What the exam asks, in what order to study it, how long it takes, what it costs and where candidates lose marks.
The CIPP/E, the Certified Information Privacy Professional/Europe, is the certification for European data protection law. It tests whether you can apply the GDPR, the ePrivacy rules and the decisions of the regulators and courts to real situations, not only whether you can recite them.
It is issued by the IAPP and accredited under ISO/IEC 17024. There are no prerequisites: no degree and no minimum experience. You sit it online or at a test centre, in English, French or German.
Format and fees
Membership of the IAPP costs $295 a year and includes the maintenance fee; without membership that fee is $250 every two years.
The IAPP publishes a body of knowledge for each certification: the list of competencies the exam is written from, with the minimum and maximum number of questions per domain. The current version for CIPP/E is 1.3.3, in force since 1 September 2025. The 22Academy course follows it concept by concept.
Where the rules come from: the institutions, the history from Convention 108 to the Charter, and which instrument does what. The legislative framework now names the EU AI Act and NIS2 alongside the GDPR and the ePrivacy Directive.
The institutions. The Council of the EU, the European Council and the Council of Europe are three different bodies, and the exam asks about all three.
Which body is made up of the heads of state or government of the EU member states, together with its President and the President of the Commission?
Twenty more like it, freeThe core of the GDPR: who is a controller or a processor, what counts as personal data, how security and breach notification work, and every right with its conditions, exceptions and deadlines. The largest domain on the exam.
The rights. Knowing that a right exists is not the same as knowing its conditions, its exceptions and its deadline.
Statement I: a data subject can always have their personal data erased on request. Statement II: a controller must normally answer a data subject request within one month of receiving it. Which statement is correct?
Twenty more like it, free
Up to 28 of the 75 scored questions come from domain 2. The course shows your accuracy per domain and per module, and points at the module to work on now.
How processing becomes lawful: the principles, the six lawful bases, consent and legitimate interest, transparency, and the rules for sending personal data outside the EEA.
Transfers. Candidates reach for standard contractual clauses without checking for an adequacy decision first, and treat Article 49 as an alternative rather than a last resort.
A retailer in the Netherlands wants to move its customer support to a provider in a country without an adequacy decision. What should it rely on before it considers a derogation under Article 49?
Twenty more like it, freeWho the GDPR reaches and how compliance is shown and enforced: territorial scope, accountability, records, DPIAs, the DPO, the supervisory authorities, the one-stop shop and fines.
When a DPIA is mandatory, and who decides. The answer is the test in Article 35 plus the national list, not a feeling about risk.
A bank plans to decide on loan applications automatically, using data combined from several sources. What is the BEST reason it must carry out a DPIA first?
Twenty more like it, freeThe GDPR applied to everyday practice: employment, surveillance, direct marketing and cookies, and new technology, including AI.
Consent at work. It is rarely valid in an employment relationship, and the exam offers it again and again as the plausible wrong answer.
An employer wants to monitor staff email to detect data leaks. Which lawful basis is MOST likely to be valid?
Twenty more like it, freeNot using your IAPP membership? Pay only the $250 maintenance fee and keep $340 every two years.
Start CIPP/E freeFour clusters of articles run through the whole exam. Know these well and the scenario questions become readable.
The six lawful bases, the balancing test for legitimate interest, and when consent fails.
Each right with its conditions, its exceptions and the one-month clock, extendable by two months.
Records, security, breach notification within 72 hours, DPIAs, the DPO and the supervisory authority.
Adequacy first, then appropriate safeguards, then derogations. Schrems II and supplementary measures.
The body of knowledge names guidelines of the European Data Protection Board per domain, and they are examinable. Knowing what each one decides matters more than memorising paragraphs; check the current list in the body of knowledge.
Who decides purposes and means, and when two parties are joint controllers.
When the GDPR reaches an organisation outside the EU.
What a copy must contain, and when a request is manifestly unfounded or excessive.
What valid consent requires, and when it cannot be freely given.
What Articles 12 to 14 require you to tell people, and how.
When to notify the authority, and when to tell the people affected.
Why derogations are a last resort, not an alternative to safeguards.
The steps for a transfer after Schrems II.
How the one-stop shop is applied.
Lawful basis, signs, retention and access for camera surveillance.
Who is responsible for targeting, and on what basis.
How delisting works against search results.
The exam tests application, and these judgments are where application was settled.
Struck down Safe Harbor: a transfer mechanism must give protection essentially equivalent to the EU's.
Struck down the Privacy Shield; standard contractual clauses survive, with a duty to assess the destination and add measures where needed.
The right to be delisted from search results, and a search engine is a controller.
Pre-ticked boxes are not consent, and the cookie rules apply whether or not the data is personal.
A website embedding a social plugin is a joint controller for the collection and transmission.
A competition authority may consider GDPR compliance, and consent to a dominant platform is rarely freely given.
Every explanation in the course is stored once and linked to its source. When a regulation, a guideline or a decision changes, we update it in one place and every lesson that uses it is correct from that moment.
Exam questions come in a small number of structures, and a candidate who knows the content can still lose marks on the structure. The course tags every question with its structure; the technique is one tap away on each one, and every test shows whether you lost the mark on the content or on the type of question.
Buy the exam voucher when you are ready, not before. It expires a year after you buy it.
Free CIPP/E assessmentThe IAPP recommends at least 30 hours of study. People who work with the GDPR every day need less; people new to data protection need more. At three hours a day you can be ready in about a month.
Book the exam before you feel ready: a fixed date concentrates the effort. You have twelve months from purchase to sit it.
Or €117 a month with a trial exam included.
A four-week plan, at three hours a day
A guideline. The course builds your own plan from your assessment and the hours you have.
| Resource | Price | Worth it? |
|---|---|---|
| CIPP/E body of knowledge | Free | Essential. Work through it competency by competency. |
| The GDPR itself | Free | No substitute. Read the articles against the recitals. |
| The IAPP textbook | IAPP store | Useful for self-study; it can lag the current body of knowledge. |
| EDPB guidelines | Free | Examinable. Summaries save a great deal of time. |
| IAPP official training | From $995 | A good introduction. It does not replace practice under time pressure. |
| IAPP practice exam | About $55 | One exam, useful for the house style of the questions. |
| 22Academy CIPP/E course | €37 a week or €117 a month | The full course, the exam skills, the measurement and a trial exam. Stop when you are ready. |
| 22Academy trial exam | €42, or free with a monthly plan | Full length under real conditions, with analysis by domain and by question type. |
If you fail, fail cheap. Ten trial exams cost less than one retake.
Buy a trial examThe CIPP/E is the certification for anyone whose job depends on getting European data protection right. It opens the door to roles on the legal side, such as privacy counsel and data protection officer, and on the operational side, such as privacy manager and head of privacy. With the AIGP next to it, it leads into AI governance, the newest of these careers.
Most of these roles ask for the certification by name, because it shows an employer that you can apply the law rather than only describe it. Pay rises with the scope of the role, and at the top end these are among the better-paid jobs in compliance.
Each role page shows which certifications it takes, in which order, and how long it takes.
| Certification | What it covers | Take it when |
|---|---|---|
| CIPP/E | European data protection law | You advise on the law, or need the foundation for everything else |
| CIPP/US | United States privacy law, federal and state | You work with American data, clients or colleagues |
| CIPM | Running a privacy programme | You run privacy rather than advise on it |
| CIPT | Privacy in technology | You build or run the systems |
| AIGP | AI governance | Your organisation builds or uses AI |
Not sure? The career plan starts from the job you want.
Free account, fifteen minutes, your score per domain.
About 1 minute 40 seconds a question. Flag and move on.
Removing what is wrong is faster than hunting for what is right.
Most, best, primary and except decide what is being asked.
Optional, fifteen minutes. Taking it means submitting the first half for good.
Online or at a test centre: both work. If you sit online, do a full dry run the day before, and disconnect second screens and docking stations.
Passed? You keep the certification with 20 CPE credits in every two-year period, plus the maintenance fee or an IAPP membership that includes it.
Not this time? A retake costs $375, and your progress in the course is still there.
“After passing the mock exam from 22academy, I truly felt prepared for the real exam.”
It is demanding rather than hard. Most of the effort goes into vocabulary and structure: knowing exactly what a controller is, which lawful basis fits, what a right requires and by when. The rest is applying those rules to a messy scenario under a clock. The questions reward precision, the qualifier in the question, the condition in the rule and the deadline in the article, so candidates who practise on exam-style questions early do far better than those who only read.
No. There are no prerequisites, no degree and no minimum experience. Candidates come from compliance, security, IT, HR and management as well as from law. The exam tests whether you can apply the rules to a situation, not whether you can argue them in court, and the course explains every concept in plain language as well as in its legal form.
The IAPP offers traditional classroom courses and e-learning in which the content is presented to you. We start from the fact that you already have access to all the content, so we focus on getting it into your head rather than throwing more of it at you. We test your knowledge constantly, because that is what makes it stick, and we explain every concept in the form and length that suits you. We also teach the exam skills: how the questions are built, what they are really asking and where the traps are. And we embrace AI for your study, because you use it already; we show you how to use it more effectively.
Practice questions check your knowledge one item at a time. The trial exam checks whether you can answer ninety in a row under the clock, the way the real exam asks it. Its analysis shows whether you lose marks on the content or on the type of question, so you know exactly what to work on in the last days. It is the last check before you book.
Yes, and we encourage it. An AI app is a good partner for rehearsing: it will quiz you, rephrase a concept or test you on a passage you give it. It is a poor judge of whether you are ready, because it cannot tell you what you failed to ask. The course gives you prompts that make your own app quiz you properly, and measures you with its own questions.
Yes. You can start your course for free and see whether the system suits you: the assessment and the first lesson are open without a card. When you want the rest, the course is €37 a week, or €117 a month with a trial exam included.
Yes. You pay for the weeks or months you study and cancel whenever you like; your access runs to the end of the period you paid for. If you come back within a year, your progress is still there.
No. The IAPP owns the CIPP/E and sets the exam. 22Academy prepares candidates for it independently, and has done so since 2018.
More in the FAQ.
How to plan around a job, when to book the exam, whether you are ready: connect and ask. Support is free!
Free account, fifteen minutes, your score per domain.