | 6.5 | 9.5 | 12.75 |
| II. Privacy Program: Establishing Program Governance | 12 to 16 | 14 | 5.5 | 8.5 | 11.25 |
| III. Privacy Program Operational Life Cycle: Assessing Data | 12 to 16 | 14 | 5.5 | 8.5 | 11.25 |
| IV. Privacy Program Operational Life Cycle: Protecting Personal Data | 9 to 13 | 11 | 4.5 | 6.5 | 8.75 |
| V. Privacy Program Operational Life Cycle: Sustaining Program Performance | 7 to 9 | 8 | 3.25 | 4.75 | 6.5 |
| VI. Privacy Program Operational Life Cycle: Responding to Requests and Incidents | 10 to 14 | 12 | 4.75 | 7.25 | 9.5 |
| Total | 75 | 30 | 45 | 60 |
Hours are in quarter hours: 0.25 is 15 minutes, 0.5 is 30 minutes and 0.75 is 45 minutes. Domains are rounded to quarter hours so that every column adds up to its budget.
Pace for timed practice
| Set | Questions | Time at the exam's average pace |
|---|---|---|
| One question | 1 | 1 minute 40 seconds |
| Short timed set | 18 | 30 minutes |
| One half of the exam | 45 | 75 minutes |
| Full exam | 90 | 2.5 hours |
Competencies, largest first
The IAPP prints a range for each competency as well as each domain. The competency ranges do not add up to the domain ranges, so read each figure on its own.
| Competency | Range | Read | Studied | Practiced |
|---|---|---|---|---|
| II.A Create policies and processes to be followed across all stages of the privacy program life cycle | 6 to 8 | [ ] | [ ] | [ ] |
| I.C Indicate in-scope laws, regulations and standards applicable to the program | 5 to 7 | [ ] | [ ] | [ ] |
| VI.A Respond to data subject access requests and privacy rights | 5 to 7 | [ ] | [ ] | [ ] |
| I.A Define program scope and develop a privacy strategy | 4 to 6 | [ ] | [ ] | [ ] |
| I.B Communicate organizational vision and mission statement | 4 to 6 | [ ] | [ ] | [ ] |
| IV.A Apply information security practices and policies | 4 to 6 | [ ] | [ ] | [ ] |
| III.A Document data governance systems | 3 to 5 | [ ] | [ ] | [ ] |
| III.D Evaluate technical controls | 3 to 5 | [ ] | [ ] | [ ] |
| IV.C Apply organizational guidelines for data use and ensure technical controls are enforced | 3 to 5 | [ ] | [ ] | [ ] |
| V.C Manage continuous assessment of the privacy program | 3 to 5 | [ ] | [ ] | [ ] |
| VI.B Follow organizational incident handling and response procedures | 3 to 5 | [ ] | [ ] | [ ] |
| II.C Define privacy metrics for oversight and governance | 2 to 4 | [ ] | [ ] | [ ] |
| III.E Evaluate risks associated with shared data in mergers, acquisitions and divestitures | 2 to 4 | [ ] | [ ] | [ ] |
| II.B Clarify roles and responsibilities | 1 to 3 | [ ] | [ ] | [ ] |
| II.D Establish training and awareness activities | 1 to 3 | [ ] | [ ] | [ ] |
| III.B Evaluate processors and third-party vendors | 1 to 3 | [ ] | [ ] | [ ] |
| IV.B Integrate the main principles of Privacy by Design (PbD) | 1 to 3 | [ ] | [ ] | [ ] |
| V.A Use metrics to measure the performance of the privacy program | 1 to 3 | [ ] | [ ] | [ ] |
| V.B Audit the privacy program | 1 to 3 | [ ] | [ ] | [ ] |
| VI.C Evaluate and modify current incident response plan | 1 to 3 | [ ] | [ ] | [ ] |
| III.C Evaluate physical and environmental controls | 0 to 2 | [ ] | [ ] | [ ] |
Before exam day
- Hours booked in the calendar for your column (our suggestion)
- At least one timed half: 45 questions in 75 minutes (our suggestion)
- Multi-select questions practiced: the exam asks for an exact number of answers and gives no partial credit (IAPP)
- Exam booked at least 24 hours ahead, inside one year of purchase (IAPP rule)
What does the CIPM cost, and what are the rules?
The exam is USD 550 on the IAPP Store for members and non-members alike, or USD 375 if you have attempted it before or hold another IAPP certification. You must sit within one year of buying it, and book at least 24 hours ahead. After passing, the certification is activated by a USD 250 maintenance fee per two-year term or by IAPP membership at USD 295 a year, and you need 20 CPE credits per term. If you do not pass, you can book again no sooner than seven days after the previous attempt.
At a test center you need two qualifying forms of ID, and no reading material goes into the room. Online, use a personal computer with no VPN and stay in view of the webcam outside the scheduled break.
How should you prepare?
The IAPP's own textbook for the CIPM is "Privacy Program Management: Tools for Managing Privacy Within Your Organization". For a single text mapped to the blueprint, the CIPM study guide covers all six domains and 21 competencies of version 4.2.0, weighted to the published ranges. For practice, the 200 CIPM practice questions carry a rationale for every answer. They are single-answer questions, so add multi-select practice from the IAPP's own materials before the day.
What should you do this week?
Download the Body of Knowledge, version 4.2.0, from the CIPM page, take the planner's column for your budget, and book your hours. Credential Press is independent of the IAPP, and nothing here comes from inside the exam.
Frequently asked questions
How many questions are on the CIPM exam?
90 multiple-choice questions in 2.5 hours, according to the IAPP's certification FAQ and exam store page. Some ask for more than one answer and say so, with no partial credit.
What is the CIPM pass mark?
300 on a scale of 100 to 500. The IAPP says 300 does not represent 60%.
Which CIPM domain has the most questions?
Domain I, Developing a Framework, with 14 to 18 questions. The largest single competency is II.A, policies and processes across the privacy program life cycle, with 6 to 8.
What languages is the CIPM offered in?
English, French, German, Chinese and Brazilian Portuguese, on the IAPP Store's CIPM exam page.
How should I split my CIPM study hours?
By the midpoint of each domain's range: 16, 14, 14, 11, 8 and 12, which add up to 75. On 30 hours that is 6 h 30 min, 5 h 30 min, 5 h 30 min, 4 h 30 min, 3 h 15 min and 4 h 45 min.
How much does the CIPM cost?
USD 550 on the IAPP Store, the same for members and non-members, or USD 375 if you have attempted the exam before or hold another IAPP certification.
CIPM: test yourself in five minutes
Which books prepare you for the CIPM?
Certified Information Privacy Manager. 21 chapters, 472 pages.
Practice questions with full rationales, weighted to the published blueprint. 216 pages.
Sources
Every IAPP figure above was read from the document itself on 2 October 2026. The study hours are our arithmetic on those figures.
- IAPP, CIPM certification page and Body of Knowledge, version 4.2.0, effective 1 September 2025
- IAPP, Privacy Candidate Handbook, version 5.3.2
- IAPP, Certification FAQs
- IAPP Store, CIPM exam
- NIST, Privacy Framework
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. Exam names and trademarks belong to their owners.