How to pass the CIPP/E

Reviewed by Victor Humenhuk. Published 20 June 2026. Reviewed 31 August 2026.

A practical guide to the IAPP Certified Information Privacy Professional/Europe (CIPP/E) exam. It explains what the exam tests, how to study and how to review common mistakes. Reviewed against current IAPP materials and primary legal sources.

What the CIPP/E actually tests

The CIPP/E certifies that you understand European data protection law, principally the GDPR but also the wider framework around it. The exam is built from the IAPP's published body of knowledge, which covers:

• The origins and context of European data protection (the Council of Europe, the Charter, Convention 108, and the road to the GDPR).
• Core GDPR concepts: personal data, controllers and processors, the data protection principles, and the six lawful bases.
• Data subject rights and how to handle requests.
• Controller and processor obligations: records, security, breach notification, DPIAs, DPOs, and data protection by design and by default.
• International data transfers: adequacy, standard contractual clauses, binding corporate rules, and derogations.
• Supervision and enforcement: supervisory authorities, the EDPB, the consistency mechanism, and fines.
• How the rules apply in practice across employment, surveillance, direct marketing and more.

You can read every one of these topics free in the study notes.

The exam format

The CIPP/E is a multiple-choice exam of 90 questions with a 2.5 hour time limit, reported on a scaled score where 300 out of 500 is a pass. A few items are unscored pilot questions. Exact figures can change, so confirm the current format on the IAPP's IAPP Exam Blueprint before you book.

A study plan that works

The biggest lever is active recall, testing yourself, rather than re-reading. Start with IAPP's minimum 30-hour recommendation, then adapt the calendar to your prior knowledge and available weekly time.

• Weeks 1 to 2, build the map. Read the notes chapter by chapter. Do not memorise yet; aim to understand the structure and where each idea sits.
• Weeks 3 to 4, drill. Switch to questions. After each topic, answer practice questions and read every explanation, including for the ones you got right.
• Week 5, spaced review. Let the spaced-repetition schedule resurface what you are forgetting, and spend your time on weak areas, not what you already know.
• Final week, simulate. Sit the full exam-style question set under timed conditions, then review every miss.

Where people lose marks

• Confusing the lawful bases. Know when consent is needed versus legitimate interests, and the conditions for each.
• Mixing up controller and processor obligations. The exam loves scenarios that turn on who is responsible for what.
• Transfers. Be precise about adequacy decisions, SCCs, and when derogations apply.
• Timelines and thresholds. Breach notification timing, DPIA triggers and the fining tiers come up repeatedly.
• Reading too fast. Many questions hinge on a single qualifying word such as "only", "must" or "unless". Slow down on the stem.

How this site helps

The study notes are free and structured for active recall, with the exam-critical wording highlighted. When you are ready to test yourself, the practice question bank includes the exam-style question set plus hundreds of topic questions, each with a worked explanation, marked automatically and scheduled for spaced review. Your progress syncs across your devices.

Frequently asked questions

See the practice exam