Ultimate CIPP/E Study Guide 2026

Updated on 9 October 2026, prices checked on 8 October 2026. Written by Bas Hennis.

This CIPP/E study guide covers what the exam asks, how long preparation takes and what it costs. The exam has 90 questions over five domains, and the GDPR runs through all of them. By our estimate a beginner needs about 90 hours, which is about a month at three hours a day. On 22Academy that month costs €117 including VAT, with a full trial exam included. By comparison, the IAPP’s own online training costs $1,195, or $995 for members. Want to know where you stand before you read on? The free CIPP/E assessment on 22Academy shows it in about 15 minutes.

I have prepared professionals for certification exams since 2018 on 22Academy, our sister platform within Future Prep. Every figure about another provider in this guide names its source and the date we checked it. Privacy Study Group is not affiliated with or endorsed by the IAPP.

What Is the CIPP/E?

The CIPP/E, the Certified Information Privacy Professional/Europe, is the IAPP certification for European data protection law. It tests whether you can apply the GDPR and related rules to real situations. Knowing the article numbers is only the start. That is exactly what the 22Academy CIPP/E course trains: applying the law to scenarios, question by question.

The ANSI National Accreditation Board has accredited the CIPP/E under ISO/IEC 17024, the international standard for bodies that certify people. The GDPR itself requires no certificate for a data protection officer. Instead, Article 37(5) asks for professional qualities and expert knowledge of data protection law and practice, and the CIPP/E is one way to show that knowledge. Our career plan for data protection officers sets out the route, from the CIPP/E to the CIPM.

There are no prerequisites: no course, no degree and no minimum experience. You can sit the exam in English, French or German through Pearson VUE, either online or at a test centre. Your result and score appear on screen as soon as you finish.

CIPP/E Exam Format and Fees

The exam has 90 multiple-choice questions, of which 75 are scored. The other 15 are unscored trial questions for future exams. Because you cannot tell which they are, treat every question as if it counts. You get 150 minutes, and the pass mark is 300 on a scale up to 500.

Halfway through there is an optional 15-minute break. Whether you take it or not, you submit the first half at that point and cannot return to it. Therefore, finish your flagged questions before you reach the halfway mark. You can rehearse that timing in the full-length, timed trial exam of the 22Academy CIPP/E course.

What the CIPP/E Costs

The exam costs $550 for members and non-members alike, and you must sit it within a year of buying it. In addition, IAPP membership costs $295 a year and covers the $250 certification maintenance fee you would otherwise pay every two years. If you fail, you buy a new exam, which costs $375 as a retake, and can sit it at least seven days after your first attempt. So the cheapest preparation is the one that tells you before the exam whether you are ready. The free CIPP/E assessment is the first step.

How we compared preparation costs

Preparation is the variable cost, and a price only means something next to the time it buys. So we compared four situations: a beginner who needs about a month, a professional who applies the GDPR daily and needs a week, someone who stops after a week and someone whose job takes over halfway through.

Every price is the one listed on 8 October 2026. On the 22Academy pricing page, prices include VAT or sales tax where it applies. However, where another provider says nothing about tax, the table says so. We did not convert currencies or estimate anything. You can also test the 22Academy column yourself, because the free CIPP/E assessment and lesson 1 cost nothing. Besides 22Academy we compared the IAPP’s official online training, Privacy Bootcamp and the highest-rated Udemy course we found with at least 30 ratings that claims the current Body of Knowledge: CIPPE Practice Exam Questions 2026 by Privacy Hub, rated 4.0 from 36 ratings.

Preparation costs compared

	22Academy	IAPP online training	Privacy Bootcamp	Udemy course
Beginner, ready to sit	€117 including VAT, trial exam included (about a month)	$1,195, $995 for members; tax not stated	$499; tax not stated	Varies by country; tax may be added
Experienced, one week	€37 including VAT	$1,195	$499	The same purchase price
Paid if you stop after week one	€37; the assessment and lesson 1 are free	$1,195	$499	The purchase price
Access and pausing	Weekly or monthly, cancel any time; progress kept for a year	Access period not stated; modules can be paused	Lifetime access, including updates	Lifetime access while Udemy holds the licence
Practice questions	More than 2,000	Review questions, number not stated; a separate 90-question practice exam costs $55 ($45 for members)	650+	160, in four tests of 40
Trial exam	Full length, timed, analysed by domain and question structure	Practice exam as a PDF with answers and explanations; timing not stated	Full length, timed	Four 40-question tests; timing not stated
Flashcards	In every lesson, weighted to the topics you find hard, plus a repetition quiz	Not stated	850+	Not stated
Study plan	A personal route built on the assessment	Not stated	Self-paced, no plan	Not stated
Body of Knowledge	Version 1.3.3	Version not named	“Latest version”, number not named	“2026”, number not named
Analysis by question structure	Yes, twenty structures	Not stated	Not stated	Not stated
Confidence against accuracy	Yes	Not stated	Not stated	Not stated
Using your own AI assistant	Yes, prompts on the study cards	Not stated	Not stated	Not stated
Technique for scenario questions	Yes, skills cards	Not stated	Not stated	Not stated

Sources: each provider’s own pages, checked on 8 October 2026. “Not stated” means the page does not say. The 22Academy CIPP/E course page shows what sits behind the first column.

The CIPP/E Body of Knowledge

The IAPP publishes a Body of Knowledge for every certification: the list of competencies the exam is written from, with a minimum and maximum number of questions per domain. In other words, it is the exam’s table of contents. Read the verbs as well as the topics. For example, “know” asks you to recognise something, while “understand” asks you to apply it to a situation.

The current CIPP/E version is 1.3.3, effective from 1 September 2025, replacing version 1.3.2. You can download it free from the IAPP’s CIPP/E page in English, French and German.

Domain	What it covers	Scored questions
I. Introduction to European data protection	Historical context, the institutions and the legislative framework	7 to 13
II. European data protection law and regulation	Core GDPR concepts, security of personal data and data subjects’ rights	18 to 28
III. European data processing	Processing principles, lawful bases, transparency and international transfers	13 to 21
IV. Scope and accountability	Territorial and material scope, accountability, supervision and enforcement	8 to 18
V. Compliance	Employment, surveillance, direct marketing and internet technology, including AI	8 to 16

What each domain asks

Introduction. Where the rules come from: Convention 108 and its update, the OECD Guidelines, the Treaty of Lisbon and the institutions. The legislative framework now names the NIS and NIS 2 Directives and the EU AI Act next to the GDPR and the ePrivacy Directive.

Law and regulation. The largest domain. It covers personal data, special categories, pseudonymous and anonymous data, controllers and processors, security, breach notification, vendor management and every data subject right with its conditions and limits.

Data processing. How processing becomes lawful: the principles, the lawful bases, transparency and privacy notices. International transfers also sit here, from adequacy to transfer impact assessments.

Scope and accountability. Who the GDPR reaches and how compliance is shown and enforced, from DPIAs and the DPO to the lead supervisory authority, fines and compensation.

Compliance. The GDPR in daily practice: the workplace, surveillance, marketing, cookies, social media and artificial intelligence.

The 22Academy CIPP/E course follows version 1.3.3, and the free assessment gives you a score for each of these five domains before you start.

How Long Should You Study?

Our estimate is about 90 hours for a beginner, or about a month at three hours a day next to a job. If you already apply the GDPR at work, a week can be enough, because much of domain II will be revision. The IAPP recommends at least 30 hours of training and study per certification, as a minimum alongside a course.

Spread your hours by weight. Domain II alone can carry up to 28 of the 75 scored questions, so it deserves the largest share. Our method for planning study time by domain weight turns the ranges into a schedule.

Find your starting point before you plan. The free CIPP/E assessment on 22Academy takes 24 questions and about 15 minutes. Afterwards you have a score per domain and an estimate of your study time.

Schedule the Exam Early

Book your exam date before you feel ready. A fixed date concentrates the effort; without one, preparation expands to fill whatever time you give it. To pick a realistic date, use the study-time estimate from the free CIPP/E assessment.

The rules keep the risk low. You can reschedule or cancel a test-centre appointment up to 48 hours before it, and an online appointment up to 15 minutes after its scheduled start, as long as you stay within the year after purchase. The candidate handbook names no fee for rescheduling.

What to Study: a Practical CIPP/E Study Guide Framework

Start with the BoK

Work through the Body of Knowledge domain by domain. For each performance indicator, ask two questions: could I explain this to a colleague, and could I apply it in a scenario? Where the answer is no, that is where your hours go.

Spending equal time on everything is the classic mistake. Instead, weight your plan towards your weakest areas and towards the domains with the highest question counts. On 22Academy that weighting is built in: the assessment scores you per domain, and the course spends your time where you lose marks.

Master the Core GDPR Concepts

A few topics run through several domains and form the backbone of the exam. First, the lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task and legitimate interests. Scenario questions test consent and legitimate interests in particular. Second, the roles. Know the difference between controllers, joint controllers and processors, and read the EDPB guidelines on the subject. Our article on answering for the right role shows how the exam builds traps on that point.

Next come the data subject rights in Articles 15 to 22. Know each right with its conditions and its exceptions, including restriction, objection, portability and the rights around automated decisions and profiling.

Finally, international transfers in Chapter V. Learn adequacy, standard contractual clauses, binding corporate rules, codes of conduct, certifications and derogations. Add the Schrems judgments, the EU-US Data Privacy Framework and transfer impact assessments. Candidates often reach for a derogation too early, so read when Article 49 derogations apply. Then test all four topics against the more than 2,000 practice questions in the 22Academy CIPP/E course.

Read the GDPR

There is no substitute for the text itself. The GDPR is dense but not endless, and the exam tests whether you understand its provisions in context. You will find the official text on EUR-Lex, with the recitals that explain each article.

If English is not your first language, also read the GDPR in your own language on EUR-Lex. The concepts are the same, but sentence structures differ, and comparing the two versions often makes the meaning clear. Reading, however, does not show whether you can apply an article. Testing does, so check yourself with the free CIPP/E assessment.

Know the EDPB Guidelines

Alongside the law, the European Data Protection Board publishes guidelines, opinions and recommendations that interpret the GDPR. The Body of Knowledge refers to them throughout. Topics include controllers and processors, breach notification, the right of access, the right to be forgotten, lawful bases, transfers, derogations and codes of conduct. It also covers territorial scope, the lead supervisory authority, video surveillance and biometrics, targeting and dark patterns on social media.

Reading every guideline in full is a large commitment. For the exam, however, understanding the principle and the practical consequence of each guideline matters more than memorising paragraphs. The EDPB publishes them all on its website. Afterwards, check whether you can use them under exam conditions in the 22Academy CIPP/E course, where the flashcards in every lesson repeat the points you find hard.

Understand the EU Institutional Framework

Domain I tests the institutions and how they relate to data protection law: the European Commission, the European Parliament, the European Council, the Court of Justice of the European Union, the Council of Europe and the European Court of Human Rights. The Council of Europe, the Council of the EU and the European Council are three different bodies. Since the exam offers each as the plausible wrong answer for the others, learn what separates them. The free CIPP/E assessment shows your score on domain I next to the other four.

Books Worth Reading

The IAPP Official Textbook

The official textbook is European Data Protection, third edition, with Eduardo Ustaran as executive editor, published by the IAPP in 2023. It is available on the IAPP store in print ($95, or $85 for members) and as an ePub ($75, or $65 for members), in English. For self-study it is close to essential, and as a reference it is useful on any route.

One thing to watch: the textbook dates from 2023, while the current Body of Knowledge took effect in September 2025. Where the two differ, the Body of Knowledge decides. So use the Body of Knowledge as your curriculum and the textbook as your companion, not the other way round. A book teaches, but it does not test. Pair it with the practice questions and trial exam in the 22Academy CIPP/E course.

GDPR in charts

Case Law and Practical Application

The CIPP/E tests how the GDPR is applied, so judgments of the Court of Justice of the European Union matter. The Body of Knowledge names the Schrems decisions explicitly, in the context of Safe Harbor and Privacy Shield. Schrems I (2015) brought down Safe Harbor, and Schrems II (2020) brought down Privacy Shield, which is why transfer impact assessments now appear in the exam.

Other judgments explain whole topics in one case. Google Spain (2014) is the origin of the right to be forgotten. Planet49 (2019) settled that a pre-ticked box is not valid consent for cookies. When you study a right or an obligation, therefore, ask which judgment shaped it. Scenario questions are often built on the facts of a real case. The skills cards in the 22Academy CIPP/E course teach you how to read such a scenario and find the facts that decide it.

Training Courses

The cost table above puts four routes side by side. Here is what the two in-depth options actually do. Whichever you choose, check two things: that it follows Body of Knowledge 1.3.3, and that it tests you rather than only teaching you.

IAPP Official Training

The IAPP’s self-paced online training costs $1,195, or $995 for members. It is presented as the equivalent of a 13-hour live training, in modules with video, text and review questions, and it carries 13 CPE credits. You can stop and resume modules as it suits you, although the store does not state an access period. No exam voucher is included, and the practice exam is a separate purchase.

If you learn best from a structured course that presents the material in order, it does that job, from the organisation that writes the exam.

22Academy CIPP/E Course

22Academy starts the other way round: it measures what you know before it teaches you anything. The free assessment maps your gaps per domain, and the course then spends your time where it makes a difference.

It holds more than 2,000 practice questions, each tagged with one of twenty question structures. Every answer records how sure you were as well as whether you were right, and what you got wrong while confident comes back first. Each lesson has flashcards weighted to the topics you find hard, plus a repetition quiz built from them. In addition, study cards give you prompts for your own AI assistant, and skills cards teach you how to approach scenario questions. A full trial exam closes the course.

It costs €37 a week or €117 a month with a trial exam included, and you can cancel any time. If you pause, we keep your progress for a year after your last paid period, while the course stays current. How it works shows the route from assessment to trial exam, and the CIPP/E course page shows what the course covers.

Why weekly rather than lifetime access? You need the certificate once, usually within a few months of starting. What decides your result is whether the course matches the Body of Knowledge you sit, on the day you sit it. Access in 2030 does not help with an exam in 2026. Of the providers in our table, 22Academy is also the only one that states an analysis by question structure, a confidence measure or guidance on your own AI assistant. Start with the free assessment and lesson 1, no payment needed.

Exam Technique Inside Every Course

Knowing the GDPR and answering CIPP/E questions are two separate skills. For that reason the Exam Question Masterclass, once a separate course, is now part of every 22Academy course.

CIPP/E questions come in recognisable shapes: two-statement true or false, best answer, definitions, sequences and scenarios. Each shape has its own trap. A scenario hides one or two facts that decide the answer, often a role or a deadline. A best-answer question offers several lawful options and asks for the one that fits first. On 22Academy the technique for each structure is explained where you meet it, and your results show whether a lost mark came from the law or from the question type. See the CIPP/E course for the full method.

CIPP/E Training for Teams

Preparing a whole team rather than yourself? Future Prep, which runs both Privacy Study Group and 22Academy, trains organisations on a comparable system of assessment, measurement and repetition. It adds one thing: role-play of real situations at work, so people practise the decisions they will actually face. Future Prep’s training programme includes CIPP/E exam preparation next to its courses on data protection and AI.

Practice Exams: the Core of Your CIPP/E Study Guide

Practice exams are where preparation becomes real. Reading builds knowledge; testing shows whether you can use it under time pressure.

Start early, and do not save practice tests for the final week. Use the first ones to find your weak domains, study those, then test again. That loop beats reading cover to cover. Your first test can be the free CIPP/E assessment: 24 questions, about 15 minutes, with a score per domain.

Trial Exam

The 22Academy trial exam is full length and timed. Afterwards its report analyses your result by domain and by question structure, so you see both what to review and which question types cost you marks. We build it to be harder than the real exam, on purpose. One trial exam is included in the monthly plan. Our advice: do not book the real exam until the trial exam says you are ready.

We stand behind that standard. Pass our trial exam at your first attempt, sit the real exam within two weeks and fail it, and you get a free trial exam or your money back for the one you paid for. The conditions are in the FAQ. Already booked your exam? The trial exam also costs €42 on its own, or €27 with a subscription; see pricing.

IAPP Practice Exam

The IAPP sells a CIPP/E practice exam of 90 questions with answers and explanations, as a PDF, for $55 or $45 for members. According to the IAPP, the questions are similar in format and content to the exam, and some are retired exam questions. Take it under a timer you set yourself about two weeks before your exam. Then study the explanations for the wrong options as closely as for the right one. For more practice than 90 questions, the 22Academy CIPP/E course holds more than 2,000.

A Warning About Exam Dumps

You will find sites selling “real CIPP/E exam questions”. These are exam dumps: stolen content, often inaccurate and out of date. The candidate handbook allows the IAPP to invalidate results, ban candidates from future exams and revoke existing certifications for misconduct of this kind.

They also do not work. A dump trains you to recognise specific questions, whereas the exam rewards applied understanding of situations you have not seen before. In a profession built on data protection and compliance, start as you mean to go on. The honest alternative is practice written to the Body of Knowledge, such as the 22Academy CIPP/E course.

Join a Study Group

Studying alone for a certification exam is harder than it needs to be. Our CIPP/E study group on Facebook brings together candidates at every stage and certified professionals who share what they learned. Members post questions, discuss difficult GDPR interpretations and report back after their exams. Joining costs nothing. For articles and study tips, also follow Privacy Study Group on LinkedIn.

If you can find two or three people on a similar timeline, form a small group inside the larger one. A study partner who keeps asking “but what about legitimate interests here?” moves you from recognising an answer to understanding it. Want to measure that progress? Each of you can take the free CIPP/E assessment and compare scores per domain.

Taking the CIPP/E Exam

Remote Proctoring vs. Test Centre

You can sit the exam online through Pearson VUE’s OnVUE platform or in person at a Pearson VUE test centre. Neither is better in principle; they carry different risks.

Online is convenient but adds variables. Members of our study groups have reported trouble scrolling, webcams failing despite a passed system check, long waits for the proctor and small text on screen. The room rules are strict: a clear desk, no second monitor and nobody else in the room.

If you choose online, do a full dry run the day before. First, charge your mouse and keyboard and learn how to enlarge text on screen. Then disconnect docking stations and extra monitors, because the proctor may ask you to show they are gone. A test centre, by contrast, removes the technology risk and adds travel. Either way, sit the timed trial exam in the 22Academy CIPP/E course at the same hour as your appointment, so exam day holds fewer surprises.

Exam Day Strategy

Read the question before the scenario. Scenarios carry detail that does not matter, and knowing what you are looking for saves time. Our three-pass method for scenario questions works this through step by step.

Eliminate first, then choose. Removing the options you know are wrong is faster and more reliable than hunting for the right one.

Do not dwell. Flag a question that is taking too long and move on, but clear your flags before the halfway submission. Budget about 90 seconds a question and you keep time in hand; our article on exam pacing gives a full routine.

Watch the qualifier words. “Most likely”, “best”, “first” and “except” change what the question asks, and misreading one costs a mark you knew. Change an answer only when you can name the reason. For the last seven days, see our final-week routine. The trial exam report in the 22Academy CIPP/E course shows which of these habits still cost you marks.

After the CIPP/E Exam

Your result and score appear on screen when you finish. If you pass, the IAPP sends your digital certificate by email through Accredible within two weeks. Your certification is in good standing once you hold IAPP membership or have paid the certification maintenance fee; you can arrange either before or after the exam.

If you do not pass, you are not the first. You buy a new exam, which costs $375 as a retake, and can sit it at least seven days after your attempt. Meanwhile, use the time on your weakest domains. The free CIPP/E assessment shows them per domain, and the 22Academy trial exam report also shows them per question structure.

Maintaining Your Certification

Your certification runs for two years from the date you passed. To keep it, you report 20 continuing privacy education credits per two-year term and keep the maintenance fee covered: $250 per term for non-members, included in IAPP membership. You do not sit the exam again.

Credits come from training, conferences, webinars and other activities that qualify under the IAPP’s CPE policy.

What Comes Next?

A CIPP/E is the first half of the IAPP’s Fellow of Information Privacy designation. To become a FIP you add a CIPM, CIPT or AIGP. You also need three years of documented work in which privacy is at least half of your role, three peer references and an approved application.

Where the certificate takes you depends on the job you want. The 22Academy career plan shows for each role which certifications it takes, in which order and for how long. Two roles start with the CIPP/E. For a data protection officer the CIPM comes next; for privacy counsel it is the CIPP/US.

If AI governance is where your work is heading, the AIGP is the natural next step. Our AIGP study guide covers it in the same way. 22Academy prepares you for the CIPM, CIPT and AIGP with the same method; see all certifications.

Where to Start

Download the CIPP/E Body of Knowledge from the IAPP. Then take the free CIPP/E assessment on 22Academy to see where you stand per domain and how long you need. Build your plan around the gaps with the 22Academy CIPP/E course, and come back to this guide as your preparation develops.

Good luck. When you are done, share your experience in the study group; the candidates after you will gain from it, as you gained from those before you.