Home/Certifications/IAPP
The IAPP certification series
The privacy profession's certifications: CIPP, CIPM, CIPT and the AI governance credential AIGP. Law and regulation mapped to the current bodies of knowledge in plain English.
Choose your path
IAPP splits privacy by jurisdiction and by role: what the law says (CIPP), how to run the program (CIPM), how to build for it (CIPT), and how to govern AI (AIGP).
Law • Europe
European data protection law: the GDPR clause by clause, plus the ePrivacy rules and the enforcement landscape.
Official weights · outline 1 September 2025
Law • United States
The US private-sector privacy landscape: sectoral federal law, state statutes and the FTC's enforcement practice.
Official weights · current outline
Management
Running the privacy program: framework, governance, the data lifecycle and incident response, from the manager's seat.
Technology
Privacy engineering: building privacy into systems, from design principles to the technical controls that implement them.
Official weights · current outline
AI governance
AI governance against Body of Knowledge v2.1.0: the EU AI Act, NIST AI RMF and ISO/IEC 42001, cross-referenced.
What is included
The books differ in length and in how practice is arranged, because the exams differ. Everything else is the same in all 5.
Chapters follow the certifying body's own outline, and each area gets its own section with a scoping paragraph, the explanation and Key Takeaways.
CIPP-E 5 · CIPP-US 5 · CIPM · CIPT 5 · AIGPCallouts sit beside the concept they belong to, flagging the distinctions the exam tests and the answers that look right under time pressure.
Throughout every chapterQuestions are printed with the answer key in the same volume, written in the exam's own style and tagged to the domain they came from.
1,062 questions across 5 titlesDelivery, scoring and the published domain weights, then a domain-weighted study plan for where the remaining hours should go.
Front matter, every titleLook inside
This is page 132 of the CIPP-E guide. Every section in every IAPP title is built from the same parts. Select a marker to see what each one does.
Marker 1 · The section heading
The heading on this page is Relationship Between Fines and Compensation. Sections follow the certifying body's own outline, so the table of contents doubles as the exam blueprint, and each one is self-contained enough to study alone.
Marker 2 · The explanation
Concepts lead with the term, then say what it is and what it is for. This page continues:
A supervisory authority's fine and an individual's compensation claim are procedurally separate…Verbatim from page 132
Marker 3 · Exam Tip
Exam Tips sit beside the concept they belong to, naming the distinction the exam tests.
Exam Tip. : The two fine tiers are a clean recall item. The lower tier (EUR 10 million or 2 percent) covers obligations such as security measures, breach notification, DPIAs, DPO rules, and processor contracts. The upper tier (EUR 20 million or 4 percent) covers the most serious wrongs: violations of the basic processing principles (including consent conditions), data subject rights, and the transfer rules.Verbatim from page 132
Marker 4 · Common Pitfall
Common Pitfalls name the plausible answer that costs you the mark, placed where you first meet the idea.
Common Pitfall. : Many candidates memorize "GDPR fine: up to EUR 20 million or 4 percent" and stop there. That is the upper tier only. The GDPR has two tiers. Quoting only the higher ceiling on an exam question that asks about a lower-tier infringement, such as a failure to notify a breach within 72 hours, which is an Article 33 obligation sitting under the lower tier, gives the wrong answer.Verbatim from page 132
Marker 5 · Key Takeaways
Every section closes with Key Takeaways, the shortest version of what you have just read, built for the final-week pass.
Straight out of the book
Printed here exactly as they appear in the practice sets. Nothing has been simplified for the website.
A homeowner in Belgium installs a doorbell camera that covers not only the front door but also a public pavement and the entrance of a neighbour's house. Based on the CJEU's reasoning in Rynes (C-212/13), which conclusion BEST describes the GDPR analysis?
Correct answer: B
In Rynes, the CJEU held that a camera covering a public road and a neighbour's entrance went beyond purely household activity. The household exemption ends when the recording extends to third parties in public or semi-public spaces, even if the equipment is operated from a private home. The owner becomes a controller subject to the GDPR.
The CIPP-E guide explains every answer.
A fitness app collects location data and shares it with advertisers without clearly indicating that it does so in its privacy policy. Based on FTC enforcement history, what is the most likely basis to initiate an enforcement action?
Correct answer: D
The FTC most commonly brings actions when a company's privacy representations are misleading or incomplete. Failing to disclose sharing of location data with advertisers constitutes a deceptive trade practice under the FTC Act.
The CIPP-US guide explains every answer.
A SaaS analytics vendor goes live on a Tuesday, processing clickstream data from the company's e-commerce site, including IP addresses for EU visitors. Which action should the privacy program manager take MOST urgently before the system handles live user data?
Correct answer: B
The data inventory (ROPA under GDPR) must reflect all active processing activities. When a new SaaS system goes live, updating the ROPA is the first internal governance step, it captures the data category (IP addresses, clickstream), the lawful basis, the retention period, and the vendor as a processor. This update is required before the system processes live data, not retroactively. All downstream obligations (DPA execution, TIA if applicable, privacy-notice update) depend on the inventory accurately reflecting the new processing activity. Chapter 9 states the exam anchor: "When a new system goes live, the first artifact to update is the data inventory."
The CIPM guide explains every answer.
To help better understand their customers, a company that distributes cleaning products purchases data about consumer grocery spending habits, including those for food and health-related products. What potential privacy problems should the company consider?
Correct answer: C
Aggregating data from various sources without proper protections can increase the risk of privacy violations through unintended disclosures or re-identification.
The CIPT guide explains every answer.
The EU AI Act defines "general-purpose AI (GPAI) model" as an AI model that, irrespective of how it is made available, can serve a variety of purposes. Which of the following MOST accurately describes when a GPAI model triggers the "systemic risk" obligations?
Correct answer: B
EU AI Act Art. 51 sets the systemic-risk threshold for GPAI models at training compute exceeding 10^25 FLOPs, or where the AI Office designates the model as posing systemic risk based on other criteria (e.g., number of users, economic impact). GPAI models meeting this threshold must comply with the heightened Art. 55 obligations: adversarial testing, incident reporting to the AI Office, cybersecurity protections, and energy efficiency reporting. (BoK v2.1.0)
The AIGP guide explains every answer.
Side by side
Exam facts come from each book's own exam overview. Book facts come from the printed interior. A dash means the book does not state it.
| Comparison | CIPP-E | CIPP-US | CIPM | CIPT | AIGP |
|---|---|---|---|---|---|
| Focus | Law | Law | Management | Technology | Governance |
| Experience | None required | None required | None required | None required | None required |
| Domains | 5 | 5 | — | 5 | — |
| Questions | 90 | 90 | — | 90 | 100 |
| Time limit | 2 h 30 min | 2 h 30 min | — | 2 h 30 min | 2 h 45 min |
| Pass mark | 300 / 100 | 300 | — | 300 | 300 / 100 |
| Practice in the book | 144 by domain | 250 in 3 mocks | 210 by domain | 324 in 4 mocks | 134 by domain |
| Pages | 362 | 343 | 417 | 370 | 274 |
| Price | $20.99 | $20.99 | $20.99 | $20.99 | $20.99 |
Why Simply Certified
Simply Certified is a study guide series for working professionals who need to certify efficiently, without a two-thousand-page reference. Chapters and practice questions are both mapped to the certifying body's published exam objectives, so your practice results point directly to the domains that need more work.
Questions