How to Prepare for the CIPM
Updated on 9 October 2026, prices checked on 8 October 2026. Written by Bas Hennis.
To prepare for the CIPM, learn how a privacy programme is built, run and measured across its six domains, then practise the question types. A beginner needs about 70 hours, or about three weeks at three hours a day. On 22Academy that costs €111 including VAT on the weekly plan, or €117 for a month with a full trial exam. The IAPP’s official online training costs $1,195 ($995 for members). Want to know where you stand before you read on? The free CIPM assessment on 22Academy shows it in about 15 minutes.
I have prepared professionals for certification exams since 2018 on 22Academy, our sister platform within Future Prep. Every figure about another provider in this guide names its source and the date we checked it.
What the CIPM is
The CIPM, the Certified Information Privacy Manager, is the IAPP certification for running a privacy programme. Where the CIPP exams test the law, the CIPM tests the operation: governance, assessments, controls, metrics, requests and incidents. It suits privacy managers, programme leads and data protection officers who own the day-to-day work. That is the work the 22Academy CIPM course trains: running the programme in scenarios, question by question.
There are no prerequisites: no course, no degree and no minimum experience. You sit the exam online or at a test centre. For each certification the IAPP publishes a Body of Knowledge, listing what the exam is written from and the question range per domain. The CIPM version in force is 4.2.0, effective from 1 September 2025.
CIPM exam format and fees
The exam has 90 questions, of which 75 are scored and 15 are unscored trial items. You get 150 minutes, and the pass mark is 300 on a scale of 500.
The exam costs $550 for members and non-members alike, and you must sit it within a year of buying it. If you fail, a retake costs $375, and you can sit it at least seven days after your first attempt. So the cheapest preparation is the one that tells you beforehand whether you are ready. The free CIPM assessment is the first step. To keep the certification you earn 20 continuing education credits every two years and pay a $250 maintenance fee. IAPP membership, at $295 a year, includes that fee.
The six CIPM domains
CIPM preparation goes faster once you see the domains as a life cycle: set up, govern, assess, protect, sustain and respond. The figures count scored questions, and the 22Academy CIPM course follows the same six domains.
Developing a framework: 14 to 18 questions
CIPM study starts with scope and strategy. Where personal information comes from, the business model and risk appetite, the governance model, the privacy team and its stakeholders. The domain also covers which laws apply, what non-compliance costs and the privacy risks of AI in the business. Our article on which privacy governance model fits works through centralised, decentralised and hybrid models.
Establishing programme governance: 12 to 16 questions
For CIPM preparation, this domain means policies across the life cycle, roles and responsibilities, metrics and training. Expect questions on breach response plans, request handling, retention and the reporting structure. A metric is only useful to the audience that acts on it, which is the point of privacy metrics for the right audience.
Assessing data: 12 to 16 questions
This part of CIPM study covers data inventories and flows, gap analysis, vendors and processors, physical and technical controls and the data in mergers and acquisitions. Here the exam asks what to do first. Establishing a baseline is a frequent right answer. Practise that order on the more than 1,500 questions in the 22Academy CIPM course.
Protecting personal data: 9 to 13 questions
Preparing for the CIPM here means information security practice, data classification, access control and privacy by design in the development life cycle. It also covers secondary use of data and working with technologists on privacy-enhancing technologies.
Sustaining programme performance: 7 to 9 questions
Metrics that track the programme, audits and continuous assessment. The assessment types are a reliable source of questions: the privacy threshold analysis, the PIA, the DPIA, the transfer impact assessment and the legitimate interests assessment. Learn what triggers each, starting with the privacy threshold analysis before the DPIA.
Responding to requests and incidents: 10 to 14 questions
Data subject requests, consent withdrawals and complaints, then incident handling from assessment to remediation and the lessons afterwards. Ordering questions are common here. Containment generally comes before external notification.
How long it takes to study for the CIPM
Our estimate is about 70 hours for a beginner, or about three weeks at three hours a day next to a job. Someone already running a privacy programme may need a week. The IAPP recommends at least 30 hours of training and study per certification, as a minimum alongside a course. Your own estimate comes from the free CIPM assessment: 24 questions, about 15 minutes, with a score per domain.
Plan by weight. The framework domain has the widest range, up to 18 questions, and the request and incident domain follows with up to 14. Leave the shorter sustain domain for later in your CIPM study, but do not skip it.
How the CIPM questions are built
Studying for the CIPM is half content and half technique. The questions come in recognisable shapes: two-statement true or false, best answer, sequences, definitions and scenarios. CIPM scenarios usually ask for the first step or the right next step, so the order of a process matters as much as its content.
22Academy tags every practice question with one of twenty question structures and shows your score per structure. You then see whether a lost mark came from the programme content or from the question type.
The Exam Question Masterclass, once a separate course, is now part of every 22Academy course, so the technique for each structure is explained where you meet it. A full trial exam closes the course, timed and analysed by domain and by question structure. We build it to be harder than the real exam, on purpose.
We stand behind that standard. Suppose you pass our trial exam at your first attempt, sit the real exam within two weeks and fail it. Then you get a free trial exam or your money back for the one you paid for. You will find the conditions in the FAQ. Already booked your exam? A trial exam on its own costs €42, or €27 with a subscription.
What the IAPP gives you free
The IAPP’s CIPM certification page links the Body of Knowledge and exam blueprint, with every topic and the question range per domain. The candidate handbook explains booking and the rules on exam day. You can also request a free study guide with sample questions. Read these before paying for any CIPM preparation. Then measure yourself against the Body of Knowledge with the free CIPM assessment.
What CIPM preparation costs: four routes compared
A one-off fee and a weekly fee only become comparable once you know the number of weeks you need. So we priced four situations. A beginner needs about three weeks. An experienced programme manager needs one. A third candidate stops after a week, and a fourth is pulled away by work halfway.
How we compared
We used the prices listed on 8 October 2026. On the 22Academy pricing page, prices include VAT or sales tax where it applies. For others, the table states whether tax is mentioned. No currency is converted and no figure estimated. You can also test the 22Academy column yourself, because the free CIPM assessment and lesson 1 cost nothing.
The other three ways to prepare for the CIPM are the IAPP’s official online training, Privacy Bootcamp and a Udemy course. The Udemy course is the highest-rated one we found with at least 30 ratings that claims the current Body of Knowledge: CIPM Inf. Privacy Manager – Best 2026 Practice Question Exam by Privacy Hub, rated 4.6 from 34 ratings.
Preparation costs compared
| 22Academy | IAPP online training | Privacy Bootcamp | Udemy course | |
|---|---|---|---|---|
| Beginner, ready to sit | €111 including VAT weekly, or €117 for a month with a trial exam (about three weeks) | $1,195, $995 for members; tax not stated | $499; tax not stated | Varies by country; tax may be added |
| Experienced, one week | €37 including VAT | $1,195 | $499 | The same purchase price |
| Paid if you stop after week one | €37; the assessment and lesson 1 are free | $1,195 | $499 | The purchase price |
| Access and pausing | Weekly or monthly, cancel any time; progress kept for a year | Access period not stated; modules can be paused | Lifetime access, including updates | Lifetime access while Udemy holds the licence |
| Practice questions | More than 1,500 | Review questions, number not stated; a separate 90-question practice exam costs $55 ($45 for members) | 600+ | 246, in six tests |
| Trial exam | Full length, timed, analysed by domain and question structure | Practice exam as a PDF with answers and explanations; timing not stated | Full length, timed | Six practice tests; timing unclear |
| Flashcards | In every lesson, weighted to your hard topics, plus a repetition quiz | Not stated | 700+ | Not stated |
| Study plan | A personal route built on the assessment | Not stated | Self-paced, no plan | Not stated |
| Body of Knowledge | Version 4.2.0 | Version not named | “Latest”, number not named | “2026”, number not named |
| Analysis by question structure | Yes, twenty structures | Not stated | Not stated | Not stated |
| Confidence against accuracy | Yes | Not stated | Not stated | Not stated |
| Using your own AI assistant | Yes, prompts on the study cards | Not stated | Not stated | Not stated |
| Technique for scenario questions | Yes, skills cards | Not stated | Not stated | Not stated |
Sources: each provider’s own pages, checked on 8 October 2026. “Not stated” means the page does not say. The 22Academy CIPM course page shows what sits behind the first column.
Lifetime access and a three-week exam
Lifetime access sounds generous for an exam you prepare for in three weeks. Each year the IAPP reviews every Body of Knowledge and changes it where needed. A CIPM prep course earns its price by matching the version you sit, on the day you sit it. Years of access after the exam add nothing to the score. Start with the free assessment and lesson 1, no payment needed.
Pausing or stopping your CIPM prep
Three weeks of study leaves little room for a large upfront fee to pay off. On 22Academy the assessment (24 questions, about 15 minutes) and the first lesson cost nothing. After that the bill runs a week at a time, so stopping after one week costs €37.
Pausing your CIPM preparation costs nothing either. Cancel, and we keep your progress for a year after your last paid period. The course stays current while you are away. How it works shows each step from the assessment to the trial exam, and the CIPM course page shows what the course covers.
Join the CIPM study group
Studying alone for a certification exam is harder than it needs to be. Our CIPM study group on Facebook brings together candidates at every stage and certified professionals who share what they learned. Members post questions, discuss difficult topics and report back after their exams. Joining costs nothing. For articles and study tips, also follow Privacy Study Group on LinkedIn.
Want to measure your progress against a study partner? Each of you can take the free CIPM assessment and compare scores per domain.
After the CIPM exam
Your result and score appear on screen when you finish. If you pass, the IAPP sends your digital certificate by email through Accredible within two weeks. If you do not pass, you buy a new exam, which costs $375 as a retake, and you can sit it at least seven days after your attempt. Use that time on your weakest domains; the free CIPM assessment shows them per domain.
Where the certificate takes you depends on the job you want. The 22Academy career plan shows for each role which certifications it takes, in which order and for how long. For a privacy manager the CIPM comes first and the CIPP/E second. For a head of privacy or a data protection officer the CIPM follows the CIPP/E. Together with a CIPP, the CIPM also counts towards the IAPP’s Fellow of Information Privacy designation, which also asks for three years of privacy work.
22Academy prepares you for the CIPP/E, CIPP/US, CIPT and AIGP with the same method; see all certifications.
For teams: Future Prep
Training a whole privacy team? Future Prep, which runs Privacy Study Group and 22Academy, trains organisations on a comparable system of assessment, measurement and repetition. It adds one thing: role-play of real situations at work, so people practise the decisions they will actually face. See Future Prep’s training programme.
Questions people ask before they prepare for the CIPM
Candidates comparing routes tend to ask these four.
How long does it take to prepare for the CIPM?
About 70 hours by our estimate, or about three weeks at three hours a day. Someone already running a privacy programme may need a single week. The IAPP’s own minimum is 30 hours.
Do I need the CIPP/E or CIPP/US first?
No. The CIPM has no prerequisites. A CIPP gives you the legal background, and the CIPM then shows how to run the programme that applies it.
Is the CIPM about law?
Only as context. The exam asks which laws apply and what non-compliance costs, then moves to governance, assessments and operations. The free CIPM assessment shows how much of that you already know.
Can I pause and pick it up later?
On 22Academy, yes. Cancel at the end of any week or month and your progress waits for a year. Start free and see how far you get in the first week.
Where to start
The free CIPM assessment on 22Academy takes about 15 minutes. It shows, per domain, where you stand and how long your CIPM study will take. Then build your plan around the gaps with the 22Academy CIPM course.
