The complete CIPM study guide
What the exam asks, in what order to study it, how long it takes, what it costs and where candidates lose marks.
What is the CIPM?
The CIPM, the Certified Information Privacy Manager, is the certification for people who run privacy in an organisation. It tests whether you can build a privacy programme and keep it working: what to do first, who is responsible, and how to show that it works.
It is issued by the IAPP. There are no prerequisites: no degree and no minimum experience. You sit it online or at a test centre.
Format and fees
Membership of the IAPP costs $295 a year and includes the maintenance fee; without membership that fee is $250 every two years.
The tools that keep coming back
Four instruments run through the whole exam. Know what each one is for and when it is used, and the scenario questions become readable.
Inventory and mapping
What you holdWhich personal data the organisation has, where it sits, who uses it and where it goes.
Assessments
What it risksPrivacy impact assessments, vendor assessments and transfer assessments, and when each is due.
Incident response
When it goes wrongThe plan, the team, the decision to notify and the lessons afterwards.
Metrics and audits
How it performsWhat to measure, who reads it, and how an audit differs from monitoring.
The frameworks worth knowing
The exam does not belong to one country. It draws on the frameworks that privacy programmes around the world are built on.
The principles most privacy laws were built on.
The American statement of the same ideas: notice, choice, access and security.
A voluntary tool for managing privacy risk, built to sit next to the NIST Cybersecurity Framework.
The international standard for a privacy information management system, an extension of ISO/IEC 27001.
The duty to be able to show compliance, not only to comply.
The Asia-Pacific framework behind the Cross-Border Privacy Rules.
Enforcement worth knowing
The exam tests the management of privacy, and these decisions show what it costs when a programme fails.
A fine of £20 million for security failings behind a breach of customer data.
A fine for a breach that began in a company Marriott later bought: due diligence matters.
An unpatched system exposed the data of millions of people and led to a settlement of at least $575 million.
A fine of €1.2 billion for transfers of personal data to the United States.
A security chief was convicted for hiding a data breach from regulators.
A fine of €345 million over default settings for children's accounts.
When the rules change, your course changes with them.
Every explanation in the course is stored once and linked to its source. When a regulation, a guideline or a decision changes, we update it in one place and every lesson that uses it is correct from that moment.
How the questions are built, and how to read them
Exam questions come in a small number of structures, and a candidate who knows the content can still lose marks on the structure. The course tags every question with its structure; the technique is one tap away on each one, and every test shows whether you lost the mark on the content or on the type of question.
- Two-statement true or false
- Judge each statement on its own before you look at the options.
- Best, most, primary
- Underline the qualifier. Several options are defensible; one is the most complete.
- Except, least, not
- Three options are right. You are looking for the one that is wrong.
- Only if, unless, provided that
- Restate the rule without the condition, then test whether the outcome could happen without it.
- Scenario
- Read the question first, then the scenario. The scenario carries deliberate noise.
- Definitions
- The trap is a neighbouring term with one word changed.
Buy the exam voucher when you are ready, not before. It expires a year after you buy it.
Free CIPM assessmentHow long does it take to prepare?
The IAPP recommends at least 30 hours of study. People who already run a privacy programme need less; people new to it need more. At three hours a day you can be ready in about three weeks.
Book the exam before you feel ready: a fixed date concentrates the effort. You have twelve months from purchase to sit it.
Or €117 a month with a trial exam included.
A 3-week plan, at three hours a day
- Week 1The free assessment, domains 1 and 2: the framework, governance, roles, metrics and training21 h
- Week 2Domains 3 and 4: inventories, assessments, vendors, privacy by design and retention. First module tests21 h
- Week 3Domains 5 and 6, question structures, the trial exam and its analysis, then book the exam21 h
A guideline. The course builds your own plan from your assessment and the hours you have.
Resources, and what each one is worth
| Resource | Price | Worth it? |
|---|---|---|
| CIPM body of knowledge | Free | Essential. Work through it competency by competency. |
| The IAPP textbook | IAPP store | Useful for self-study; it can lag the current body of knowledge. |
| NIST Privacy Framework | Free | Short, practical, and close to how the exam thinks about risk. |
| IAPP official training | From $995 | A good introduction. It does not replace practice under time pressure. |
| IAPP practice exam | IAPP store | One exam, useful for the house style of the questions. |
| 22Academy CIPM course | €37 a week or €117 a month | The full course, the exam skills, the measurement and a trial exam. Stop when you are ready. |
| 22Academy trial exam | €42, or free with a monthly plan | Full length under real conditions, with analysis by domain and by question type. |
Ten mistakes that cost candidates the exam
- Answering as a lawyerThe exam asks what a privacy manager does, not what the law says.
- Ignoring the orderFirst, next and before are the question. Know the sequence of the life cycle.
- Mixing up the assessmentsEach one answers a different question at a different moment.
- Treating security as privacyA security control does not answer a privacy question.
- Confusing monitoring and auditOne is continuous, the other is a check at one moment.
- Reading the scenario firstThe scenario is written with noise in it. Read the question first.
- Missing the qualifierMost, best, first and except change the logic of the whole question.
- Practice in the last week onlyTesting early is what finds the weak domains.
- Exam dumpsOften wrong, against the candidate agreement, and useless on scenarios.
- Sitting too earlyA retake costs $375. A trial exam costs €42 and tells you whether you are ready.
If you fail, fail cheap. Ten trial exams cost less than one retake.
Buy a trial examWhat jobs does CIPM lead to, and what do they pay?
The CIPM is the certification for anyone who runs privacy rather than advises on it. It leads to the roles that carry the programme: privacy manager and head of privacy, and it is the natural second certification for a data protection officer.
Employers ask for it because it shows that you can turn the law into a working programme. Pay rises with the scope of the role.
Each role page shows which certifications it takes, in which order, and how long it takes.
CIPM or another certification: which first?
| Certification | What it covers | Take it when |
|---|---|---|
| CIPM | Running a privacy programme | You run privacy rather than advise on it |
| CIPP/E | European data protection law | You want the legal foundation first |
| CIPP/US | United States privacy law, federal and state | You work with American data, clients or colleagues |
| CIPT | Privacy in technology | You build or run the systems |
| AIGP | AI governance | Your organisation builds or uses AI |
Not sure? The career plan starts from the job you want.
The terms the exam expects you to use precisely
- Privacy programme
- The policies, people and processes an organisation uses to handle personal data responsibly.
- Privacy framework
- A structure for organising the programme, such as the NIST Privacy Framework or ISO/IEC 27701.
- Data inventory
- A record of what personal data the organisation holds, where, why and for how long.
- Data mapping
- Tracing how personal data flows through systems, teams and third parties.
- Privacy impact assessment
- An analysis of the privacy risks of a project, done before it starts.
- Privacy by design
- Building privacy into a system or process from the start instead of adding it later.
- Vendor assessment
- Checking how a third party will protect the personal data it receives.
- Data retention schedule
- The rule for how long each kind of data is kept, and what happens to it afterwards.
- Data subject request
- A request from an individual to use a right, such as access or deletion.
- Privacy incident
- An event that puts personal data at risk. Not every incident is a breach.
- Data breach
- An incident in which personal data is lost, disclosed or accessed without authority.
- Incident response plan
- The agreed steps, roles and contacts for handling an incident.
- Privacy metric
- A measure of how the programme performs, tied to an objective and an owner.
- Monitoring
- Continuous checking that controls are working.
- Audit
- A check at one moment against a standard, by an internal or outside party.
- Accountability
- Being able to show that the organisation does what it says.
Know the terms. Now prove it.
Free account, fifteen minutes, your score per domain.
Exam day, and after
About 1 minute 40 seconds a question. Flag and move on.
Removing what is wrong is faster than hunting for what is right.
Most, best, first and except decide what is being asked.
Optional, fifteen minutes. Taking it means submitting the first half for good.
Online or at a test centre: both work. If you sit online, do a full dry run the day before, and disconnect second screens and docking stations.
Passed? You keep the certification with 20 CPE credits in every two-year period, plus the maintenance fee or an IAPP membership that includes it.
Not this time? A retake costs $375, and your progress in the course is still there.
“I highly recommend the trial exam”
Questions people ask about the CIPM
Is the CIPM hard?
It is demanding rather than hard. There is little law to memorise; the effort goes into the sequence of the work and into choosing what a privacy manager would do first, next or best. The questions reward precision, so candidates who practise on exam-style questions early do far better than those who only read.
Do I need the CIPP/E first?
No. The CIPM stands on its own. The CIPP/E teaches the law and the CIPM teaches how to run the programme that applies it, so the two fit together well, in either order.
Do I need to have run a privacy programme?
No. There are no prerequisites, no degree and no minimum experience. Experience helps you move faster, and the course explains every concept in plain language for those who are new to it.
How is 22Academy different from IAPP training?
The IAPP offers traditional classroom courses and e-learning in which the content is presented to you. We start from the fact that you already have access to all the content, so we focus on getting it into your head rather than throwing more of it at you. We test your knowledge constantly, because that is what makes it stick, and we explain every concept in the form and length that suits you. We also teach the exam skills: how the questions are built, what they are really asking and where the traps are. And we embrace AI for your study, because you use it already; we show you how to use it more effectively.
Do I need a trial exam if I have done practice questions?
Practice questions check your knowledge one item at a time. The trial exam checks whether you can answer ninety in a row under the clock, the way the real exam asks it. Its analysis shows whether you lose marks on the content or on the type of question, so you know exactly what to work on in the last days. It is the last check before you book.
Can I use my own AI app to prepare?
Yes, and we encourage it. An AI app is a good partner for rehearsing: it will quiz you, rephrase a concept or test you on a passage you give it. It is a poor judge of whether you are ready, because it cannot tell you what you failed to ask. The course gives you prompts that make your own app quiz you properly, and measures you with its own questions.
Is there a free option?
Yes. You can start your course for free and see whether the system suits you: the assessment and the first lesson are open without a card. When you want the rest, the course is €37 a week, or €117 a month with a trial exam included.
Can I stop at any time?
Yes. You pay for the weeks or months you study and cancel whenever you like; your access runs to the end of the period you paid for. If you come back within a year, your progress is still there.
Is 22Academy affiliated with the IAPP?
No. The IAPP owns the CIPM and sets the exam. 22Academy prepares candidates for it independently, and has done so since 2018.
More in the FAQ.
Questions about your study?
How to plan around a job, when to book the exam, whether you are ready: connect and ask. Support is free!
Start where you actually are
Free account, fifteen minutes, your score per domain.