CIPM
Running a privacy program: who the CIPM is for
Knowing what privacy law requires is one job. Making an organization meet those requirements every day, across every team, product and vendor, is another. The CIPM is the IAPP's credential for the second job: building, governing, measuring and running a privacy program. This guide is about who does that work, the moments that create it, how the CIPM differs from the CIPP and CIPT, and what the exam will ask.
The facts here come from the IAPP's CIPM page and the CIPM Body of Knowledge, version 4.2.0, the IAPP's Certification Candidate Handbook and certification FAQs, the IAPP and Credo AI AI Governance Profession Report 2025, and our CIPM Exam Guide. Where this page and the IAPP differ, the IAPP wins.
What does a privacy program manager actually do?
The IAPP says the CIPM shows that you are a leader in privacy program administration, equipped with the knowledge to establish, maintain and manage a privacy program across all stages of its life cycle. The Body of Knowledge divides that life cycle into six domains, two about setting the program up and four about running it, and publishes a range of items for each:
| Domain | Items | Competencies |
|---|---|---|
| I. Developing a framework | 14 to 18 | Program scope and strategy; vision and mission; in-scope laws, regulations and standards |
| II. Establishing program governance | 12 to 16 | Policies and processes across the life cycle; roles and responsibilities; privacy metrics; training and awareness |
| III. Assessing data | 12 to 16 | Data governance systems; processors and vendors; physical and technical controls; shared data in mergers, acquisitions and divestitures |
| IV. Protecting personal data | 9 to 13 | Information security practices; Privacy by Design; data use guidelines and technical enforcement |
| V. Sustaining program performance | 7 to 9 | Performance metrics; auditing the program; continuous assessment |
| VI. Responding to requests and incidents | 10 to 14 | Data subject access requests and rights; incident handling; improving the incident response plan |
Unlike the CIPP exams, no single domain dominates. The largest has 14 to 18 items and the smallest 7 to 9, and the 21 competencies are spread across all of them. That is an honest picture of the job. A privacy program manager has to set a strategy, write policies, choose metrics, assess vendors, enforce controls, measure results and handle requests and incidents, often in the same week, and the exam gives each part its share.
The single biggest competency is creating the policies and processes followed across every stage of the program life cycle, at 6 to 8 items. The next biggest are identifying the in-scope laws, regulations and standards and responding to data subject access requests and privacy rights, each at 5 to 7. Between them they describe the core of the role: know what applies, write down how the organization will meet it, and handle the requests that test whether it does.
Who runs privacy programs?
The IAPP describes CIPM holders as leaders in privacy program administration. In practice the job sits in several places, depending on how an organization is built:
| Role | Where the program sits | CIPM domains that carry the day job | Pairs it with |
|---|---|---|---|
| Privacy program manager | A dedicated privacy office | All six, led by II governance | CIPP/E or CIPP/US |
| Data protection officer leading a team | An independent DPO function reporting to top management | I framework; V sustaining; VI requests | CIPP/E |
| Privacy lead in legal or compliance | The legal or compliance department | I.C in-scope laws; II policies | CIPP/E or CIPP/US |
| Privacy lead in security | The security or risk function | III assessing data; IV protecting data | CIPT or CISSP |
| Privacy operations analyst | Running requests, assessments and vendor reviews day to day | III assessing data; VI requests and incidents | CIPP for the region |
| Consultant setting up programs | Several clients, each at a different maturity | I framework; II governance | CIPP for the region |
The pairings are our suggestion, not the IAPP's. They follow a simple rule: the CIPM tells you how to run the program, and a CIPP tells you what the law in your region requires of it. Some privacy leaders end up holding one of each.
The governance work inside the job
The governance domain is where a privacy program becomes real inside an organization. Our guide sets out what it expects. Responsibilities are assigned to internal stakeholders by name. Rules govern how personal data moves, including who approves a transfer to a third party. Where there is a data protection officer, the program keeps that role independent from operational decision-making, which the exam expects you to recognize. And training is matched to the risk of each role rather than delivered once to everyone: software engineers, for example, need Privacy by Design principles, while customer-facing staff need to recognize a rights request.
Vendor work is just as concrete. A program manager has to vet third parties, draft appropriate contracts and assess compliance with the help of the right internal departments. Vendors should demonstrate they meet a baseline before they get access to personal data, and a vendor without basic access controls is a risk to flag, not a box to tick. Where a vendor uses subcontractors, the program monitors that they follow its instructions.
Privacy programs are becoming governance programs
The privacy program can be the base other governance work is built on. The IAPP and Credo AI's AI Governance Profession Report 2025, based on an IAPP survey of more than 670 people in spring 2024, found that organizations often share responsibility for AI governance with privacy and other disciplines, and that a strong number of privacy professionals are continually asked to take on AI governance roles:
| Finding | Figure or statement |
|---|---|
| AI governance professionals typically assigned to ethics, compliance, privacy or legal teams | 50% |
| Respondents who expected privacy, IT, security, and legal and compliance to gain responsibility | Over 50% |
| A common way privacy programs adapt | Adding AI questions to existing privacy assessment processes |
| Newer AI governance programs, in many of the report's case studies | Hire managers with prior experience in a digital governance discipline, such as privacy |
The report is a survey run by a privacy association, so read the privacy findings with that in mind. But the direction is clear enough: the skills the CIPM teaches, building governance, assessments, metrics and response processes, are the ones the report describes organizations reaching for when a new kind of risk arrives.
When does the CIPM start to matter?
Privacy programs are usually built in response to something. These are the moments that most often put the work on someone's desk.
A new law applies
The GDPR, a new state privacy law in the US, or a sector rule creates obligations, and somebody has to turn them into policies, roles, training and processes. The CIPM's first domain starts there: define the program's scope and strategy, and identify the in-scope laws, regulations and standards. The law tells you what; the program decides how.
The board asks how the program is doing
Privacy metrics appear twice in the Body of Knowledge: once in governance, where metrics are defined for oversight, and once in sustaining performance, where they measure the program. Our guide is firm about what makes a metric useful. A metric has value if it drives a business decision, and a metric floating in isolation provides no value. "Reduce privacy-related customer complaints by 15% over six months" is a metric; "be more compliant" is not.
A vendor, or an acquisition, brings new data
Assessing data includes evaluating processors and third-party vendors and, as its own competency, evaluating the risks of shared data in mergers, acquisitions and divestitures. A deal team that buys a company buys its data, its consents and its liabilities too, and the privacy program manager is the person who should see that before signing.
A new product or project starts
The program decides how privacy enters project work. Our guide sets out the tools: a privacy threshold assessment acts as a triage step to decide whether a project involves personal data and needs a full privacy impact assessment or DPIA; a PIA is a deep analysis of how the data is handled; and a DPIA is a legally mandated assessment for processing that poses a high risk to individuals. Timing matters too: a DPIA cannot mitigate risk if the high-risk processing is already running in production.
Requests and incidents arrive
The last domain is where the program meets the public. A customer service agent needs to recognize an access request even if the customer never uses the word privacy: a message saying "tell me what you know about me" is an access request. Shadow IT is a serious risk to the access request process, because data the program does not know about cannot be found when someone asks for it. And every incident is a test of the response plan, which the Body of Knowledge expects to be evaluated and improved afterwards.
Someone new takes over the program
Privacy programs change hands, and a new program manager inherits whatever the last one left. The first job is an honest assessment: which policies exist and are followed, which metrics are reported and whether anyone uses them, which vendors were assessed and when, and how requests and incidents are actually handled. The CIPM's six domains are a ready-made structure for that review, and the checklist below follows them in order.
What each moment asks of the program
Here is the same ground turned into the work it creates. For each moment, the second column is what the program manager produces, and the third is the CIPM competency, with its published item range, that teaches it.
| Moment | What the program manager produces | CIPM competency (items) |
|---|---|---|
| A new law applies | An updated register of in-scope laws and the policies that meet them | I.C in-scope laws (5 to 7); II.A policies and processes (6 to 8) |
| Leadership asks for a strategy | Program scope, strategy, vision and mission | I.A scope and strategy (4 to 6); I.B vision and mission (4 to 6) |
| The board asks how it is going | Metrics tied to decisions, and a performance report | II.C privacy metrics (2 to 4); V.A performance metrics (1 to 3) |
| A new vendor | A vendor assessment and contract terms | III.B processors and vendors (1 to 3) |
| An acquisition | A shared-data risk assessment before signing | III.E mergers, acquisitions and divestitures (2 to 4) |
| A new project | A threshold assessment, then a PIA or DPIA where needed, and Privacy by Design in the build | III.A data governance (3 to 5); IV.B Privacy by Design (1 to 3) |
| A rights request | A response within the legal deadline, from a process staff can recognize and follow | VI.A access requests and rights (5 to 7) |
| An incident | Handling under the response plan, then an improved plan | VI.B incident handling (3 to 5); VI.C improving the plan (1 to 3) |
| Time for assurance | A program audit and continuous assessment | V.B audit (1 to 3); V.C continuous assessment (3 to 5) |
We have turned the six domains into a first-90-days checklist for anyone building or taking over a program, which you can copy or download below.
Privacy program first 90 days checklist
Privacy program: first 90 days checklist
Use this when you have been asked to build or take over a privacy program. The order follows the six domains of the IAPP CIPM Body of Knowledge, version 4.2.0: framework, governance, then the operational life cycle of assessing, protecting, sustaining and responding.
Framework (weeks 1 to 3)
- Program scope written down, and a privacy strategy agreed with leadership
- Vision and mission statement for the program, communicated
- The laws, regulations and standards in scope, listed by jurisdiction and business line
Governance (weeks 2 to 6)
- Policies and processes for each stage of the program life cycle, drafted or reviewed
- Roles and responsibilities named, including who decides, who advises and who executes
- Privacy metrics chosen for oversight, each tied to a decision it will drive
- Training and awareness plan, including how front-line staff recognize a rights request
Assess (weeks 4 to 10)
- Data inventory and data governance systems documented
- Processors and third-party vendors evaluated
- Physical, environmental and technical controls evaluated
- A triage step (privacy threshold assessment) to decide which projects need a full PIA or DPIA
- Any merger, acquisition or divestiture checked for shared-data risk
Protect (weeks 6 to 12)
- Information security practices and policies aligned with the privacy program
- Privacy by Design principles built into project intake
- Data use guidelines in place, with technical controls that enforce them
Sustain (from week 8)
- Program performance measured against the chosen metrics
- An audit of the program planned
- Continuous assessment built into the calendar
Respond (from day 1)
- A route for data subject access and rights requests, including requests that never use the word privacy
- Incident handling and response procedures, tested
- A date to review and improve the incident response plan
Where does the credential apply?
The CIPM is not tied to any one country. Its first domain asks you to identify the laws, regulations and standards that apply to your program, wherever they come from, and the rest of the Body of Knowledge is about how a program meets them. That makes it useful for a privacy lead in Europe working under the GDPR, one in California working under the CCPA, and one running a global program across both. The IAPP runs the exam at Pearson VUE test centers and online through OnVUE, and describes the CIPM as ANAB-accredited.
Auditing ties the program to that wider picture. Our guide's view is that a program is evaluated against three things at once: internal policies, external regulations and industry frameworks, with the form of audit chosen to fit the program's goals. When a new law applies, the audit criteria have to change to match it, which is one more reason the first domain's register of in-scope laws has to stay current.
The law still matters; it just is not the CIPM's subject. A CIPM holder who runs a European program needs the GDPR, and one running a US program needs federal and state law. That is why the CIPM so often pairs with a CIPP.
What the CIPM is not
It is not a law credential. It does not teach what any particular law requires. It teaches how to build the program that meets whatever laws apply.
It is not a technical credential. It covers security practices, technical controls and Privacy by Design from the program manager's view. Building privacy into systems is the CIPT's subject.
It is not a one-time project. Two of the six domains are about sustaining performance and responding to requests and incidents. A program that was built once and never measured is the failure the CIPM is designed to prevent.
It is not a percentage. The pass mark is 300 on the IAPP's scale of 100 to 500, and the scale is the same across the IAPP's credentials, so a score cannot be read as a share of questions answered correctly.
What does it take to earn and keep?
| Item | The IAPP's rule |
|---|---|
| Accreditation | ANAB-accredited designation |
| Prerequisites | None |
| Exam | 90 questions in 2.5 hours, at a Pearson VUE test center or online through OnVUE |
| Pass | 300 on a scale of 100 to 500 |
| Fee | USD 550, the same for members and non-members; USD 375 if you have attempted the exam before or hold another IAPP certification |
| Upkeep | IAPP membership or a certification maintenance fee, and continuing privacy education under the IAPP's CPE policy |
The full fee detail and study plans of 30, 45 or 60 hours are on our CIPM exam page.
How does it compare with the credentials around it?
| Credential | The question it answers | Suits |
|---|---|---|
| CIPM | How do we run a privacy program? | Program managers, DPOs leading a team, privacy leads in any function |
| CIPP/E | What does European data protection law require? | DPOs, counsel, anyone handling EU personal data |
| CIPP/US | What does US privacy law require? | Counsel, privacy and compliance staff working on US law |
| CIPT | How do we build privacy into technology? | Engineers, architects, product and security people |
| AIGP | How do we govern AI systems? | The people asked to govern AI, often from privacy or legal |
The IAPP's credentials stack, and all use the same 100 to 500 scale with 300 to pass. A privacy leader may hold a CIPP for the law and the CIPM for the program; a privacy engineer the CIPT; and a privacy lead who has been handed AI governance may add the AIGP. Our CIPP/E, CIPP/US and AIGP pages cover the alternatives.
What will the exam expect of you?
The CIPM has 90 questions in 2.5 hours, 1 minute 40 seconds a question on average. Questions often describe a situation inside a program and ask what the manager should do, or which tool fits. Precision about the tools is where marks are won and lost: a privacy threshold assessment is triage, a PIA is analysis, and a DPIA is a legal requirement for high-risk processing; a point-in-time metric gives only a snapshot of a single day; and an access request is an access request whether or not the customer uses the word privacy.
Wrong options can be actions a capable but inexperienced manager would take: a metric that measures activity rather than outcome, a DPIA started after the system is live, or a response process that depends on staff recognizing legal vocabulary. Our guide works through each competency with the traps its questions are built on. Test yourself with the CIPM quiz, see the six domains on one page in the CIPM mind map, and if the credential is part of a job move, the CIPM interview questions page covers what employers ask.
How to prepare
Start from the Body of Knowledge, because it is what the exam is written to, and spread your time across all six domains. With weights this even, the risk is not under-preparing one big domain but skipping a small one.
The CIPM Exam Guide (Wikidata) has 21 chapters across 543 pages, one for each of the 21 competencies the IAPP publishes, with each chapter's item range printed at its head. It covers building, running, measuring and keeping a privacy program alive, and every claim traces to a primary document.
The CIPM Practice Questions (Wikidata) has 200 questions weighted to the published item counts, each with a rationale that says why the right answer is right and why every wrong option fails. The answer letters are spread evenly across A, B, C and D on purpose, because an uneven key teaches a habit that scores nothing on the day.
Privacy by Design deserves its own hour. The Body of Knowledge asks candidates to integrate its main principles, and our guide's advice is to learn the principles well enough to recognize them in operational scenarios, starting with the first: be proactive, not reactive. The principles apply to general business activities as well as software, which is why they sit in a program manager's credential and not only in the CIPT.
Is it current? Both books follow Body of Knowledge 4.2.0, effective 1 September 2025. If the IAPP publishes a new version, check its effective date against your exam date.
If you plan 60 hours, the midpoints of the item ranges suggest roughly 13 hours for developing a framework, 11 each for governance and assessing data, 9 for protecting data, 6 for sustaining performance and 10 for requests and incidents. Then move hours toward the parts of the program your job does not touch: a lawyer may need more on technical controls and metrics; a security lead more on governance and requests.
So, do you need the CIPM?
Take it if your job is to make privacy happen across an organization, not only to know what the law says: as a program manager, a DPO leading a team, a privacy lead in legal, compliance or security, or a consultant building programs. It is the IAPP's credential for the operational side of privacy, and its domains match the work closely. Take it too if your privacy program is being asked to absorb AI governance, because the governance machinery it teaches is the same.
The credential also suits people who arrived in privacy from operations, project management or security and now run the program by default. The CIPM gives that experience a structure, names the parts of the job that are easy to miss, such as metrics, program audits and incident plan reviews, and gives the organization a recognized standard to point to.
Take a CIPP first if you do not yet know the law your program has to meet. Take the CIPT if your job is building systems rather than running the program. And if you are new to privacy entirely, a CIPP may be the easier first step, with the CIPM as the second.
Questions people ask about the CIPM
Who is the CIPM for?
People who build and run privacy programs: privacy program managers, data protection officers who lead a team, privacy leads in legal, compliance or security, and consultants who set up programs for clients. The IAPP says the CIPM shows you are a leader in privacy program administration, equipped to establish, maintain and manage a privacy program across all stages of its life cycle.
What is the difference between the CIPM and the CIPP?
The CIPP credentials (CIPP/E, CIPP/US and others) are about what privacy law requires in a region. The CIPM is about running the program that meets those requirements, whatever the jurisdiction. Some privacy leaders take one CIPP and the CIPM.
What does the CIPM cover?
Six domains in Body of Knowledge 4.2.0: developing a framework (14 to 18 items), establishing program governance (12 to 16), assessing data (12 to 16), protecting personal data (9 to 13), sustaining program performance (7 to 9) and responding to requests and incidents (10 to 14).
How many questions are on the CIPM exam?
The IAPP's certification FAQs give the CIPM as 90 questions in 2.5 hours. You sit at a Pearson VUE test center or online through OnVUE.
What is the CIPM passing score?
300 on the IAPP's scale of 100 to 500.
How much does the CIPM cost?
USD 550 on the IAPP Store, the same for members and non-members, or USD 375 if you have attempted the exam before or hold another IAPP certification.
Is the CIPM tied to one country's law?
No. The CIPM covers identifying the laws, regulations and standards that apply to a program, but it is not a law exam. It is about the program that sits on top of whatever laws apply.
Do I need the CIPP before the CIPM?
No; there are no prerequisites. But the CIPM assumes you can identify which laws apply, and a CIPP is the IAPP's credential for knowing what they require, so it can make sense to take a CIPP first.
Does the CIPM help with AI governance?
It can. The IAPP and Credo AI report that many organizations build AI governance in conjunction with their privacy programs, and that a common example is adding AI questions to existing privacy assessment processes. The IAPP's own AI credential is the AIGP.
Which CIPM Body of Knowledge is current?
Version 4.2.0, effective 1 September 2025. Check the IAPP's CIPM page before you book.
CIPM: test yourself in five minutes
Which books prepare you for the CIPM exam?
Certified Information Privacy Manager. 21 chapters, 543 pages.
Practice questions with full rationales, weighted to the published blueprint. 216 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- IAPP, CIPM: Certified Information Privacy Manager
- IAPP, CIPM Body of Knowledge and Exam Blueprint, version 4.2.0, effective 1 September 2025
- IAPP, Certification Candidate Handbook: scoring scale and passing score
- IAPP, Certification FAQs: exam length
- IAPP and Credo AI, AI Governance Profession Report 2025
- Regulation (EU) 2016/679 (GDPR)
- California Attorney General, California Consumer Privacy Act (CCPA)
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. CIPM, CIPP/E, CIPP/US, CIPT and AIGP are trademarks of the International Association of Privacy Professionals.