CIPP/US
What is on the IAPP CIPP/US exam, and where should your study hours go?
The IAPP's CIPP/US exam is 90 multiple-choice questions in 2.5 hours, scored from 100 to 500 with 300 to pass. Its Body of Knowledge, version 2.6.1, effective 1 September 2025, gives a question range for each of five domains, and two of them dominate: the U.S. privacy environment (27 to 33 questions) and state privacy laws (17 to 21).
The facts below come from the IAPP's Privacy Candidate Handbook, version 5.3.2, its certification FAQs, the CIPP/US page and its Body of Knowledge, and the IAPP Store, all read on 2 October 2026. The study hours are ours.
How is the CIPP/US exam structured?
90 questions in 2.5 hours averages 1 minute 40 seconds each. Halfway through you are offered a 15-minute break, which splits the exam into two halves of 45 questions and 75 minutes; once you submit the first half, you cannot return to it.
All IAPP exams are multiple choice with one or more correct answers. A multi-select question says how many to choose, such as "Select 3 of the 5 options below", and there is no partial credit. Some questions follow a scenario. Scores run from 100 to 500, 300 passes, and the IAPP's FAQ says 300 "does not represent 60%".
IAPP Privacy Candidate Handbook v5.3.2; IAPP Certification FAQs
The CIPP/US is offered in English, at a Pearson VUE test center or online through OnVUE. The result shows on screen when you finish, with the percentage you scored in each domain.
Which CIPP/US domains carry the most questions?
| Domain | Questions |
|---|---|
| I. The U.S. Privacy Environment | 27 to 33 |
| II. Federal Privacy Laws | 15 to 19 |
| III. Government and Court Access to Private-sector Information | 3 to 5 |
| IV. Workplace Privacy | 4 to 6 |
| V. State Privacy Laws | 17 to 21 |
Two competencies stand out. The principles of information management from a U.S. perspective (I.C) has 18 to 22 questions, the largest on the blueprint, and the key concepts and principles of state data privacy and security laws (V.B) has 13 to 17. Government and court access (3 to 5) and workplace privacy (4 to 6) are small. One caution: the IAPP's competency ranges for the CIPP/US do not add up to its domain ranges, so read each figure as printed.
What does the current Body of Knowledge name?
Version 2.6.1 is specific about recent law. Under the FTC competency, it asks you to identify priority areas in future federal enforcement, "e.g., data brokers, IoT, AI, biometrics, unregulated data". Under healthcare, it names online tracking technologies used by HIPAA-covered entities and business associates. The enforcement competency names the California Privacy Protection Agency, and the state law competency names laws such as Washington's My Health, My Data Act (2023), Nevada's Consumer Health Data Privacy Act (SB 370) and New York City's automated employment decision tool law.
Read the regulators' own pages for those topics: the FTC's privacy and security guidance, its COPPA Rule page, the California Privacy Protection Agency and the California Attorney General's CCPA page. The IAPP names "U.S. Private-sector Privacy: Law and Practice for Information Privacy Professionals" as the authoritative reference.
How should you split your CIPP/US study hours?
The IAPP recommends at least 30 hours. Split them by the midpoint of each domain's range; the midpoints add up to 75, so on 30 hours each is worth 24 minutes.
| Domain | Midpoint | 30-hour plan |
|---|---|---|
| I. The U.S. Privacy Environment | 30 | 12 h |
| II. Federal Privacy Laws | 17 | 6 h 45 min |
| III. Government and Court Access | 4 | 1 h 45 min |
| IV. Workplace Privacy | 5 | 2 h |
| V. State Privacy Laws | 19 | 7 h 30 min |
| Total | 75 | 30 h |
Domains II, III and V fall between quarter hours, so we round them to keep the total at 30. The planner has the same split for 45 and 60 hours and a checklist of all 16 competencies. Our suggestion: start with I.C and V.B, which can supply up to 39 questions between them.
CIPP/US study planner
IAPP CIPP/US: study planner
Question ranges come from the IAPP CIPP/US Body of Knowledge, version 2.6.1, effective 1 September 2025, read on 2 October 2026. The 30-hour minimum is the IAPP's recommendation (IAPP Certification FAQs). The hours are our suggestion: each domain gets a share in proportion to the midpoint of its published range. Check the IAPP's CIPP/US page before you start in case the Body of Knowledge has changed.
Hours by domain
The midpoints add up to 75, so on 30 hours each midpoint question is worth 24 minutes.
| Domain | Range | Midpoint | 30 hours | 45 hours | 60 hours |
|---|---|---|---|---|---|
| I. The U.S. Privacy Environment | 27 to 33 | 30 | 12 | 18 | 24 |
| II. Federal Privacy Laws | 15 to 19 | 17 | 6.75 | 10.25 | 13.5 |
| III. Government and Court Access to Private-sector Information | 3 to 5 | 4 | 1.75 | 2.5 | 3.25 |
| IV. Workplace Privacy | 4 to 6 | 5 | 2 | 3 | 4 |
| V. State Privacy Laws | 17 to 21 | 19 | 7.5 | 11.25 | 15.25 |
| Total | 75 | 30 | 45 | 60 |
Hours are in quarter hours: 0.25 is 15 minutes, 0.5 is 30 minutes and 0.75 is 45 minutes. Domains II, III and V are rounded to quarter hours so that every column adds up to its budget.
Pace for timed practice
| Set | Questions | Time at the exam's average pace |
|---|---|---|
| One question | 1 | 1 minute 40 seconds |
| Short timed set | 18 | 30 minutes |
| One half of the exam | 45 | 75 minutes |
| Full exam | 90 | 2.5 hours |
Competencies, largest first
The IAPP prints a range for each competency as well as each domain. The competency ranges do not add up to the domain ranges, so read each figure on its own.
| Competency | Range | Read | Studied | Practiced |
|---|---|---|---|---|
| I.C Understand the principles of information management from a U.S. perspective | 18 to 22 | [ ] | [ ] | [ ] |
| V.B Understand the key concepts and principles of state data privacy and security laws | 13 to 17 | [ ] | [ ] | [ ] |
| I.B Understand the enforcement framework for U.S. privacy and security laws | 5 to 7 | [ ] | [ ] | [ ] |
| I.A Understand the U.S. legal framework | 3 to 5 | [ ] | [ ] | [ ] |
| II.A Understand how the Federal Trade Commission addresses consumer protection in regard to privacy and security | 3 to 5 | [ ] | [ ] | [ ] |
| II.B Understand how healthcare and medical privacy is regulated | 3 to 5 | [ ] | [ ] | [ ] |
| II.C Understand how financial sector privacy is regulated | 3 to 5 | [ ] | [ ] | [ ] |
| II.E Understand how privacy is regulated in telecommunications and marketing activities | 2 to 4 | [ ] | [ ] | [ ] |
| IV.B Understand workplace privacy issues that arise before, during and after employment | 2 to 4 | [ ] | [ ] | [ ] |
| V.C Understand the key principles of state data breach notification laws | 2 to 4 | [ ] | [ ] | [ ] |
| II.D Understand how education sector privacy is regulated | 1 to 3 | [ ] | [ ] | [ ] |
| III.B Understand the relationship between national security and privacy | 1 to 3 | [ ] | [ ] | [ ] |
| IV.A Understand the issues involved in workplace privacy | 1 to 3 | [ ] | [ ] | [ ] |
| III.A Understand the relationship between law enforcement and privacy issues | 1 to 2 | [ ] | [ ] | [ ] |
| III.C Understand issues regarding civil litigation and privacy | 1 to 2 | [ ] | [ ] | [ ] |
| V.A Understand concepts of authority governing state privacy laws | 1 to 2 | [ ] | [ ] | [ ] |
Before exam day
- Hours booked in the calendar for your column (our suggestion)
- At least one timed half: 45 questions in 75 minutes (our suggestion)
- Multi-select questions practiced: the exam asks for an exact number of answers and gives no partial credit (IAPP)
- Exam booked at least 24 hours ahead, inside one year of purchase (IAPP rule)
What does the CIPP/US cost, and what are the rules?
The exam is USD 550 on the IAPP Store for members and non-members alike, or USD 375 if you have attempted it before or hold another IAPP certification. You must sit within one year of buying it, and book at least 24 hours ahead. After passing, the certification is activated by a USD 250 maintenance fee per two-year term or by IAPP membership at USD 295 a year, and you need 20 CPE credits per term. If you do not pass, you can book again no sooner than seven days after the previous attempt.
At a test center you need two qualifying forms of ID, and no reading material goes into the room. Online, use a personal computer with no VPN and stay in view of the webcam outside the scheduled break.
How should you prepare?
The CIPP/US exam guide maps its 20 chapters to all five domains and 16 competencies and teaches each statute from its own text. For practice, the 200 CIPP/US practice questions are weighted to the blueprint, with a rationale for every option. They are single-answer questions, so add multi-select practice from the IAPP's own materials before the day.
What should you do this week?
Download the Body of Knowledge, version 2.6.1, from the CIPP/US page, take the planner's column for your budget, and book your hours. Credential Press is independent of the IAPP, and nothing here comes from inside the exam.
Frequently asked questions
How many questions are on the CIPP/US exam?
90 multiple-choice questions in 2.5 hours, according to the IAPP's certification FAQ and exam store page. Some ask for more than one answer and say so, with no partial credit.
What is the CIPP/US pass mark?
300 on a scale of 100 to 500. The IAPP says 300 does not represent 60%.
Which CIPP/US domain has the most questions?
Domain I, The U.S. Privacy Environment, with 27 to 33 questions. Its competency on the principles of information management from a U.S. perspective (18 to 22) is the largest on the blueprint.
How much of the CIPP/US is state law?
Domain V, State Privacy Laws, has 17 to 21 questions, and its competency on state data privacy and security laws alone has 13 to 17.
How should I split my CIPP/US study hours?
By the midpoint of each domain's range: 30, 17, 4, 5 and 19, which add up to 75. On 30 hours that is 12 h, 6 h 45 min, 1 h 45 min, 2 h and 7 h 30 min.
How much does the CIPP/US cost?
USD 550 on the IAPP Store, the same for members and non-members, or USD 375 if you have attempted the exam before or hold another IAPP certification.
CIPP/US: for interviews and hiring
Which books prepare you for the CIPP/US?
Certified Information Privacy Professional, United States. 20 chapters, 520 pages.
Practice questions with full rationales, weighted to the published blueprint. 217 pages.
Sources
Every IAPP figure above was read from the document itself on 2 October 2026. The study hours are our arithmetic on those figures.
- IAPP, CIPP/US certification page and Body of Knowledge, version 2.6.1, effective 1 September 2025
- IAPP, Privacy Candidate Handbook, version 5.3.2
- IAPP, Certification FAQs
- IAPP Store, CIPP/US exam
- Federal Trade Commission, Privacy and Security
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. Exam names and trademarks belong to their owners.