CIPP/E
What is on the IAPP CIPP/E exam?
The IAPP's CIPP/E exam is 90 multiple-choice questions in 2.5 hours, with an optional 15-minute break at the halfway point. It is scored from 100 to 500, and 300 passes. The questions come from the five domains of the CIPP/E Body of Knowledge, version 1.3.3, effective 1 September 2025, and the IAPP publishes a minimum and a maximum number of questions for each one.
Every fact below comes from the IAPP's own documents: the Privacy Candidate Handbook, version 5.3.2, the certification FAQs, the CIPP/E page and its Body of Knowledge, and the IAPP Store, all read on 2 October 2026.
How is the CIPP/E exam structured?
The IAPP's FAQ and its exam store page both give 90 questions and 2.5 hours. Halfway through, you are offered a 15-minute break, and the break splits the exam into two halves, each with half the questions and half the time. Once you submit the first half, you cannot go back to it.
All IAPP exams are multiple choice, with one or more correct answers, and a question tells you when it has more than one. A multi-select question asks for an exact number, such as "Select 3 of the 5 options below", and there is no partial credit. Some questions follow a short scenario.
IAPP Privacy Candidate Handbook v5.3.2; IAPP Certification FAQs
Not every question counts. The current handbook says the number of scored and unscored questions is listed on the designation's page, and on 2 October 2026 the CIPP/E page did not show it. The IAPP's older certification pages and its 2024 handbook gave 15 unscored questions out of 90. The exam is offered in English, French and German.
Which CIPP/E domains carry the most questions?
The Body of Knowledge prints the minimum and maximum number of questions that will come from each domain. The bars show each domain's maximum.
| Domain | Questions | Competencies |
|---|---|---|
| I. Introduction to European Data Protection | 7 to 13 | 3 |
| II. European Data Protection Law and Regulation | 18 to 28 | 3 |
| III. European Data Processing | 13 to 21 | 4 |
| IV. European Data Protection: Scope and Accountability | 8 to 18 | 4 |
| V. Compliance with European Data Protection Law and Regulation | 8 to 16 | 4 |
Want it on one page? Our free CIPP/E mind map gives the five domains and 18 competencies with a mnemonic, and the 10-question CIPP/E quiz checks your recall in five minutes.
Domain II is the heaviest, and two of its competencies are the largest on the whole blueprint: data subjects' rights (8 to 12 questions) and maintaining the security of personal data (7 to 11). The legislative framework behind European data protection (5 to 8) and the GDPR's accountability requirements (4 to 8) come next. Those four competencies can supply up to 39 questions between them.
How is the CIPP/E scored?
All core IAPP exams are scored on a scale from 100 to 500, and 300 or above passes. The IAPP's FAQ adds that 300 "does not represent 60%". Your raw score is the number of scored questions you get right, converted to the scale because exam forms can differ slightly in difficulty. No question is weighted more than another, and there is no minimum for any section.
IAPP Privacy Candidate Handbook v5.3.2; IAPP Certification FAQs
The result shows on screen when you finish. The score report gives the percentage you answered correctly in each blueprint domain, and the handbook warns against averaging those percentages to work out a passing score. Use them to find the domain to study next.
What does the Body of Knowledge cover beyond the GDPR?
Version 1.3.3 reaches past the GDPR. Its legislative framework competency names the NIS and NIS 2 Directives and the EU Artificial Intelligence Act. International transfers include the basics of the EU-US Data Privacy Framework and transfer impact assessments. Accountability and enforcement include when class actions over GDPR violations may be filed, and the compliance competency covers the compliance and ethical issues of artificial intelligence, including machine learning.
Read those topics in the primary texts, starting with the GDPR on EUR-Lex and the EDPB's guidelines for controllers and processors. The handbook says no question will be on the exam that is not covered by a topic or subtopic in the Body of Knowledge, so the BoK is also your list of what you can leave out.
The IAPP updates its exams every year, changing about 10% to 15% of the content, and announces Body of Knowledge changes at least 90 days ahead. On 2 October 2026 no change to the CIPP/E had been announced.
What does the CIPP/E cost?
| Item | Price (IAPP Store, 2 Oct 2026) |
|---|---|
| CIPP/E exam | USD 550, members and non-members alike |
| If you have attempted the exam before, or hold another IAPP certification | USD 375 |
| Certification maintenance fee | USD 250 per two-year term, included in membership |
| IAPP membership | USD 295 a year |
You must schedule and sit the exam within one year of buying it, or the exam is closed and the fee forfeited. The IAPP's refund policy says "We do not give refunds, BUT, we do offer credits," and does not mention exams specifically.
What happens on exam day?
You sit at a Pearson VUE test center or online through OnVUE. Book at least 24 hours ahead. A test center booking can be moved up to 48 hours before; an online one up to 15 minutes after the scheduled start.
At a test center you need two qualifying forms of ID, and no electronic devices or reading material of any kind go into the room. You can leave for a break, but the timer keeps running. Online, use a personal computer with no VPN, keep to one drink, and stay in view of the webcam: leaving it outside the scheduled break ends the exam.
IAPP CIPP/E exam-day checklist
IAPP CIPP/E: exam-day checklist
Rules come from the IAPP Privacy Candidate Handbook, version 5.3.2 (effective 1 June 2026), the IAPP Certification FAQs and the IAPP Store, all read on 2 October 2026. Suggestions are marked as ours. Check the IAPP's pages before your exam in case anything has changed.
When you buy
- You have one year from purchase to schedule and sit the exam; expired exams are closed and the fee is forfeited (IAPP rule)
- The name in your MyIAPP profile matches the name on your ID exactly (IAPP rule)
- Choose: a Pearson VUE test center, or OnVUE online proctoring (IAPP)
Booking
- Book at least 24 hours ahead (IAPP rule)
- Test center: reschedule or cancel at least 48 hours before the appointment (IAPP rule)
- OnVUE: reschedule or cancel up to 15 minutes after the scheduled start (IAPP rule)
- Missing the appointment counts as a no-show and uses up the attempt (IAPP rule)
Test center
- Two qualifying forms of ID that meet Pearson VUE's requirements (IAPP rule)
- Arrive 15 minutes early (IAPP advice)
- No electronic devices and no reading material in the exam room (IAPP rule)
- You may leave for a break, but the timer keeps running (IAPP rule)
OnVUE (online)
- A personal computer, not a work-issued device; no VPN (IAPP rule)
- The Begin button appears 30 minutes before the appointment (IAPP)
- A photo of yourself, a government-issued photo ID, and four photos of the room (IAPP rule)
- One drink allowed; no food, headphones, external monitors or speaking aloud (IAPP rule)
- Leaving the webcam's view outside the scheduled break ends the exam (IAPP rule)
In the exam
| What | Figure |
|---|---|
| Questions | 90, multiple choice; some ask for more than one answer and say so |
| Multi-select scoring | You must pick the exact number asked for; no partial credit |
| Time | 2.5 hours (150 minutes) |
| Break | Optional 15 minutes at halfway; you cannot go back to the first half |
| Average per question | 1 minute 40 seconds |
| Each half | 45 questions in 75 minutes |
| Scale | 100 to 500; 300 passes, and 300 is not 60% |
- Answer every question; the score counts correct answers and nothing is weighted (IAPP)
- Flag and move on when a question stalls; you cannot return to the first half after the break (our suggestion)
After
- The result shows on screen straight away; allow up to two business days for it to reach your MyIAPP profile (IAPP)
- Passed: pay the certification maintenance fee (USD 250 per two-year term) or hold IAPP membership, or the certification is not activated (IAPP rule)
- Not passed: buy a new attempt once the result shows in MyIAPP, and book no sooner than seven days after the last one (IAPP rule)
- Use the score report's percentage per domain to choose what to study, and do not average those percentages to guess a score (IAPP advice)
How should you prepare?
The IAPP recommends at least 30 hours of study for each certification, and names "European Data Protection: Law and Practice" as the authoritative reference for the CIPP/E. The pace on the day is about 1 minute 40 seconds a question, 45 questions in each 75-minute half. Our CIPP/E study plan splits 30, 45 or 60 hours across the five domains by the published ranges.
The CIPP/E exam guide maps one chapter to each of the 18 competencies and is written from the Official Journal text of the GDPR, the ePrivacy Directive, Directive 95/46/EC, the Charter and the Treaty. For practice, the 201 CIPP/E practice questions are weighted to the blueprint, and each rationale names the Article that decides it. They are single-answer questions, so practice the multi-select format on the IAPP's own materials too.
What if you do not pass?
You can buy a new attempt once the result shows in your MyIAPP profile, which can take up to two business days, and you cannot book a date sooner than seven days after the previous attempt. No IAPP document we read sets a limit on attempts. The domain percentages on your score report tell you where to start.
How do you keep the CIPP/E once you pass?
The certification is activated when you pay the maintenance fee or hold IAPP membership. Over each two-year term you need 20 hours of continuing professional education per certification, and up to 10 surplus credits earned in the term's final six months can carry over. If you would rather not submit credits, the IAPP allows you to retest instead.
What should you do this week?
Download the Body of Knowledge, version 1.3.3, from the CIPP/E page, print the checklist, and book a date inside the one-year window. Credential Press is independent of the IAPP, and nothing here comes from inside the exam.
Frequently asked questions
How many questions are on the CIPP/E exam?
90 multiple-choice questions in 2.5 hours, according to the IAPP's certification FAQ and exam store page. Some questions ask for more than one answer, and the question says so.
What is the CIPP/E pass mark?
300 on a scale of 100 to 500. The IAPP says 300 does not represent 60%. Raw scores are converted to the scale because exam forms can differ slightly in difficulty.
Is the CIPP/E open book?
Not at a test center: the handbook says no reading material of any kind is admitted to the exam room. Online exams run under a proctor, with no external monitors allowed.
How much does the CIPP/E cost?
USD 550 for members and non-members alike on the IAPP Store, or USD 375 if you have attempted the exam before or hold another IAPP certification. After passing, a USD 250 maintenance fee per two-year term, or IAPP membership at USD 295 a year, keeps it active.
Which CIPP/E domain has the most questions?
Domain II, European Data Protection Law and Regulation, with 18 to 28 questions. Within it, data subjects' rights (8 to 12) and the security of personal data (7 to 11) are the two largest competencies on the blueprint.
How soon can I retake the CIPP/E?
You can buy a new attempt once your result shows in your MyIAPP profile, and you cannot book a date sooner than seven days after the previous attempt.
CIPP/E: test yourself in five minutes
Which books prepare you for the CIPP/E?
Certified Information Privacy Professional, Europe. 18 chapters, 441 pages.
Sources
Every figure above was read from the document itself on 2 October 2026.
- IAPP, Privacy Candidate Handbook: Procedures and policies, version 5.3.2, effective 1 June 2026
- IAPP, Certification FAQs
- IAPP, CIPP/E certification page and Body of Knowledge, version 1.3.3, effective 1 September 2025
- IAPP Store, CIPP/E exam
- IAPP, Certification Continuing Professional Education Policy, version 3.3.1
- Regulation (EU) 2016/679, the General Data Protection Regulation, EUR-Lex
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. Exam names and trademarks belong to their owners.