Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
This guide covers the IAPP's privacy technology certification as of October 2026, including the five BoK v4.0.0 domains, the 90-question exam, the $550 exam fee, maintenance, career paths, and how the CIPT compares to the CIPM, ISACA's CDPSE and the AIGP. It's written for the engineers, architects and security staff deciding whether the CIPT is worth their time.
CIPT is the IAPP's privacy technology certification, the credential for people who build data protection into the products, services and systems an organization runs.
The IAPP says the CIPT proves you understand how to use technical solutions to build data protection into products and services, and its candidate handbook credits holders with a dual literacy in privacy and technology. Where the CIPP credentials test the law and the CIPM tests the program, the CIPT tests the engineering decisions in between: which consent mechanism to build, when pseudonymization is enough and when it isn't, how a data flow crosses borders, and what a dark pattern looks like before it ships.
The credential is ANAB accredited under ISO/IEC 17024:2012, carries no experience or education prerequisite, and is one of the three credentials (with the CIPM and AIGP) that can complete the IAPP's Fellow of Information Privacy designation. CIPT is issued and maintained by the IAPP, which introduced it in 2014 and also runs the CIPP, CIPM and AIGP programs.
Privacy roles, legal requirements turned into technical solutions, risk and threat models such as FAIR and LINDDUN, and data ethics.
Consent, minimization, retention, anonymization and differential privacy. The heaviest domain at 19 to 23 scored questions.
Dark patterns, software vulnerabilities, tracking and surveillance, AI at work, and DPIAs.
The seven principles, privacy in user experience, usability testing, and value sensitive design.
NIST privacy engineering objectives, data flow diagrams, data inventories, code reviews and runtime monitoring.
Four things that set the credential apart as more privacy requirements land on engineering teams instead of stopping at the legal department.
Lawyers and policy staff have the CIPP, and program managers have the CIPM. The CIPT is the IAPP credential written for the people who build the systems. BoK v4.0.0 expects you to translate legal requirements into technical solutions, pick privacy-enhancing techniques such as anonymization and differential privacy, review code for privacy gaps, and apply the NIST privacy engineering objectives of predictability, manageability and dissociability.
ISACA's CDPSE, the other big privacy engineering credential, asks for three years of experience in its domains before it grants the certification. The CIPT has no experience or education prerequisite. You buy the exam, agree to the IAPP's certification policies, and you have a year to sit it.
The IAPP's Fellow of Information Privacy needs a CIPP plus a CIPM, CIPT or AIGP, and three years of work where privacy is at least half the job. A security certification from ISC2, ISACA or IEEE can count for one of those years, which helps engineers who come from security. Our CPE comparison covers what holding several credentials costs to maintain.
The IAPP does not claim a DoD 8140 mapping for the CIPT, and we don't claim one either. If you need an 8140 qualification for a cyber-coded position, check the current Approved Qualifications Matrix at cyber.mil before you commit.
Its weight comes from two other places: ANAB accreditation under ISO/IEC 17024:2012, the international standard for personnel certification bodies, and privacy laws that expect protection to be built into systems from the start. The GDPR, for one, requires data protection by design and by default.
The certification, the exam structure, and what it takes to maintain the CIPT, as of October 2026.
The CIPT covers how technology carries out privacy requirements. The IAPP's other credentials each add a different layer, and the right pair, plus the experience, qualifies you for the Fellow of Information Privacy designation.
The law your designs have to satisfy. A CIPP is the required first half of the FIP, so a CIPT holder who wants the Fellow designation needs one. The CIPP/US covers US federal and state privacy law, and the CIPP/E covers European data protection law, the GDPR included.
The CIPM covers the privacy program your controls sit inside: governance, assessments, metrics and incident response. It suits technologists who end up leading a privacy function. CIPT Domain III already asks you to reduce the privacy risks of AI, and the AIGP goes further into how AI systems are governed.
The IAPP's senior designation. It requires a CIPP plus a CIPM, CIPT or AIGP, three years of work experience in which privacy is at least half the job, three peer references and a personal statement. For a CIPT holder, adding a CIPP completes the credential half.
With no prerequisites, the CIPT can be a first credential. In practice most candidates come from engineering, IT or security work, earn the CIPT once privacy questions start landing on their team, and then add a privacy law credential or a deeper specialty.
Common starting points, none required
The privacy technology anchor
Two things to settle before you commit: can you certify, and should you pursue the CIPT specifically. Here's a straight answer to both.
No experience or education prerequisite.
The IAPP lists no experience or education requirement for the CIPT. You purchase the exam, and you have one year from purchase to schedule and sit it at a Pearson VUE test center or online through OnVUE. Membership is not required to take the exam, though the certification only becomes active once you hold an IAPP membership or pay the Certification Maintenance Fee.
No prerequisite, but the exam assumes technical fluency.
The Body of Knowledge assumes you can follow a technical discussion about data flows, access control and encryption, and some questions drop you into a scenario and ask for the best design choice. One retired sample question in the IAPP's BoK asks which concept engineers followed when they set the default for stored credit card data to "Do Not Save." The IAPP suggests at least 30 hours of study. Candidates with no IT background can pass, but they should plan extra time for the engineering vocabulary the questions take for granted, and plan around the seven-day wait before any retake.
The CIPT maps to the technical roles that sit between engineering and privacy counsel, the people who have to make privacy requirements work in code, infrastructure and product design.
Builds privacy controls into products and data pipelines: consent and preference handling, retention and deletion jobs, pseudonymization, and the access rules that keep secondary uses of personal data in check.
Designs systems so minimization, processing segregation and cross-border transfer rules are settled in the architecture, using data flow diagrams and data lineage tools to show where personal data goes.
Extends security work into privacy: identity and access management, encryption, intrusion detection and incident support, with a clear view of which events count as personal data breaches.
Runs the technical side of privacy operations, from data inventories and records of processing activities to DPIAs and the KRIs and KPIs that show leadership where privacy risk is heading.
Decides how privacy shows up in the product: notices, settings and dashboards people can understand, usability testing of privacy features, and design choices that steer clear of dark patterns.
Assesses client systems against privacy requirements, from code reviews and runtime monitoring to service provider reviews and privacy by design recommendations for new products.
Shortest version: CIPT is for the technologists who build privacy into systems, CIPM is for the people who run the privacy program, CDPSE is ISACA's experience-verified engineering credential, and AIGP is for the people who govern AI.
| CIPT | CIPM | CDPSE | AIGP | |
|---|---|---|---|---|
| Issuer | IAPP | IAPP | ISACA | IAPP |
| Focus | Privacy in technology | Privacy program management | Privacy engineering | AI governance |
| Prerequisites | None | None | 3 years of experience, verified after the exam | None |
| Exam Format | 90 items (75 scored), 2.5 hours | 90 items (75 scored), 2.5 hours | 120 items, 3.5 hours | 100 items (85 scored), about 3 hours |
| Passing Score | 300 (scaled 100 to 500) | 300 (scaled 100 to 500) | 450 (scaled 200 to 800) | 300 (scaled 100 to 500) |
| Exam Cost | $550 | $550 | $575 member / $760 non-member | $649 member / $799 non-member |
| Renewal | 20 CPE hours per 2-year term | 20 CPE hours per 2-year term | 20 CPE hours per year, 120 per 3-year cycle | 20 CPEs over 2 years |
| Current Blueprint | BoK v4.0.0, effective September 1, 2025 | BoK v4.2.0, effective September 1, 2025 | 4-domain job practice | BoK v2.1, effective February 2, 2026 |
| DoD 8140 Matrix | No mapping claimed | Not a matrix credential | Not listed | Not listed |
| Best For | Engineers, architects, security and IT staff | Program managers, DPOs, privacy officers | Security engineers, architects, developers | AI governance, compliance and risk leads |
CIPT exam facts are from the IAPP. CIPM, CDPSE and AIGP facts are from our CIPM guide, CDPSE guide and AIGP guide. We could not verify a DoD 8140 matrix listing for any of the four. Check the current Approved Qualifications Matrix at cyber.mil before relying on one for a cyber-coded position.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our IAPP CIPT boot camp runs two days, live online or in person, with official IAPP courseware, exam prep review sessions, a CIPT practice test, the $550 exam voucher, a free retake and your first year of IAPP membership included. Training Camp is an IAPP Authorized Training Partner, and you can browse the full IAPP course lineup if you are planning more than one credential.
Privacy fundamentals, the data life cycle, encryption, maintenance costs, and how the CIPT stacks up against the other privacy and governance credentials.
The ground the CIPT is built on: what data privacy means, how it differs from data security, the principles behind every privacy law, and where the CIPT sits among the IAPP and ISACA privacy credentials.
ISACA's privacy engineering credential, the one most often weighed against the CIPT, and a straight read on which roles benefit from its experience requirement.
How the IAPP's 20 CPE hours per two-year term compares with ISC2, ISACA and CompTIA renewal rules, useful if you hold a CIPT next to a security credential.
Data owners, custodians, controllers and processors, the three data states, and retention and destruction. The same roles and life cycle stages run through CIPT Domains I and II.
Symmetric and asymmetric encryption, protecting data at rest, in transit and in use, key management, and the implementation mistakes that leave personal data exposed.
A February 2026 federal ruling on consumer AI chats, and what it means when employees paste company data into AI tools. It is the kind of workplace technology risk CIPT Domain III asks you to reduce.
The IAPP's AI governance credential explained, and a logical next step for CIPT holders who already study the privacy risks of AI, machine learning and deep learning in Domain III.
The CIPT Body of Knowledge v4.0.0 is organized into five domains. The IAPP publishes a minimum and maximum number of scored questions per domain out of 75, not percentage weights, and the badges below show those scored-question ranges from the Exam Blueprint. Click any domain for what it covers.
The general and technical responsibilities of the role: the roles inside the privacy function (DPO, data owner, data steward, data custodian, legal compliance and cybersecurity), translating legal and regulatory requirements into practical technical and operational solutions, implementing notices, policies and procedures, and overseeing the technical side of privacy operations and audits, third-party assessments included. It also covers technical support for breach and incident response, risk concepts such as threat, vulnerability and exploit, privacy risk models (Nissenbaum's contextual integrity, Calo's harms dimensions, FAIR, FIPPs, the OECD principles), threat models such as LINDDUN and MITRE PANOPTIC, and the link between data ethics and privacy, including bias in automated decision-making.
Reducing privacy risk at each stage of the data life cycle. For collection: giving data subjects control through notices, settings, dashboards and consent mechanisms, managing automatic collection, extracting data from publicly available sources, retention and destruction, minimization, and processing segregation. For use: controlling aggregation risk, applying anonymization, pseudonymization and differential privacy, and limiting secondary uses such as profiling. For dissemination: techniques against data distortion, exposure, breach of confidentiality, blackmail and appropriation, plus defense-in-depth controls such as identity and access management and authentication.
The threats that come from how systems behave: intrusion and decisional interference through behavioral advertising, profiling, cyberbullying and social engineering, and the dark patterns that limit privacy-preserving choices. It covers software security (finding and fixing privacy vulnerabilities, intrusion detection and prevention, change management, service provider violations, and e-commerce risks from cookies, chatbots and payments), tracking and surveillance (audio and video, wearables and IoT, biometrics, location tracking, web tracking), workplace technologies including AI, machine learning and communications platforms, and monitoring risk through privacy audits, IT control reviews, KRIs, KPIs and impact assessments.
Putting privacy by design into practice: understanding and applying the seven privacy by design principles, defining and communicating privacy goals that guide design work across the organization, and aligning high-level specifications with low-level specifications. It also covers evaluating privacy risk in user experiences, how UX decisions affect what users actually do, usability testing of privacy-related functions, and value sensitive design.
Building privacy into technology policies and the development life cycle: applying the NIST privacy engineering objectives of predictability, manageability and dissociability, understanding enterprise architecture, data flow diagrams and data lineage tools (cross-border transfers included), and managing privacy risk through each phase of development. It also covers cataloging data assets, building a data inventory and a record of processing activities, running code reviews for privacy gaps, and monitoring runtime behavior.
Domains and scored-question ranges reflect the IAPP CIPT Body of Knowledge and Exam Blueprint v4.0.0, approved March 25, 2025 and effective September 1, 2025, which replaced v3.2.0. The IAPP reviews the BoK every year and announces changes at least 90 days before they reach the exam. No newer version had been published when this page was written in October 2026.
The questions candidates ask most often when researching the Certified Information Privacy Technologist certification.
The Certified Information Privacy Technologist (CIPT) is the IAPP's credential for technology professionals who build data protection into products, services and systems. The IAPP says it proves you understand how to use technical solutions to do that, and its candidate handbook describes CIPT holders as having a dual literacy in privacy and technology. Where the CIPP credentials test privacy law and the CIPM tests program management, the CIPT tests how privacy gets implemented.
Anyone who has to make privacy requirements work in technology: software and privacy engineers, architects, security engineers and analysts, IT and data professionals, product and UX leads, and technical privacy consultants. It also suits compliance and privacy staff who work closely with engineering teams and need to speak their language.
Under Body of Knowledge v4.0.0, effective September 1, 2025, the five domains are The Privacy Technologist's Role in the Context of the Organization (15 to 19 scored questions), Data Collection, Use, Dissemination and Destruction (19 to 23), Privacy Risk Management (17 to 21), Privacy by Design (7 to 9), and Privacy Engineering and Privacy Governance (9 to 11). The IAPP publishes these as scored-question ranges, not percentages.
The CIPT exam costs $550 as of October 2026, and the IAPP store shows the same price for members and non-members. You must take the exam within one year of purchase. Retakes are discounted, and so are first-time exams for people who already hold an IAPP certification. A retake can't be scheduled sooner than seven days after the prior attempt. Training Camp's 2-day CIPT boot camp includes the exam voucher and a free retake.
The CIPT exam has 90 multiple-choice questions, 75 scored and 15 unscored, over 2.5 hours. A 15-minute break is offered halfway, and once you submit the first half you can't go back to it. Some questions have more than one correct answer and some are scenario-based. Scores are scaled from 100 to 500, and 300 or above passes. It's delivered at Pearson VUE test centers or online through OnVUE.
No. The IAPP lists no experience or education requirement for the CIPT. You purchase the exam, agree to the IAPP's certification policies, and schedule it. IAPP membership isn't required to sit the exam, though the certification only becomes active once you hold a membership or pay the Certification Maintenance Fee.
The CIPT runs on a two-year term. To keep it active you earn 20 hours of continuing privacy education per credential per term and pay a $250 Certification Maintenance Fee per term, which is covered if you hold an active IAPP membership. Up to 10 surplus credits earned in the final six months of a term can carry over to the next one.
We don't claim it. The IAPP does not list a DoD 8140 mapping for the CIPT, so don't count on it to satisfy a cyber-coded position requirement. If you need an 8140 qualification, check the current DoD 8140 Approved Qualifications Matrix at cyber.mil and see the full DoD 8140 work role paths. The CIPT's recognition comes from privacy regulation and from ANAB accreditation instead.
Yes. The CIPT, along with the CIPM, CIPP/E and CIPP/US, is accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012, the international standard for bodies that certify people. The IAPP's other credentials, the AIGP among them, are not on that accredited list at the time of writing.
Both aim at technologists who implement privacy, but they get there differently. The CIPT has no experience requirement. ISACA's CDPSE asks for three years of experience in its domains before it grants the credential. The CIPT exam is 90 questions in 2.5 hours for $550. The CDPSE is 120 questions in 3.5 hours and costs $575 for ISACA members or $760 for non-members. If you want the IAPP route toward the Fellow of Information Privacy, take the CIPT. If you want a credential that verifies hands-on experience, the CDPSE does that.
The FIP is the IAPP's designation for senior privacy professionals. It requires a CIPP credential plus a CIPM, CIPT or AIGP, three years of work experience in which privacy is at least half the job, three peer references and a personal statement. An information security certification from ISC2, ISACA or IEEE can stand in for one of those three years. For a CIPT holder, adding a CIPP completes the credential half.
Yes. Body of Knowledge v4.0.0 was approved on March 25, 2025 and took effect on September 1, 2025, replacing v3.2.0. The IAPP reviews the BoK every year and announces changes at least 90 days before they reach the exam, and says roughly 10 to 15 percent of content changes in an annual update. No newer version had been published as of October 2026.
For technologists who handle personal data, yes. Laws such as the GDPR require data protection by design and by default, which puts much of the work on engineering teams, and the CIPT is the IAPP credential built for that technical side. It's ANAB accredited, has no prerequisite, and counts toward the FIP. It's a weaker fit if your work is purely legal interpretation or program management, or if you need a credential that verifies years of experience.
If you're weighing the certification, comparing IAPP credentials, or planning privacy training for an engineering team, tell us where you are and we'll help you map out the right path.