Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A 2026 reference to the IAPP’s European data protection certification: the five domains of Body of Knowledge v1.3.3, the 90-question exam (offered in English, French, and German), what it costs, how to keep it, the jobs it maps to, and how CIPP/E compares to CIPP/US, CIPM, and AIGP. Written for anyone weighing the CIPP/E or trying to pin down what the GDPR exam actually tests.
CIPP/E is the IAPP’s certification in European data protection law, the concentration of the CIPP built around the GDPR for professionals whose work touches the personal data of people in the EU.
It tests whether you can apply the regulation to a set of facts. The five domains run from the history and institutions behind European data protection, through GDPR concepts, data subject rights, lawful processing, and international transfers, to territorial scope, accountability, enforcement, and the specific problems of employee data, surveillance, marketing, cookies, and AI. Some questions hand you a scenario and ask what a controller should do next, the kind of call a data protection officer or privacy counsel makes on the job.
The credential has no prerequisites, is accredited by the ANSI National Accreditation Board under ISO/IEC 17024:2012, and is issued and maintained by the IAPP, the International Association of Privacy Professionals, the same body behind the CIPP/US, CIPM, CIPT, and AIGP. You can sit it in English, French, or German, and the IAPP says the translated versions were produced by professional translation firms with no machine translation.
Human rights roots, EU institutions, and the legislative framework from Convention 108 to the GDPR and the EU AI Act.
GDPR concepts, security and breach notification, and data subject rights. The heaviest domain at 18 to 28 questions.
Processing principles, lawful bases, privacy notices, and international data transfers.
Territorial scope, accountability duties, DPIAs and DPOs, supervision, and fines.
Employment, surveillance, direct marketing, cookies, cloud, social media, and AI.
Four reasons the credential carries weight for anyone whose work falls under the GDPR, including people at U.S. companies with EU customers.
The CIPP/E comes from the IAPP, a not-for-profit association founded in 2000, and it carries ANSI National Accreditation Board accreditation under ISO/IEC 17024:2012 alongside the CIPP/US, CIPM, and CIPT. The IAPP calls it the global industry standard for privacy professionals. More useful in practice, the exam starts from the GDPR and works outward instead of treating European law as one chapter in a global survey.
The IAPP sets no experience or education requirement, and membership is optional. You can take the exam in English, French, or German, with an IAPP translation dictionary on screen for the French and German versions. For a candidate in Lyon or Munich, reading a works council scenario in their own language is a real advantage.
The IAPP’s Fellow of Information Privacy designation requires an active CIPP plus an active AIGP, CIPM, or CIPT, three years of continuous work in which privacy is at least half the job (an ISC2, ISACA, or IEEE security certification can stand in for one of those years), three peer references, and a personal statement. CIPP/E counts as the CIPP half. See how the IAPP maintenance cycle compares once you hold more than one.
The IAPP does not claim DoD 8140 alignment for the CIPP/E, and a European data protection law credential isn’t built to qualify anyone for a U.S. cyber work role. Before relying on any credential for a cyber-coded position, check the current qualification matrix at cyber.mil.
Its weight comes from the regulation. The GDPR reaches organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior there, and fines for the most serious infringements run up to 20 million euros or, for a company, 4 percent of worldwide annual turnover, whichever is higher.
The certification, the exam, and the maintenance rules for the CIPP/E, as the IAPP publishes them and as checked in October 2026.
The CIPP/E covers what European law requires. The IAPP’s other credentials cover running the program, building privacy into technology, and governing AI, and any one of them paired with a CIPP completes the credential half of the FIP designation.
The IAPP’s “operationalizing privacy” credential: six domains under BoK v4.2.0 on building, running, and measuring a privacy program. Same exam shape as CIPP/E, 90 questions in 2.5 hours for $550, and the logical second step for anyone who will run the GDPR program rather than interpret it. Our CIPM guide covers it in full.
The IAPP’s “engineering privacy” credential, for the people who have to build data protection by design and by default into systems and products. For CIPP/E holders on the IT or security side it is the closest pairing, and it is one of the three credentials that completes a FIP.
The IAPP’s “executing responsible AI governance” credential. CIPP/E already lists the EU AI Act in Domain I and the compliance questions AI raises in Domain V. The AIGP turns that into a full governance program covering the EU AI Act, the NIST AI RMF, and ISO/IEC 42001, with no prerequisites of its own.
With no prerequisites, the CIPP/E can be the first privacy credential someone earns, especially at an organization that answers to EU regulators. Candidates arrive from legal, compliance, IT, security, HR, and marketing roles, use it as the anchor, and then specialize by what the job asks of them next.
Where candidates come from, none required
The European data protection anchor
Two questions to answer before you commit: can you certify, and should you pursue the CIPP/E specifically. Here’s a straight answer to both.
No prerequisites, no experience requirement, no membership requirement.
The IAPP sets no experience or education prerequisite for the CIPP/E, and you do not need to join the IAPP to register. Buy the exam for $550, choose English, French, or German at checkout, and you have one year to schedule and take it at a Pearson VUE test center or online through OnVUE. Once you pass, keeping the credential active does require either a membership or the Certification Maintenance Fee.
Open entry doesn’t mean easy entry.
Some questions are scenario-based, multi-select items give no partial credit, and the BoK expects you to know European Data Protection Board guidance on everything from controller and processor roles to transfer derogations. Candidates who have never read a GDPR article or an EDPB guideline can pass, but they spend more of their prep time learning to work from the text of the law to the right answer.
The CIPP/E maps to the roles that interpret and apply European data protection law, from the analyst working an access request against the one-month clock to the DPO who deals directly with the supervisory authority.
Monitors GDPR compliance from inside the organization, advises on data protection impact assessments, and acts as the contact point for supervisory authorities and data subjects. Article 37 makes the role mandatory for some organizations, which is why the exam tests when a DPO is required.
Runs the daily work of a GDPR program: answering access and erasure requests inside the one-month response window, keeping records of processing current, drafting privacy notices, and working through vendor questionnaires.
Advises the business on lawful bases, processor contracts, and transfer mechanisms such as Standard Contractual Clauses, and handles the response when a supervisory authority opens an inquiry or a breach has to be reported within 72 hours.
Turns GDPR requirements into a program business teams can follow, with DPIA workflows, training, retention schedules, and the documentation the accountability principle expects an organization to produce on request.
Owns data protection inside a broader regulatory function, tracking where the GDPR overlaps with NIS 2, the ePrivacy rules, and the EU AI Act, and keeping evidence ready for audits and regulator requests.
Helps organizations inside and outside Europe work out whether the GDPR applies to them, close the gaps an assessment turns up, and put transfer mechanisms in place that hold up after Schrems II.
Shortest version: CIPP/E is for the people who know what European law requires, CIPP/US does the same job for U.S. law, CIPM is for the people who run the program, and AIGP is for the people who govern AI.
| CIPP/E | CIPP/US | CIPM | AIGP | |
|---|---|---|---|---|
| Issuer | IAPP | IAPP | IAPP | IAPP |
| Focus | European data protection law (GDPR) | U.S. private-sector privacy law | Privacy program management | AI governance, law, lifecycle oversight |
| Prerequisites | None | None | None | None |
| Exam Format | 90 questions (75 scored), 2.5 hours | 90 questions (75 scored), 2.5 hours | 90 questions (75 scored), 2.5 hours | 100 questions (85 scored), about 3 hours |
| Passing Score | 300 (scaled 100 to 500) | 300 (scaled 100 to 500) | 300 (scaled 100 to 500) | 300 (scaled 100 to 500) |
| Exam Cost | $550 | $550 | $550 | $649 member / $799 non-member |
| Renewal | 20 CPE per 2-year term, $250 maintenance | 20 CPE per 2-year term, $250 maintenance | 20 CPE per 2-year term, $250 maintenance | 20 CPE per 2-year term, $250 maintenance |
| Current Blueprint | BoK v1.3.3, effective September 1, 2025 | BoK v2.6.1, effective September 1, 2025 | BoK v4.2.0, effective September 1, 2025 | BoK v2.1, effective February 2, 2026 |
| Best For | DPOs, EU privacy counsel, compliance leads | U.S. privacy analysts, counsel, compliance leads | Privacy program managers | AI governance and compliance leads |
Pricing and renewal details can change and vary by membership status. CIPP/US, CIPM, and AIGP figures come from our CIPP/US guide, CIPM guide, and AIGP guide, and the renewal row follows the IAPP CPE policy, which applies the same two-year, 20-credit rule to all four. Confirm any DoD 8140 status against the current qualification matrix at cyber.mil.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As an IAPP Authorized Training Partner, we run the IAPP CIPP/E Boot Camp over two days, live online or in person, with official IAPP courseware and a CIPP/E practice test. Enrollment includes the $550 exam voucher, your first year of IAPP membership, and a free course retake if you need a second pass.
Privacy fundamentals, the EU laws that sit beside the GDPR, career strategy, maintenance, and the other privacy and governance credentials.
The groundwork under the whole credential: what data privacy means in practice, the GDPR’s top penalty of 20 million euros or 4 percent of global turnover, and where the IAPP’s CIPP tracks fit.
The NIS 2 Directive sits in CIPP/E Domain I beside the GDPR. Who it applies to, how its incident reporting timeline lines up with GDPR breach notification, and what American companies operating in Europe need to do.
The EU AI Act is listed in the CIPP/E Body of Knowledge and anchors the IAPP’s AI governance exam. How the act fits with the NIST AI RMF and ISO/IEC 42001, with a note for readers coming from a CIPP/E or CIPM background.
Where a privacy law credential fits in a governance, risk, and compliance career, including the case for IAPP certifications when an organization operates in Europe and GDPR compliance never really stops.
How the IAPP two-year term and 20-credit rule compares with ISACA, ISC2, and CompTIA, and why one IAPP activity can count toward more than one credential once you hold several.
ISACA’s privacy engineering credential, who it serves, and why its experience requirement and technical focus put it on a different track from a law-focused CIPP.
One of the three IAPP credentials that pairs with a CIPP toward the FIP: what the AI governance exam tests, who it fits, and whether it is worth the time for a privacy professional.
The CIPP/E Body of Knowledge v1.3.3 is organized into five domains. The badge on each row is the blueprint’s published minimum and maximum number of questions for that domain. The IAPP publishes these ranges rather than percentages, and Domain II carries the most. Click any domain for what it covers.
Where European data protection law came from and who maintains it. The domain starts with the human rights roots and early instruments, including the OECD Guidelines, the Treaty of Lisbon, and Council of Europe Convention 108 and its update, Convention 108+, then asks why Europe moved toward a harmonized approach and what complicates it, Brexit among them. It maps the institutions (the Council of Europe, the European Court of Human Rights, the European Parliament, the European Commission, the European Council, and the Court of Justice of the European Union) and the legislation underneath: Directive 95/46/EC, the ePrivacy Directive, the e-Commerce Directive, the GDPR, the NIS and NIS 2 Directives, and the EU Artificial Intelligence Act.
The heaviest domain on the blueprint. It covers the core GDPR vocabulary: personal data, special categories of data, pseudonymous versus anonymous data, data subjects, and the controller and processor roles as the European Data Protection Board interprets them. Security comes next, from technical and organizational measures such as encryption and access controls to breach notification, vendor management, and sharing data with third parties. The biggest single competency on the exam, at 8 to 12 questions, is data subject rights: access, rectification, erasure and the right to be forgotten, restriction, objection, consent and its withdrawal, automated decision-making and profiling, portability, and the limits on those rights.
How processing becomes lawful and how personal data leaves Europe. The domain covers the processing principles (fairness and lawfulness, purpose limitation, proportionality, accuracy, storage limitation, integrity and confidentiality), the lawful bases from consent and contractual necessity to legitimate interest, the rules for special categories, and the transparency obligations behind privacy notices and layered notices. The transfer material covers adequacy decisions, the history of Safe Harbor and Privacy Shield and the Schrems rulings that ended them, the basics of the EU-US Data Privacy Framework, Standard Contractual Clauses, Binding Corporate Rules, codes of conduct and certifications, derogations, and transfer impact assessments.
Who the GDPR reaches and what it demands of them. The domain covers territorial and material scope, including what counts as establishment in the EU and how the regulation applies to organizations with no establishment there, plus the exemptions it allows. Accountability carries the most weight: the duties of controllers, joint controllers, and processors, data protection by design and by default, documentation and cooperation with regulators, data protection impact assessments, mandatory data protection officers, and audits. It closes with supervision and enforcement, meaning the European Data Protection Board, the European Data Protection Supervisor, national supervisory authorities, the lead authority concept, fines, class actions, and compensation owed to data subjects.
The GDPR applied to specific situations. In the workplace that means the legal basis for processing employee data, personnel records, monitoring and data loss prevention, bring your own device programs, works councils, and whistleblowing systems. Surveillance covers interception of communications, monitoring by public authorities, CCTV, geolocation, and biometrics and facial recognition. The domain also takes in direct marketing and online behavioral targeting, then internet technology: cloud computing, cookies, social media platforms and dark patterns, search engine marketing, and the compliance and ethical questions raised by artificial intelligence and machine learning.
Domains and question ranges reflect the IAPP CIPP/E Body of Knowledge and Exam Blueprint v1.3.3, approved March 4, 2025 and effective September 1, 2025, which replaced v1.3.2. The IAPP reviews each BoK every year, changes roughly 10 to 15 percent of exam content in its annual updates, and announces changes at least 90 days before they reach the exam. As of October 2026 the IAPP’s CIPP/E page still links v1.3.3.
The questions candidates ask most often when researching the Certified Information Privacy Professional/Europe certification.
The Certified Information Privacy Professional/Europe (CIPP/E) is the IAPP’s certification in European data protection law. It covers the history and institutions behind European privacy law, core GDPR concepts and data subject rights, lawful processing and international data transfers, the GDPR’s scope, accountability and enforcement rules, and compliance in areas like employment, surveillance, marketing, and online technology. The IAPP describes the CIPP as the premier global credential for privacy and data protection, and CIPP/E is the concentration for professionals whose work falls under European law.
Under Body of Knowledge v1.3.3, effective September 1, 2025, the five domains are Introduction to European Data Protection (7 to 13 questions), European Data Protection Law and Regulation (18 to 28), European Data Processing (13 to 21), European Data Protection: Scope and Accountability (8 to 18), and Compliance with European Data Protection Law and Regulation (8 to 16). The IAPP publishes these as minimum and maximum question counts, not percentages.
As of October 2026 the CIPP/E exam costs $550 for a first attempt, and the price is the same for IAPP members and non-members. The IAPP discounts retakes, and additional first-time exams for people who already hold an IAPP certification, but its store page lists only the $550 price. You must schedule and take the exam within one year of purchase. Training Camp’s 2-day CIPP/E boot camp includes the $550 exam voucher.
The CIPP/E exam has 90 multiple-choice questions, 75 scored and 15 unscored, delivered over 2.5 hours with a 15-minute break offered at the halfway point. Some questions are scenario-based, and multi-select questions tell you how many answers to choose and give no partial credit. Scores are scaled from 100 to 500 and 300 passes, which the IAPP notes does not represent 60 percent. The exam runs year-round at Pearson VUE test centers or online through OnVUE.
No. The IAPP sets no experience or education prerequisite for the CIPP/E exam, and you don’t need to be an IAPP member to sit it. Comfort reading legislation helps, because the exam asks you to apply GDPR articles and European Data Protection Board guidance to scenarios, but candidates come from legal, compliance, IT, security, HR, and marketing roles.
The CIPP/E has a two-year certification term. To keep it active you earn 20 hours of continuing privacy education per credential per term and either pay the $250 Certification Maintenance Fee or hold an IAPP membership, which costs $295 per year and includes the fee. Up to 10 surplus credits earned in the last six months of a term can carry over into the next one.
Yes. The CIPP/E exam is offered in English, French, and German, and you pick the language when you buy it. The IAPP says the French and German versions were translated from the English exam by professional translation firms with no machine translation. An IAPP translation dictionary is available on screen during those exams, and the Body of Knowledge is published in all three languages.
The IAPP does not claim DoD 8140 approval for the CIPP/E, and as a European data protection law credential it isn’t designed for U.S. cyber work role qualification. Before relying on it for a cyber-coded position, check the current DoD 8140 qualification matrix at cyber.mil. If you need an 8140 path, see the full DoD 8140 work role paths.
Pick the one that matches the law your organization answers to. CIPP/E covers the GDPR and European data protection law. CIPP/US covers U.S. federal and state privacy law, from HIPAA and GLBA to the newer state consumer privacy laws. Both are 90-question, 2.5-hour, $550 exams with no prerequisites. If your company answers to both, the two pair well, and either one satisfies the CIPP half of the Fellow of Information Privacy designation.
Start with the one that matches your job. If you will be deciding what the GDPR requires, that’s CIPP/E, the IAPP’s “practicing privacy” credential. If you will be running the program that meets those requirements, CIPM is the “operationalizing privacy” credential, with six domains under BoK v4.2.0. Both are 90-question, 2.5-hour, $550 exams with no prerequisites. A DPO usually needs both sides sooner or later, and a CIPP plus a CIPM, CIPT, or AIGP is the credential half of the Fellow of Information Privacy designation.
The difficulty is precision. The exam expects you to know which lawful basis fits a scenario, when a transfer needs Standard Contractual Clauses or a derogation, and what European Data Protection Board guidance says on topics like access requests and the lead supervisory authority. Scenario questions can offer several defensible answers, and the best one usually turns on a detail of the regulation. The IAPP recommends at least 30 hours of study for each certification, and working from the BoK v1.3.3 beats memorizing article numbers.
The last change took effect September 1, 2025. The current Body of Knowledge and Exam Blueprint is version 1.3.3, approved March 4, 2025, replacing version 1.3.2, and its Domain I lists the NIS and NIS 2 Directives and the EU Artificial Intelligence Act among the laws candidates should understand. The IAPP updates its exams annually, changing roughly 10 to 15 percent of content, and announces body of knowledge changes at least 90 days before they reach the exam. As of October 2026 the IAPP’s CIPP/E page still links version 1.3.3, so check any prep material against it.
For anyone whose work touches the personal data of people in the EU, yes. The GDPR reaches companies outside Europe that offer goods or services to people in the EU or monitor their behavior there, and the BoK also covers NIS 2 and the EU AI Act. It’s ANAB accredited under ISO/IEC 17024:2012, has no prerequisites, and costs $550 to sit. If your work runs mainly under U.S. law, the CIPP/US is the better first credential.
Weighing the certification, comparing the IAPP credentials, or planning GDPR training for a team: tell us where you are and we’ll help you map out the right path.