CIPP/E
The CIPP/E and the people who use it: DPOs, counsel and the jobs GDPR created
The GDPR wrote a job into law. Article 37 requires many organizations to designate a data protection officer, and Article 37(5) says that person must have expert knowledge of data protection law and practices. The CIPP/E is the IAPP's credential for that knowledge. This guide is about who holds it, from DPOs and privacy counsel to the security, HR and product people the GDPR reaches, when the law makes the role mandatory, and what the exam will ask.
The facts here come from the IAPP's CIPP/E Body of Knowledge and Exam Blueprint, version 1.3.3, its CIPP/E page, its Certification Candidate Handbook and certification FAQs, and the Official Journal text of the GDPR. Where this page and the IAPP differ, the IAPP wins; where it and the GDPR differ, the Regulation does.
What does the CIPP/E cover?
The IAPP says the CIPP/E proves an understanding of pan-European and national data protection laws, key privacy terminology and practical concepts concerning the protection of personal data and trans-border data flows. Its Body of Knowledge splits that into five domains and 18 competencies, and publishes a range of items for each domain:
| Domain | Items | What it covers |
|---|---|---|
| I. Introduction to European Data Protection | 7 to 13 | Origins and history; the EU institutions; the legislative framework, from Convention 108 to the GDPR, NIS2 and the AI Act |
| II. European Data Protection Law and Regulation | 18 to 28 | Core GDPR concepts; security and breach notification; vendor management; data subjects' rights |
| III. European Data Processing | 13 to 21 | Processing principles; lawful bases; transparency and notices; international transfers |
| IV. European Data Protection: Scope and Accountability | 8 to 18 | Territorial and material scope; accountability, DPIAs and DPOs; supervision and the lead authority; violations and fines |
| V. Compliance with European Data Protection Law and Regulation | 8 to 16 | The workplace; surveillance; direct marketing; cookies, cloud, social media and AI |
The largest domain is the law itself, and two competencies inside it carry the most weight: security, including breach notification and vendor management, at 7 to 11 items, and data subjects' rights, at 8 to 12. Those are two of the places where an organization meets the GDPR in practice: when something goes wrong with data, and when a person asks what an organization holds about them. The fifth domain is the most practical of all, applying the law to employment, monitoring, marketing and internet technology.
The rights competency is a good example of how detailed the Body of Knowledge gets. It asks candidates to understand the right of access, rectification, erasure (the right to be forgotten), restriction and objection, consent and its withdrawal, the rights around automated decision-making and profiling, data portability, and the restrictions on all of them, with the European Data Protection Board's guidelines on several. Each is a separate request type a DPO may handle, with its own conditions and exceptions.
The workplace competency is just as concrete. It covers the legal basis for processing employee data, personnel records, workplace monitoring and data loss prevention, bring-your-own-device programs, and the role of European Works Councils and whistleblowing systems. The internet technology competency covers cloud computing, cookies, social media platforms including dark patterns, search engine marketing, and the compliance and ethical issues of artificial intelligence. These are the questions HR, IT and product teams bring to a DPO.
The CIPP/E is also wider than the GDPR. The Body of Knowledge asks candidates to understand the ePrivacy Directive, the e-Commerce Directive, the NIS and NIS2 Directives and the EU Artificial Intelligence Act, and to know the roles of the Council of Europe, the European Court of Human Rights, the European Parliament, the Commission, the Council and the Court of Justice. A CIPP/E holder is expected to understand where the GDPR sits, not only what it says.
Who uses the CIPP/E?
The GDPR applies to any organization that processes personal data in the context of an EU establishment, and, under Article 3(2), to organizations outside the EU that offer goods or services to people in the Union or monitor their behavior there. That reach is why the credential's audience is so wide. The people who hold it fall into these roles:
| Role | What they do under the GDPR | CIPP/E competencies that carry the day job | Pairs it with |
|---|---|---|---|
| Data protection officer | The Article 39 tasks: advise, monitor, DPIAs, the regulator's contact point | All five domains, led by IV.B accountability | CIPM |
| Privacy counsel or in-house lawyer | Lawful bases, contracts, transfers, regulator correspondence | III.B lawful bases; III.D transfers; IV.C supervision | CIPM for program work |
| Privacy program or compliance manager | Records, notices, policies, training, audits | III.C notices; IV.B accountability | CIPM |
| Security lead | Technical and organizational measures; breach response | II.B security and breach notification | CIPT or CISSP |
| HR or people lead | Employee data, monitoring, whistleblowing | V.A the workplace | CIPM |
| Marketing or digital lead | Consent, direct marketing, cookies and tracking | V.C direct marketing; V.D internet technology | CIPT |
| Product or engineering lead | Privacy by design, cloud, AI features | IV.B by design and by default; V.D cloud and AI | CIPT |
| Outsourced DPO or consultant | The DPO role under a service contract, for several clients | All five domains | CIPM |
The pairings are our suggestion, not the IAPP's. The CIPP/E teaches what the law requires; the IAPP's CIPM teaches how to run the program that meets it, and its CIPT how to build privacy into technology. Many of the roles above need the law first and one of the others next.
When does the GDPR make the role mandatory?
Article 37(1) of the GDPR says the controller and the processor "shall designate a data protection officer in any case where" one of three conditions is met:
| Rule | What the GDPR says |
|---|---|
| Article 37(1)(a) | The processing is carried out by a public authority or body, except for courts acting in their judicial capacity |
| Article 37(1)(b) | Core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale |
| Article 37(1)(c) | Core activities consist of large-scale processing of special categories of data (Article 9) or of criminal convictions and offences data (Article 10) |
| Article 37(4) | In other cases a DPO may be designated, or must be where Union or Member State law requires it |
| Article 37(5) | Designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices |
| Article 37(6) | A staff member, or someone working under a service contract |
| Article 38(3) | Receives no instructions on how to carry out the tasks, is not dismissed or penalized for performing them, and reports directly to the highest management level |
Article 38 sets out how the DPO works once appointed. The controller and processor must involve the DPO properly and in a timely manner in all issues relating to the protection of personal data, and support the DPO with the resources needed for the tasks, access to personal data and processing operations, and the means to maintain expert knowledge. Data subjects may contact the DPO about any issue relating to their data and their rights. The DPO is bound by secrecy or confidentiality, may have other tasks and duties, and the organization must make sure those duties do not create a conflict of interests. Article 37(2) lets a group of undertakings appoint a single DPO if one is easily accessible from each establishment, and Article 37(7) requires the DPO's contact details to be published and communicated to the supervisory authority.
The fifth row is why the CIPP/E matters. The GDPR does not name a credential, but it does require the DPO to have expert knowledge of data protection law and practice, and an organization that appoints a DPO has to be able to show why that person qualifies. A recognized, ANAB-accredited credential is one plain way to do it. Article 37(6) explains the consultant market too: because the DPO can work under a service contract, an organization can use an outsourced DPO rather than an employee.
The other moments the CIPP/E starts to matter
Not every organization must have a DPO, but every organization subject to the GDPR has GDPR work. Several moments put it on someone's desk:
A supervisory authority writes. Domain IV covers the European Data Protection Board, the European Data Protection Supervisor, national supervisory authorities and the lead supervisory authority under the one-stop shop. When a regulator's letter arrives, the DPO is the contact point Article 39 names, and the reply has to show the organization understands which authority leads and what powers it has.
A breach. Article 33 requires the controller to notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to people's rights and freedoms. The person who decides whether, when and how to notify needs the law at their fingertips.
A non-EU business with EU customers. Article 3(2) brings controllers and processors outside the Union into scope when they offer goods or services to people in the Union or monitor their behavior there. A US or UK company that discovers it is in scope needs someone who can map what follows.
A data transfer. Moving personal data out of the EEA needs a lawful mechanism. The Body of Knowledge covers the rationale for restricting transfers, adequacy, the EU-US Data Privacy Framework, Standard Contractual Clauses, Binding Corporate Rules, codes of conduct and certifications, derogations and transfer impact assessments, and the history of Safe Harbor, Privacy Shield and the Schrems decisions behind them. A new vendor outside Europe, or a parent company in another jurisdiction, is enough to start that work.
A new AI or tracking feature. The Body of Knowledge now includes the EU AI Act, AI and machine learning, cookies, online behavioral targeting and dark patterns on social media. Article 25's data protection by design and by default applies when the means of processing are decided, so the privacy questions belong at the design stage, not after launch.
The cost of getting it wrong. Article 83 sets two tiers of administrative fines. Infringements of the provisions in Article 83(4), including many of the controller's and processor's obligations, can bring fines up to EUR 10,000,000 or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Infringements in Article 83(5), including the basic principles for processing, can bring fines up to EUR 20,000,000 or 4%, whichever is higher. The fourth domain of the CIPP/E asks candidates to know those procedures, the fines, and when compensation and class actions can follow.
What each DPO task asks of the CIPP/E
Here is the GDPR's own job description laid against the Body of Knowledge. For each of the minimum tasks Article 39(1) gives the DPO, the second column is what the DPO produces, and the third is the CIPP/E competency that teaches it.
| Article 39(1) task | What the DPO produces | CIPP/E competency |
|---|---|---|
| (a) Inform and advise the controller, the processor and employees of their obligations | Advice on lawful bases, notices and rights; training for staff | III.B lawful bases; III.C information provision; II.C rights |
| (b) Monitor compliance, including responsibilities, awareness-raising, training and audits | A compliance monitoring plan, audit results and records | IV.B accountability, including the role of auditing |
| (c) Advise on data protection impact assessments and monitor their performance | DPIA advice and sign-off records | IV.B DPIAs and the criteria for conducting them |
| (d) Cooperate with the supervisory authority | Responses to inquiries and investigations | IV.C supervision, the EDPB and the lead authority |
| (e) Act as the authority's contact point, including for prior consultation | Prior consultation filings and a published contact route | IV.C supervision; IV.B accountability |
Two parts of the Body of Knowledge sit behind every row: the security and breach competency, because breaches are where the DPO is most visible, and the rights competency, because access and erasure requests are where the public meets the organization. We have turned Articles 37 to 39 into a checklist that tests whether a DPO is required and whether the role is set up the way the GDPR says.
GDPR DPO designation and duties checklist
GDPR data protection officer: designation and duties checklist
Use this to decide whether an organization must designate a data protection officer under the GDPR, and to check that the role is set up the way the Regulation requires. Article numbers are from Regulation (EU) 2016/679. It is a planning aid, not legal advice; national law can add cases where a DPO is mandatory.
Must you designate a DPO? (Article 37(1))
- Processing is carried out by a public authority or body (other than courts acting in their judicial capacity)
- Core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale
- Core activities consist of large-scale processing of special categories of data (Article 9) or criminal
convictions and offences data (Article 10)
- Union or Member State law requires a DPO in your case (Article 37(4))
- None of the above: you may still designate one voluntarily (Article 37(4))
Setting up the role
- Chosen for professional qualities and expert knowledge of data protection law and practice (Article 37(5))
- Staff member or service contract (Article 37(6)); one DPO for a group only if easily accessible from each establishment (Article 37(2))
- Contact details published and communicated to the supervisory authority (Article 37(7))
- Involved properly and in a timely manner in all data protection issues (Article 38(1))
- Resources, access to personal data and processing, and support to maintain expert knowledge (Article 38(2))
- No instructions on how to carry out the tasks; not dismissed or penalized for doing them (Article 38(3))
- Reports directly to the highest management level (Article 38(3))
- Other duties do not create a conflict of interests (Article 38(6))
The minimum tasks (Article 39(1))
- Inform and advise the controller or processor and employees of their obligations
- Monitor compliance, including assignment of responsibilities, awareness-raising, training and audits
- Advise on data protection impact assessments and monitor their performance (Article 35)
- Cooperate with the supervisory authority
- Act as the authority's contact point, including for prior consultation (Article 36)
Where does the credential apply?
The CIPP/E is about European law, but it is relevant well beyond Europe because the GDPR reaches beyond Europe. The IAPP runs the exam at Pearson VUE test centers and online through OnVUE, and says its translated versions of the exam were produced from the English exam by professional translation firms under ISO-certified quality processes, with no machine translation.
The credential covers European law, not every national variation of it. The GDPR leaves room for Member State law in areas such as employment and in some DPO cases, and the CIPP/E asks candidates to know national laws in general terms. A DPO in a particular country still needs that country's supervisory authority guidance and national provisions on top.
What the CIPP/E is not
It is not a legal qualification. It shows knowledge of European data protection law. It does not entitle anyone to practice law, and a DPO is not the organization's lawyer.
It is not a GDPR requirement. The Regulation asks for expert knowledge, not a particular certificate. The CIPP/E is evidence of that knowledge, not a legal precondition.
It is not a program management credential. Knowing what the law requires is different from building the program that meets it. That is the CIPM's subject.
It is not frozen. The Body of Knowledge changes, and version 1.3.3 includes material such as the AI Act and NIS2. Regulators' guidance changes faster, which is why the Body of Knowledge keeps pointing candidates to the European Data Protection Board's guidelines and opinions.
What does it take to earn and keep?
| Item | The IAPP's rule |
|---|---|
| Accreditation | ANAB-accredited designation |
| Exam | 90 questions in 2.5 hours, at a Pearson VUE test center or online through OnVUE |
| Pass | 300 on a scale of 100 to 500 |
| Fee | USD 550; USD 375 if you have attempted the exam before or hold another IAPP certification |
| Window to sit | Schedule and sit within one year of buying the exam, or the fee is forfeited |
| Upkeep | USD 250 maintenance fee per two-year term, or IAPP membership; continuing privacy education under the IAPP's CPE policy |
The one-year window catches people out. Buying the exam starts the clock, so buy it when your study plan has a date in it, not as a commitment device. The full cost detail and exam-day rules are on our CIPP/E exam page.
How does it compare with the credentials around it?
| CIPP/E | CIPM | CIPT | CIPP/US | |
|---|---|---|---|---|
| The question it answers | What does European law require? | How do we run a privacy program? | How do we build privacy into technology? | What does US privacy law require? |
| Suits | DPOs, counsel, anyone handling EU personal data | Privacy program managers, DPOs running a team | Engineers, architects, product and security people | Counsel and privacy staff working on US law |
| Awarded by | IAPP, with the same 100 to 500 scale and 300 to pass | |||
The IAPP's credentials are designed to stack. A DPO may need the CIPP/E for the law and the CIPM for the program; a privacy engineer needs the CIPT and enough of the law to know what to build. An organization operating on both sides of the Atlantic may want people with both the CIPP/E and the CIPP/US. Our CIPM exam page sets out the next step for most DPOs.
What will the exam expect of you?
The CIPP/E has 90 questions in 2.5 hours, which is 1 minute 40 seconds a question on average. Some questions follow a short scenario. The pass mark is 300 on the IAPP's scale of 100 to 500.
The questions reward knowing which Article decides a case, and knowing its exceptions. Our guide is built around those distinctions. A public authority acting as such cannot rely on consent, contract or compelling legitimate interests to export data. Outside the mandatory cases in Article 37(1), a DPO may be designated voluntarily, and Union or Member State law can make designation mandatory in more cases. Where legitimate interests is the lawful basis, the notice has to name those interests. Under the one-stop shop, the lead supervisory authority is the sole interlocutor of the controller or processor for cross-border processing. Each of these is a single sentence of law, and each is a likely wrong answer if you only half remember it.
Test yourself with the CIPP/E quiz, see the five domains on one page in the CIPP/E mind map, plan your hours with the CIPP/E study plan, and if the credential is part of a job move, the CIPP/E interview questions page covers what employers ask.
How to prepare
The IAPP offers textbooks, training and self-assessment tests, and says its European Data Protection training is the principal training for the CIPP/E. Whatever you use, start from the Body of Knowledge, because it is what the exam is written to, and read the Articles themselves: the GDPR is published in full in the Official Journal and free to read.
The CIPP/E Exam Guide (Wikidata) has 18 chapters across 483 pages, mapped to all five domains and all 18 competencies. Each competency gets the pages its published item weight deserves. It was written from the Official Journal text of the GDPR, the ePrivacy Directive, Directive 95/46/EC, the Charter and the Treaty, each read in full, and every chapter was fact-checked against them.
The CIPP/E Practice Questions (Wikidata) distributes its questions to match the item counts the IAPP publishes for each of the 18 competencies, so your percentage tells you something an evenly spread set cannot. Every rationale names the Article that decides the question and says why each wrong option fails, and no question is included whose key cannot be traced to an Article.
The domain ranges are wide, so plan against them rather than against an average. Domain II can carry anything from 18 to 28 items, and domain IV from 8 to 18. If you split your study time by the midpoint of each range, domain II gets the largest share, then domain III, then domain IV, with domains I and V close behind. Then move hours toward whatever your job does not touch: a lawyer may need more time on security and breach notification, and a security lead more on lawful bases, notices and transfers.
Is it current? Both books follow Body of Knowledge 1.3.3, effective 1 September 2025. If the IAPP publishes a new version, check its effective date against your exam date.
So, do you need the CIPP/E?
Take it if you are, or will be, a data protection officer, or if GDPR questions land on your desk as counsel, compliance, security, HR, marketing or product. The GDPR asks DPOs for expert knowledge of data protection law and practice, and the CIPP/E is a recognized way to show it. Take it too if you work outside Europe for an organization that the GDPR reaches through Article 3(2).
Look at the CIPM first if you already know the law and your job is running the program. Look at the CIPT if your job is building systems. And if your privacy work is mostly American, the CIPP/US covers that ground. For most people who handle European personal data, though, the CIPP/E is the place to start.
Questions people ask about the CIPP/E
Who is the CIPP/E for?
Anyone who needs to show an understanding of European data protection law in practice: data protection officers, privacy counsel and in-house lawyers, compliance and privacy program staff, and the security, HR, marketing and product people whose work the GDPR reaches. The IAPP says the designation proves an understanding of pan-European and national data protection laws, key privacy terminology and practical concepts concerning the protection of personal data and trans-border data flows.
Does the GDPR require a DPO to hold the CIPP/E?
No. Article 37(5) says a DPO shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices. It names no certificate. The CIPP/E is one way to show that knowledge.
When is a data protection officer mandatory under the GDPR?
Under Article 37(1), when processing is carried out by a public authority or body (except courts acting in their judicial capacity), when core activities require regular and systematic monitoring of data subjects on a large scale, or when core activities involve large-scale processing of special categories of data or criminal convictions data. National law can add more cases.
How many questions are on the CIPP/E exam?
The IAPP's certification FAQs give the CIPP/E as 90 questions in 2.5 hours. You sit at a Pearson VUE test center or online through OnVUE.
What is the CIPP/E passing score?
300 on the IAPP's scale of 100 to 500, as set out in the IAPP Certification Candidate Handbook.
How much does the CIPP/E cost?
USD 550 on the IAPP Store, or USD 375 if you have attempted the exam before or hold another IAPP certification. After you pass, a USD 250 maintenance fee per two-year term, or IAPP membership, keeps it active.
Which CIPP/E domain carries the most questions?
Domain II, European Data Protection Law and Regulation, with 18 to 28 items in Body of Knowledge 1.3.3. It covers GDPR concepts, security and breach notification, and data subjects' rights.
Is the CIPP/E only about the GDPR?
Mostly, but not only. The Body of Knowledge also covers the history and institutions of European data protection, the ePrivacy Directive, NIS and NIS2, the EU AI Act, and applied topics such as workplace monitoring, surveillance, direct marketing, cookies and cloud computing.
CIPP/E or CIPM?
The CIPP/E is about what European law requires. The CIPM is about running the privacy program that meets those requirements. A DPO may need both: the law first, then the program.
Which version of the CIPP/E Body of Knowledge is current?
Version 1.3.3, approved on 4 March 2025 and effective from 1 September 2025, replacing version 1.3.2. Check the IAPP's CIPP/E page before you book.
CIPP/E: test yourself in five minutes
Which books prepare you for the CIPP/E exam?
Certified Information Privacy Professional, Europe. 18 chapters, 483 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- IAPP, CIPP/E Body of Knowledge and Exam Blueprint, version 1.3.3, approved 4 March 2025, effective 1 September 2025
- IAPP, CIPP/E: Certified Information Privacy Professional/Europe
- IAPP, Certification Candidate Handbook: scoring scale and passing score
- IAPP, Certification FAQs: exam length
- Regulation (EU) 2016/679 (GDPR), OJ L 119, 4 May 2016, Articles 3, 33, 37, 38, 39 and 83
- Regulation (EU) 2024/1689 (AI Act)
- Directive (EU) 2022/2555 (NIS2)
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. CIPP/E, CIPP/US, CIPM and CIPT are trademarks of the International Association of Privacy Professionals. This page is not legal advice.