How to study for the CIPT
Updated on 9 October 2026, prices checked on 8 October 2026. Written by Bas Hennis.
To study for the CIPT, start from the Body of Knowledge, learn the engineering frameworks it names and practise how the exam turns them into questions. A beginner needs about a month at three hours a day by our working estimate. On 22Academy that month costs €117 including VAT, with a full trial exam. The IAPP’s official online training costs $1,195 ($995 for members). Want to know where you stand before you read on? The free CIPT assessment on 22Academy shows it in about 15 minutes.
I have prepared professionals for certification exams since 2018 on 22Academy, our sister platform within Future Prep. Every figure about another provider in this guide names its source and the date we checked it.
What the CIPT is
The CIPT, the Certified Information Privacy Technologist, is the IAPP certification for privacy in technology. It tests privacy as it is built into systems: data flows, privacy by design, privacy-enhancing technologies, tracking and the threats to personal data. It suits engineers, architects, security specialists and product people, as well as the privacy professionals who work alongside them. That is the work the 22Academy CIPT course trains: applying the frameworks to systems, question by question.
There are no prerequisites: no course, no degree and no minimum experience. You sit the exam online or at a test centre. For each certification the IAPP publishes a Body of Knowledge, which lists what the exam is written from and the question range per domain. The CIPT version in force is 4.0.0, effective from 1 September 2025.
CIPT exam format and fees
The exam has 90 questions: 75 scored and 15 unscored trial items. You get 150 minutes, and the pass mark is 300 on a scale of 500.
The exam costs $550 for members and non-members alike, and you must sit it within a year of buying it. If you fail, a retake costs $375, and you can sit it at least seven days after your first attempt. So the cheapest preparation is the one that tells you beforehand whether you are ready. The free CIPT assessment is the first step. To keep the certification you earn 20 continuing education credits every two years and pay a $250 maintenance fee. IAPP membership, at $295 a year, includes that fee.
The five CIPT domains
CIPT preparation follows five domains. The figures count scored questions per domain, and the 22Academy CIPT course follows the same five.
The technologist’s role in the organisation: 15 to 19 questions
CIPT study opens with roles and responsibilities in the privacy function. It covers turning legal requirements into technical controls, plus technical support for audits and incidents. The domain also names the risk models you must recognise: contextual integrity, Calo’s harms, FAIR, the FIPPs and OECD principles, LINDDUN and MITRE PANOPTIC. Data ethics and bias in automated decisions complete it. Our explainer on what LINDDUN threat modelling actually does covers one of the frameworks the exam names.
Data collection, use, dissemination and destruction: 19 to 23 questions
The largest domain in CIPT study. It follows data through its life: consent mechanisms and notices, automatic collection, scraping, retention and destruction. Minimisation, segregation, anonymisation, pseudonymisation and differential privacy follow. Dissemination closes it, with access control and authentication as defence in depth. The exam likes the difference between pseudonymised and anonymised data, so be exact.
Privacy risk management: 17 to 21 questions
Preparing for the CIPT here means intrusion and decisional interference, dark patterns and software security. Then tracking and surveillance: cookies and web tracking, location, biometrics, audio and video, wearables and the Internet of Things. Workplace technologies and AI follow, and the domain ends with audits, metrics and impact assessments. Practise all of it on the more than 1,500 questions in the 22Academy CIPT course.
Privacy-enhancing strategies, techniques and technologies: 7 to 9 questions
Privacy by design in practice: the seven principles, privacy goals and turning high-level specifications into low-level ones. UX and value sensitive design appear here too. Read privacy by design without trade-offs before the exam offers you the zero-sum option.
Privacy by design: 9 to 11 questions
Privacy engineering and governance: the NIST privacy engineering objectives, enterprise architecture with data flow diagrams and risk in the development life cycle. Data inventories, records of processing, code review and runtime monitoring complete it. The three objectives get a full treatment in the three privacy engineering objectives.
How long it takes to study for the CIPT
Our working estimate is about a month at three hours a day for a beginner. Someone who already designs privacy controls may need a week. The IAPP recommends at least 30 hours of training and study per certification, as a minimum alongside a course. Your own estimate comes from the free CIPT assessment: 24 questions, about 15 minutes, with a score per domain.
Plan by weight. The collection and risk management domains together can carry up to 44 of the 75 scored questions. Give them the bulk of your CIPT prep time, and keep the two privacy by design domains for when the vocabulary is in place.
How the CIPT questions are built
In CIPT study, knowing a technique and answering a question about it are two separate skills. Questions come in recognisable shapes: two-statement true or false, best answer, definitions, sequences and scenarios. Definition questions suit this exam, because the frameworks have precise terms. Scenarios usually describe a system and ask which control, objective or threat category fits.
22Academy tags every practice question with one of twenty question structures and shows your score per structure. You then see whether a lost mark came from the technology or from the question type.
The Exam Question Masterclass, once a separate course, is now part of every 22Academy course, so the technique for each structure is explained where you meet it. A full trial exam closes the course, timed and analysed by domain and by question structure. We build it to be harder than the real exam, on purpose.
We stand behind that standard. Suppose you pass our trial exam at your first attempt, sit the real exam within two weeks and fail it. Then you get a free trial exam or your money back for the one you paid for. You will find the conditions in the FAQ. Already booked your exam? A trial exam on its own costs €42, or €27 with a subscription.
What the IAPP gives you free
The IAPP’s CIPT certification page links the Body of Knowledge and exam blueprint, with every topic and the question range per domain. The candidate handbook explains booking and the rules on exam day. You can also request a free study guide with sample questions. Any CIPT preparation should start with those three. Then measure yourself against the Body of Knowledge with the free CIPT assessment.
What CIPT preparation costs: four routes compared
How long the material takes you decides what you pay on any route that charges by time. So we priced four candidates. Our beginner needs about a month. An engineer who already builds privacy controls needs a week. Someone else stops after one week, and one more candidate is pulled away by a release deadline halfway through.
How we compared
All prices are as listed on 8 October 2026. The prices on the 22Academy pricing page include VAT or sales tax where it applies. Where another provider says nothing about tax, the table says so. No currency is converted and nothing is estimated. You can also test the 22Academy column yourself, because the free CIPT assessment and lesson 1 cost nothing.
Three other ways to prepare for the CIPT made the table: the IAPP’s official online training, Privacy Bootcamp and a Udemy course. The Udemy course is the highest-rated one we found with at least 30 ratings that claims the current curriculum. It is CIPT Certification Exam Prep Course 2025 by Fortivance Academy, rated 4.2 from 31 ratings.
Preparation costs compared
| 22Academy | IAPP online training | Privacy Bootcamp | Udemy course | |
|---|---|---|---|---|
| Beginner, ready to sit | €117 including VAT, trial exam included (about a month) | $1,195, $995 for members; tax not stated | $499; tax not stated | Varies by country; tax may be added |
| Experienced, one week | €37 including VAT | $1,195 | $499 | The same purchase price |
| Paid if you stop after week one | €37; the assessment and lesson 1 are free | $1,195 | $499 | The purchase price |
| Access and pausing | Weekly or monthly, cancel any time; progress kept for a year | Access period not stated; modules can be paused | Lifetime access, including updates | Lifetime access while Udemy holds the licence |
| Practice questions | More than 1,500 | Review questions, number not stated; a separate 90-question practice exam costs $55 ($45 for members) | 450+ | Not stated |
| Trial exam | Full length, timed, analysed by domain and question structure | Practice exam as a PDF with answers and explanations; timing not stated | Full length, timed | Not stated |
| Flashcards | In every lesson, weighted to the topics you find hard, plus a repetition quiz | Not stated | 800+ | Not stated |
| Study plan | A personal route built on the assessment | Not stated | Self-paced, no plan | Not stated |
| Body of Knowledge | Version 4.0.0 | Version not named | “Latest”, number not named | Aligned with exams from 1 September 2025 |
| Analysis by question structure | Yes, twenty structures | Not stated | Not stated | Not stated |
| Confidence against accuracy | Yes | Not stated | Not stated | Not stated |
| Using your own AI assistant | Yes, prompts on the study cards | Not stated | Not stated | Not stated |
| Technique for scenario questions | Yes, skills cards | Not stated | Not stated | Not stated |
Sources: each provider’s own pages, checked on 8 October 2026. “Not stated” means the page does not say. The 22Academy CIPT course page shows what sits behind the first column.
Lifetime access and an exam you sit once
You sit the CIPT once. The IAPP reviews each Body of Knowledge every year, revising it where needed. CIPT prep is worth what it matches when you sit the exam. Access that outlives your certificate by a decade does nothing for your score. Start with the free assessment and lesson 1, no payment needed.
If CIPT prep stops or stalls
The cost of changing your mind is where CIPT prep routes part. On 22Academy the assessment (24 questions, about 15 minutes) and the first lesson are free. After that you pay by the week, so walking away after one week costs €37. A one-off course takes its full fee up front.
A stall in your CIPT preparation costs nothing extra either. Cancel, and we keep your progress for a year after your last paid period, while we keep the course current. How it works walks through it from the assessment to the trial exam, and the CIPT course page shows what the course covers.
Join the CIPT study group
Studying alone for a certification exam is harder than it needs to be. Our CIPT study group on Facebook brings together candidates at every stage and certified professionals who share what they learned. Members post questions, discuss difficult topics and report back after their exams. Joining costs nothing. For articles and study tips, also follow Privacy Study Group on LinkedIn.
Want to measure your progress against a study partner? Each of you can take the free CIPT assessment and compare scores per domain.
After the CIPT exam
Your result and score appear on screen when you finish. If you pass, the IAPP sends your digital certificate by email through Accredible within two weeks. If you do not pass, you buy a new exam, which costs $375 as a retake, and you can sit it at least seven days after your attempt. Use that time on your weakest domains; the free CIPT assessment shows them per domain.
Where the certificate takes you depends on the job you want. The 22Academy career plan shows for each role which certifications it takes, in which order and for how long. For a privacy engineer the CIPT comes first and the CIPP/E second. Together with a CIPP, the CIPT also counts towards the IAPP’s Fellow of Information Privacy designation, which also asks for three years of privacy work.
22Academy prepares you for the CIPP/E, CIPM, CIPP/US and AIGP with the same method; see all certifications.
For teams: Future Prep
Training engineers and architects together? Future Prep, which runs Privacy Study Group and 22Academy, trains organisations on a comparable system of assessment, measurement and repetition. It adds one thing: role-play of real situations at work, so people practise the decisions they will actually face. See Future Prep’s training programme.
Questions people ask before they study for the CIPT
These four come up when candidates plan their route.
How long does it take to prepare for the CIPT?
About a month at three hours a day by our working estimate. Someone who already builds privacy controls may need a week. The IAPP’s own minimum is 30 hours of training and study.
Do I need a technical background for the CIPT?
The CIPT has no prerequisites. Its topics, such as privacy by design and privacy-enhancing technologies, can be learned without an engineering degree. To see where you start, take the free CIPT assessment.
Which certification goes well with the CIPT?
The CIPT covers the technology. The CIPP exams cover the law and the CIPM the programme, so a CIPP is a natural partner for a technologist who also advises on compliance.
Can I pause and pick it up later?
On 22Academy, yes. Cancel at the end of any week or month and your progress waits for a year. Start free and see how far you get in the first week.
Where to start
The free CIPT assessment on 22Academy takes about 15 minutes. It shows your score per domain and how long your CIPT study will take, before you pay anything. Then build your plan around the gaps with the 22Academy CIPT course.
