What the exam asks, in what order to study it, how long it takes, what it costs and where candidates lose marks.
The CIPT, the Certified Information Privacy Technologist, is the certification for people who build privacy into systems and products. It tests whether you can recognise a privacy risk in a design and choose the technique that answers it.
It is issued by the IAPP. There are no prerequisites: no degree and no minimum experience. You sit it online or at a test centre, in English.
Format and fees
Membership of the IAPP costs $295 a year and includes the maintenance fee; without membership that fee is $250 every two years.
The IAPP publishes a body of knowledge for each certification: the list of competencies the exam is written from. The 22Academy course follows the current version concept by concept.
What a privacy technologist does and with whom: the work with legal, security and product teams, and how privacy differs from security.
Privacy and security. Encryption keeps outsiders away from data. It does not make a use of that data acceptable.
Which term describes building a system so that the most privacy-protective setting applies without the user doing anything?
Twenty more like it, freeThe privacy risks at each stage of the data life cycle: how data is collected, what it is used for, who it is shared with and how it is destroyed.
The harm. The exam describes a situation and asks which kind of privacy harm it is. Surveillance, aggregation, secondary use and exposure are not interchangeable.
Statement I: pseudonymised data falls outside data protection law because it no longer identifies anyone. Statement II: combining data from several sources can create a privacy risk that none of the sources carried alone. Which statement is correct?
Twenty more like it, free
The exam sits between law and engineering. The course shows your accuracy per domain and per module, so you see which side needs the work, and points at the module to work on now.
Finding and weighing privacy risk in a system: risk models, threat modelling and privacy impact assessments.
The model. Each risk model asks a different question, and the exam names one and describes another.
A team is designing a new mobile app and wants to find the privacy threats before any code is written. Which technique should it use?
Twenty more like it, freeDesigning privacy in from the first sketch: the principles, the design strategies, and interfaces that inform people without steering them.
The strategy. Minimise, hide, separate and aggregate sound alike, and each means one specific thing.
A service needs to know only whether a user is over 18. Which design choice BEST applies data minimisation?
Twenty more like it, freeThe techniques and the discipline around them: privacy-enhancing technologies, the objectives of privacy engineering, and governance through the development life cycle.
The technique. Anonymisation, pseudonymisation, k-anonymity and differential privacy give different guarantees, and the exam asks which one a description matches.
Which technique adds calibrated statistical noise to results, so that the presence of any one person in a dataset cannot be inferred?
Twenty more like it, freeNot using your IAPP membership? Pay only the $250 maintenance fee and keep $340 every two years.
Start CIPT freeFour groups of techniques run through the whole exam. Know what each one guarantees and what it does not.
What each form protects, and what it leaves exposed.
How they differ, and how data gets re-identified.
Sharing results about a group without revealing any one person in it.
Walking through a design to find the privacy threats in it.
The exam draws on the frameworks and models that privacy engineers work with. Knowing what each one is for matters more than memorising it.
A voluntary tool for managing privacy risk, built to sit next to the NIST Cybersecurity Framework.
Predictability, manageability and disassociability: what a system should achieve for privacy.
The seven foundational principles, starting with proactive and not reactive.
Minimise, hide, separate, aggregate, inform, control, enforce and demonstrate.
A method for privacy threat modelling, named after the seven kinds of threat it looks for.
Four groups of harmful activity: collection, processing, dissemination and invasion.
These decisions settled how the law treats identifiers, cookies, plugins, security and pseudonymised data.
A dynamic IP address can be personal data for a website operator.
Pre-ticked boxes are not consent, and the cookie rules apply whether or not the data is personal.
A website that embeds a social plugin is a joint controller for the collection and transmission.
Transfers need an assessment of the destination and, where needed, extra measures such as strong encryption.
The FTC may treat poor data security as an unfair practice.
Whether pseudonymised data is personal data depends on whether the recipient can reasonably re-identify people.
Every explanation in the course is stored once and linked to its source. When a regulation, a guideline or a decision changes, we update it in one place and every lesson that uses it is correct from that moment.
Exam questions come in a small number of structures, and a candidate who knows the content can still lose marks on the structure. The course tags every question with its structure; the technique is one tap away on each one, and every test shows whether you lost the mark on the content or on the type of question.
Buy the exam voucher when you are ready, not before. It expires a year after you buy it.
Free CIPT assessmentThe IAPP recommends at least 30 hours of study. People who already work in privacy or in engineering need less; people new to both need more. At three hours a day you can be ready in about a month.
Book the exam before you feel ready: a fixed date concentrates the effort. You have twelve months from purchase to sit it.
Or €117 a month with a trial exam included.
A four-week plan, at three hours a day
A guideline. The course builds your own plan from your assessment and the hours you have.
| Resource | Price | Worth it? |
|---|---|---|
| CIPT body of knowledge | Free | Essential. Work through it competency by competency. |
| The IAPP textbook | IAPP store | Useful for self-study; it can lag the current body of knowledge. |
| NIST Privacy Framework | Free | Short, practical, and close to how the exam thinks about risk. |
| IAPP official training | From $995 | A good introduction. It does not replace practice under time pressure. |
| IAPP practice exam | IAPP store | One exam, useful for the house style of the questions. |
| 22Academy CIPT course | €37 a week or €117 a month | The full course, the exam skills, the measurement and a trial exam. Stop when you are ready. |
| 22Academy trial exam | €42, or free with a monthly plan | Full length under real conditions, with analysis by domain and by question type. |
If you fail, fail cheap. Ten trial exams cost less than one retake.
Buy a trial examThe CIPT is the certification for anyone who builds or runs the systems that hold personal data. It leads to privacy engineering, and it strengthens roles that sit between technology and governance, such as the AI governance manager and the head of privacy.
Employers ask for it because it shows that you can turn a privacy requirement into a design. Pay rises with the scope of the role.
Each role page shows which certifications it takes, in which order, and how long it takes.
| Certification | What it covers | Take it when |
|---|---|---|
| CIPT | Privacy in technology | You build or run the systems |
| CIPP/E | European data protection law | You want the legal foundation first |
| CIPP/US | United States privacy law, federal and state | You work with American data, clients or colleagues |
| CIPM | Running a privacy programme | You run privacy rather than advise on it |
| AIGP | AI governance | Your organisation builds or uses AI |
Not sure? The career plan starts from the job you want.
Free account, fifteen minutes, your score per domain.
About 1 minute 40 seconds a question. Flag and move on.
Removing what is wrong is faster than hunting for what is right.
Most, best, primary and except decide what is being asked.
Optional, fifteen minutes. Taking it means submitting the first half for good.
Online or at a test centre: both work. If you sit online, do a full dry run the day before, and disconnect second screens and docking stations.
Passed? You keep the certification with 20 CPE credits in every two-year period, plus the maintenance fee or an IAPP membership that includes it.
Not this time? A retake costs $375, and your progress in the course is still there.
“This mock test will give you an exact reality check on your preparation.”
It is demanding rather than hard. It sits between law and engineering, and most candidates are at home on one side only. The questions reward precision about terms that sound alike, so candidates who practise on exam-style questions early do far better than those who only read.
No. There are no prerequisites, no degree and no minimum experience. The exam asks what a technique does and when to use it, not how to program it. Candidates come from engineering, security, product, compliance and law, and the course explains every concept in plain language.
No. The CIPT stands on its own. A CIPP certification gives you the law and the CIPT shows how to build it into systems, so the two fit together well, in either order.
The IAPP offers traditional classroom courses and e-learning in which the content is presented to you. We start from the fact that you already have access to all the content, so we focus on getting it into your head rather than throwing more of it at you. We test your knowledge constantly, because that is what makes it stick, and we explain every concept in the form and length that suits you. We also teach the exam skills: how the questions are built, what they are really asking and where the traps are. And we embrace AI for your study, because you use it already; we show you how to use it more effectively.
Practice questions check your knowledge one item at a time. The trial exam checks whether you can answer ninety in a row under the clock, the way the real exam asks it. Its analysis shows whether you lose marks on the content or on the type of question, so you know exactly what to work on in the last days. It is the last check before you book.
Yes, and we encourage it. An AI app is a good partner for rehearsing: it will quiz you, rephrase a concept or test you on a passage you give it. It is a poor judge of whether you are ready, because it cannot tell you what you failed to ask. The course gives you prompts that make your own app quiz you properly, and measures you with its own questions.
Yes. You can start your course for free and see whether the system suits you: the assessment and the first lesson are open without a card. When you want the rest, the course is €37 a week, or €117 a month with a trial exam included.
Yes. You pay for the weeks or months you study and cancel whenever you like; your access runs to the end of the period you paid for. If you come back within a year, your progress is still there.
No. The IAPP owns the CIPT and sets the exam. 22Academy prepares candidates for it independently, and has done so since 2018.
More in the FAQ.
How to plan around a job, when to book the exam, whether you are ready: connect and ask. Support is free!
Free account, fifteen minutes, your score per domain.