Which IAPP Certification To Take First
Which IAPP certification to take first depends on the job you do now and the job you want next. The law certifications suit lawyers, data protection officers and privacy counsel. People who run a privacy programme fit the CIPM. The CIPT suits engineers and architects, and the AIGP suits anyone who governs AI systems. If you are not sure where your knowledge already sits, the free CIPP/E assessment gives you a score per domain in about fifteen minutes.
Which IAPP certification fits your role
A certification is a means to a job. So the useful version of the question is which IAPP certification the role in front of you asks for first. Our career plan starts from the job and works back to the exams. Here is how the routes run:
- Data protection officer: CIPP/E, then CIPM.
- Head of privacy: CIPP/E, then CIPM. If you already hold the CIPP/E, start with the CIPM.
- AI governance manager: CIPP/E, then AIGP. With the CIPP/E already held, start with the AIGP.
- Privacy counsel: CIPP/E, then CIPP/US. With the CIPP/E already held, start with the CIPP/US.
- Privacy engineer: CIPT, then CIPP/E.
- Privacy manager: CIPM, then CIPP/E.
Notice how often the answer to which IAPP certification comes first is the CIPP/E. Our reading: European data protection law is the base that programme work and AI governance build on.
What each certification covers
Every IAPP exam follows a Body of Knowledge, the official list of the domains and topics it tests. Reading it is the fastest way to decide which IAPP certification fits you, because it tells you exactly what you would study.
The law: CIPP/E and CIPP/US
The CIPP/E covers European data protection law: the GDPR, its principles, rights, transfers and enforcement. As for the CIPP/US, it covers the United States: federal sectoral laws, state privacy laws and the enforcement role of the FTC. Choose by the jurisdiction you work in. If you advise across the Atlantic, the career plan for privacy counsel takes both.
The programme: CIPM
The CIPM is about running privacy in an organisation: governance, assessments, policies, metrics and responding to incidents and requests. It suits managers more than lawyers. Our guide on how to prepare for the CIPM sets out the exam in full, and you can start the CIPM course once you know it fits.
The technology: CIPT
The CIPT is for people who build or secure systems: privacy engineering, de-identification, security controls and privacy by design. A privacy engineer starts here, then adds the CIPP/E for the law behind the controls. The free CIPT assessment shows how much of it you already know.
AI: the AIGP, and what is coming for lawyers
The AIGP covers AI governance: how AI systems work, the laws that apply to them and how organisations develop and deploy them responsibly. Our AIGP study guide covers the exam. For an AI governance manager the career plan puts the CIPP/E first, because the data rules apply before the AI rules do.
Legal professionals have a newer option to watch. The IAPP has announced the AISL, a certification for lawyers, paralegals and legal operations professionals who use and oversee AI in legal work. It has published a draft Body of Knowledge, and training and certification open in January 2027. Until then, our page on the AISL certification tracks what is known. If you work in legal services and want a head start, the free AISL assessment is the place to begin.
How long the first one takes
At three hours a day, about 21 hours a week next to a job, the CIPP/E takes about a month and the CIPM about three weeks. The AIGP takes about five weeks at the same pace, and the CIPP/US and CIPT about a month each. These are working figures; your own depends on what you know already.
That is why a measured start matters as much as deciding which IAPP certification comes first. 22Academy, our sister platform within Future Prep, begins every course with a free assessment that gives you a score per domain and a study-time estimate. If you are heading for a data protection officer role, our article on becoming a data protection officer explains why that route starts with the law.
Which IAPP certification to start with
Pick the role and follow its route, and you know which IAPP certification to take first. For four of the six routes above, that means the free CIPP/E assessment and the CIPP/E study guide. For an AI governance role, take the free AIGP assessment once the law is in place.
