CIPP/E
How should you split your study time for the CIPP/E?
Start from the IAPP's own numbers. It recommends at least 30 hours of study, and its Body of Knowledge gives a minimum and maximum number of questions for each of the five domains. Split your hours by the midpoint of each range and Domain II, European Data Protection Law and Regulation, gets nearly a third of them.
The ranges come from the CIPP/E Body of Knowledge, version 1.3.3, effective 1 September 2025, on the IAPP's CIPP/E page, and the 30 hours from the IAPP's certification FAQs, both read on 2 October 2026. The hours and plans are ours. For the format, scoring and rules, see what is on the IAPP CIPP/E exam.
How many hours should each CIPP/E domain get?
Take the midpoint of each domain's published range. The five midpoints add up to 75, so on 30 hours each midpoint question is worth 24 minutes.
| Domain | Range | Midpoint | 30-hour plan |
|---|---|---|---|
| I. Introduction to European Data Protection | 7 to 13 | 10 | 4 h |
| II. European Data Protection Law and Regulation | 18 to 28 | 23 | 9 h 15 min |
| III. European Data Processing | 13 to 21 | 17 | 6 h 45 min |
| IV. European Data Protection: Scope and Accountability | 8 to 18 | 13 | 5 h 15 min |
| V. Compliance with European Data Protection Law and Regulation | 8 to 16 | 12 | 4 h 45 min |
| Total | 75 | 30 h |
Want it on one page? Our free CIPP/E mind map gives the five domains and 18 competencies with a mnemonic, and the 10-question CIPP/E quiz checks your recall in five minutes.
Domains II to V land between quarter hours, so we round them alternately up and down by 3 minutes; the column still adds up to 30 hours. The planner below gives the same split for 45 and 60 hours. Why midpoints? A domain's real count on your exam form can be anywhere in its range, and the midpoint is the fairest single guess. The IAPP does not say how many questions are scored, so treat the 75 as our arithmetic.
CIPP/E study planner
IAPP CIPP/E: study planner
Question ranges come from the IAPP CIPP/E Body of Knowledge, version 1.3.3, effective 1 September 2025, read on 2 October 2026. The 30-hour minimum is the IAPP's recommendation (IAPP Certification FAQs). The hours are our suggestion: each domain gets a share in proportion to the midpoint of its published range. Check the IAPP's CIPP/E page before you start in case the Body of Knowledge has changed.
Hours by domain
The midpoints add up to 75, so on 30 hours each midpoint question is worth 24 minutes.
| Domain | Range | Midpoint | 30 hours | 45 hours | 60 hours |
|---|---|---|---|---|---|
| I. Introduction to European Data Protection | 7 to 13 | 10 | 4 | 6 | 8 |
| II. European Data Protection Law and Regulation | 18 to 28 | 23 | 9.25 | 13.75 | 18.5 |
| III. European Data Processing | 13 to 21 | 17 | 6.75 | 10.25 | 13.5 |
| IV. European Data Protection: Scope and Accountability | 8 to 18 | 13 | 5.25 | 7.75 | 10.5 |
| V. Compliance with European Data Protection Law and Regulation | 8 to 16 | 12 | 4.75 | 7.25 | 9.5 |
| Total | 75 | 30 | 45 | 60 |
Hours are in quarter hours: 0.25 is 15 minutes, 0.5 is 30 minutes and 0.75 is 45 minutes. Domains II to V are rounded to the nearest quarter hour, alternately up and down, so every column still adds up to its budget.
Pace for timed practice
| Set | Questions | Time at the exam's average pace |
|---|---|---|
| One question | 1 | 1 minute 40 seconds |
| Short timed set | 18 | 30 minutes |
| One half of the exam | 45 | 75 minutes |
| Full exam | 90 | 2.5 hours |
Competencies, largest first
Tick each one when you have read it in the Body of Knowledge, studied it, and done practice questions on it.
| Competency | Range | Read | Studied | Practiced |
|---|---|---|---|---|
| II.C Understand data subjects' rights | 8 to 12 | [ ] | [ ] | [ ] |
| II.B Understand the requirements involved in maintaining the security of personal data | 7 to 11 | [ ] | [ ] | [ ] |
| I.C Understand the legislative framework underpinning the principles of European data protection | 5 to 8 | [ ] | [ ] | [ ] |
| IV.B Understand the various accountability requirements under the GDPR | 4 to 8 | [ ] | [ ] | [ ] |
| III.C Understand information provision obligations | 4 to 6 | [ ] | [ ] | [ ] |
| III.D Understand the principles of, and the risks involved in, international data transfers | 4 to 6 | [ ] | [ ] | [ ] |
| II.A Understand basic GDPR data protection concepts | 3 to 5 | [ ] | [ ] | [ ] |
| III.B Know what constitutes a lawful processing basis | 3 to 5 | [ ] | [ ] | [ ] |
| V.A Compliance in the workplace, specifically as it relates to employment relationships | 3 to 5 | [ ] | [ ] | [ ] |
| III.A Understand the principles of European data processing | 2 to 4 | [ ] | [ ] | [ ] |
| IV.A Understand issues related to the territorial and material scope of the GDPR | 2 to 4 | [ ] | [ ] | [ ] |
| V.C Compliance related to direct marketing | 2 to 4 | [ ] | [ ] | [ ] |
| V.D Compliance related to internet technology and communications | 2 to 4 | [ ] | [ ] | [ ] |
| I.A Understand the origins and historical context of European data protection laws | 1 to 3 | [ ] | [ ] | [ ] |
| IV.C Understand the European data protection supervision and enforcement structure | 1 to 3 | [ ] | [ ] | [ ] |
| IV.D Understand the consequences for GDPR violations | 1 to 3 | [ ] | [ ] | [ ] |
| V.B Compliance related to surveillance activities | 1 to 3 | [ ] | [ ] | [ ] |
| I.B Understand the roles and functions of significant European Union institutions | 1 to 2 | [ ] | [ ] | [ ] |
Competency names for domain V are shortened; the Body of Knowledge gives the full wording.
Before exam day
- Hours booked in the calendar for your column (our suggestion)
- At least one timed half: 45 questions in 75 minutes (our suggestion)
- Multi-select questions practiced: the exam asks for an exact number of answers and gives no partial credit (IAPP)
- Exam booked at least 24 hours ahead, inside one year of purchase (IAPP rule)
Which competencies deserve the most time?
Inside the domains, the Body of Knowledge also gives a range for each of the 18 competencies. Four of them can supply up to 39 questions between them:
- II.C Data subjects' rights: 8 to 12 questions
- II.B Maintaining the security of personal data: 7 to 11
- I.C The legislative framework underpinning European data protection: 5 to 8
- IV.B Accountability requirements under the GDPR: 4 to 8
Study these four first, from the text of the GDPR itself, and come back to them in your last week. The smallest, the roles of the EU institutions, has 1 to 2 questions.
What does the CIPP/E pace mean for practice?
90 questions in 150 minutes is 1 minute 40 seconds a question on average. The optional 15-minute break splits the exam into two halves of 45 questions and 75 minutes each, and once you submit the first half you cannot return to it.
Some questions ask for more than one answer, for example "Select 3 of the 5 options below", and you must pick exactly that number to score; there is no partial credit. Practice that format before the day. Our practice book's questions are single-answer, so add multi-select practice from the IAPP's own materials.
Work untimed while you learn a domain, then switch to timed sets of 18 questions in 30 minutes. In the last week, sit one full half, 45 questions in 75 minutes, without stopping.
Which primary sources should you read?
The IAPP names "European Data Protection: Law and Practice" as the authoritative reference for the CIPP/E. Alongside it, read the primary texts the Body of Knowledge points at: the GDPR, the EDPB's guidelines for controllers and processors, and the European Commission's data protection pages for international transfers and adequacy.
The current Body of Knowledge also names the NIS and NIS 2 Directives and the EU AI Act under the legislative framework, the EU-US Data Privacy Framework and transfer impact assessments under international transfers, and the compliance and ethical issues of artificial intelligence under internet technology and communications. Give each the share of hours its competency earns.
For one text that follows the blueprint, the CIPP/E study guide gives each of the 18 competencies its own chapter. For practice, the CIPP/E practice questions with rationales are weighted to the published ranges.
What can you leave out?
Anything outside the Body of Knowledge. The IAPP's handbook says no question will be on the exam that is not covered by a topic or subtopic in it. If you work in the UK, the ICO's guidance is on the UK GDPR, which is a separate law; use it for work, and the EU texts for the exam.
What should you do first?
Download the planner, pick your column and book the hours. Then read the Body of Knowledge once, start to finish, so you know what each competency asks. No study plan promises a pass, ours included. Credential Press is independent of the IAPP, and nothing here comes from inside the exam.
Frequently asked questions
How many hours should I study for the CIPP/E?
The IAPP recommends at least 30 hours of study for each certification. Our planner gives columns for 30, 45 and 60 hours.
How should CIPP/E study hours be split across the domains?
In proportion to the midpoint of each domain's published question range: 10, 23, 17, 13 and 12, which add up to 75. On 30 hours that is 4 h, 9 h 15 min, 6 h 45 min, 5 h 15 min and 4 h 45 min.
Which CIPP/E topics carry the most questions?
Data subjects' rights (8 to 12 questions) and the security of personal data (7 to 11), both in Domain II. The legislative framework (5 to 8) and the GDPR's accountability requirements (4 to 8) come next.
How fast do I need to answer CIPP/E questions?
90 questions in 150 minutes is 1 minute 40 seconds a question on average. Each half of the exam is 45 questions in 75 minutes, and you cannot go back to the first half after the break.
Do I need to study the EU AI Act for the CIPP/E?
It is named in the current Body of Knowledge, under the legislative framework competency, alongside the NIS and NIS 2 Directives. Study it to the depth that competency's 5 to 8 questions allow, shared with the rest of the framework.
CIPP/E: test yourself in five minutes
Which books fit this study plan?
Certified Information Privacy Professional, Europe. 18 chapters, 441 pages.
Sources
Every IAPP figure above was read from the document itself on 2 October 2026. The hours are our arithmetic on those figures, and the plans are our suggestions.
- IAPP, CIPP/E certification page and Body of Knowledge, version 1.3.3, effective 1 September 2025
- IAPP, Certification FAQs
- IAPP, Privacy Candidate Handbook, version 5.3.2
- Regulation (EU) 2016/679, the General Data Protection Regulation, EUR-Lex
- European Data Protection Board, guidelines relevant for controllers and processors
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. Exam names and trademarks belong to their owners.