TL;DR: Take CIPP/E if your work touches personal data of people in Europe, or if your employer is built around GDPR. Take CIPP/US if your work is mostly about American law: FTC enforcement, sector rules such as HIPAA and GLBA, state privacy statutes and breach notification. Both exams use the same format (90 questions, 2.5 hours, US 550 exam fee), both sit on the same IAPP scoring scale and both need the same recertification effort, so the decision is about geography and job content, not difficulty. If you work across both regions, start with the one your current role uses every day, because you will learn faster and retain more when the material matches your work.
People often ask which is “harder” or “worth more”. That is the wrong frame. These are two different legal systems, and the exams reward very different kinds of study. This guide walks through what each one covers, how they are examined, what they cost, how to choose, and how to study for whichever you pick.
Quick Facts
| Item | CIPP/E | CIPP/US |
| Awarding body | IAPP | IAPP |
| Full name | Certified Information Privacy Professional / Europe | Certified Information Privacy Professional / United States |
| Legal focus | GDPR, European institutions, transfers, workplace and marketing rules in Europe | US federal and state privacy law, sector rules, enforcement, government access, workplace |
| Questions | 90 multiple choice (75 scored, 15 unscored per the IAPP handbook) | 90 multiple choice (75 scored, 15 unscored) |
| Time | 2.5 hours including a 15-minute break | 2.5 hours including a 15-minute break |
| Exam fee | US$550 (members and non-members) | US$550 (members and non-members) |
| Languages | English, German, French | English |
| Delivery | Pearson VUE test center or online proctored | Pearson VUE test center or online proctored |
| Time to sit the exam | Within one year of purchase | Within one year of purchase |
| Passing score | 300 on a 100 to 500 scale | 300 on a 100 to 500 scale |
| Prerequisites | None | None |
| Content refresh | Current study guide dated September 2025 | Additional content for exams on or after September 1, 2025 |
| Recertification | 20 CPE hours per two-year term plus a maintenance fee | 20 CPE hours per two-year term plus a maintenance fee |
One caution before you book: the IAPP store pages confirm the format, price, languages and delivery, and the study guides confirm the body of knowledge. The scoring scale, unscored-question counts, CPE rule and retake waiting period come from IAPP’s candidate handbook, which can lag behind the live policy. Confirm those items on the IAPP site before you book.
What Each Certification Is Really About
CIPP/E: one big regulation and the system around it
The Europe exam is built around the General Data Protection Regulation. That sounds narrow, but GDPR is dense, and it sits in a wider structure: the EU institutions that create law, the member state regulators that enforce it, the courts that interpret it, and the sector rules (employment, surveillance, direct marketing, online tracking) that apply it to real activity.
If you have worked on a data protection impact assessment, a records of processing activities, a data subject access request or a transfer risk assessment, you have already met the main themes of this exam. If you have not, expect the learning curve to be steep in the first few weeks, because the vocabulary (controller, processor, lawful basis, legitimate interests, adequacy, binding corporate rules) has precise legal meaning.
CIPP/US: many laws, no single code
The US exam covers a patchwork. There is no single federal privacy statute. Instead, you study a framework that includes the Federal Trade Commission’s consumer protection authority, healthcare privacy, financial privacy, education privacy, telecommunications and marketing rules, government and court access to private-sector information, workplace privacy and the growing body of state privacy and breach notification laws.
The challenge here is breadth and memory. Many candidates say it feels less like learning a system and more like learning a long list of statutes, each with its own scope, exceptions and enforcement route. Good organization (a table per law: who is covered, what is regulated, who enforces, what are the penalties) matters more than deep legal reasoning.
Body of Knowledge Compared
CIPP/E domains
| Domain | What it covers |
| I. Introduction to European Data Protection | Origins and history of European data protection law, roles of the EU institutions, the legislative framework |
| II. European Data Protection Law and Regulation | Core GDPR concepts, security requirements, data subject rights |
| III. European Data Processing | Processing principles, lawful bases, information obligations, international transfers and their risks |
| IV. Scope and Accountability | Territorial and material scope, accountability duties, supervision and enforcement, consequences of violations |
| V. Compliance | Employment relationships, surveillance, direct marketing, internet technology and communications |
CIPP/US domains
| Domain | What it covers |
| I. The U.S. Privacy Environment | The legal framework, enforcement framework, principles of information management from a US view |
| II. Federal Privacy Laws | FTC authority, healthcare, financial, education, telecommunications and marketing |
| III. Government and Court Access | Law enforcement, national security, civil litigation |
| IV. Workplace Privacy | Privacy before, during and after employment |
| V. State Privacy Laws | State authority, state data privacy and security laws, state breach notification |
IAPP publishes a blueprint with the minimum and maximum number of questions per area. We could not retrieve the per-domain counts, so use IAPP’s own blueprint to decide where to spend your time.
Where the two overlap
There is less overlap than people expect, but some ideas carry across: data subject rights and consumer rights, security and breach duties, accountability programs, workplace data, marketing consent. If you study one first, the second becomes faster because you already know the concepts and only need to learn the legal mechanics.
The Exam Experience
Both exams share the same structure: 90 multiple-choice questions in 2.5 hours, with a 15-minute break included in that time. IAPP’s handbook says 75 questions are scored and 15 are unscored trial items, and you will not know which are which. You can take either exam in a Pearson VUE test center or online with a proctor, and you must sit it within one year of buying it.
Scores are scaled from 100 to 500 and the pass mark is 300. That is not 50% correct, so do not judge your readiness by a simple percentage. Instead, aim to be consistently well above the pass mark on timed practice sets from different sources.
The question style is the same on both: short scenarios and direct legal-knowledge questions. You will get questions that ask which law applies, who the competent authority is, which obligation is triggered, or what a company must do next. Close reading matters, because two options are often both partly right and the correct one is the one that fits the scenario’s jurisdiction, sector or role.
The CIPP/E is offered in English, German and French. The CIPP/US is offered in English.
Cost: What You Pay
| Item | CIPP/E | CIPP/US |
| Exam fee | US$550 | US$550 |
| Certification maintenance fee | Charged for activation and each two-year term. Included in IAPP membership | Same |
| Retake | Check the current IAPP price before you plan | Same |
The IAPP store page says non-members are encouraged to buy the maintenance fee together with the exam so the certification activates on passing. If you plan to take more than one IAPP exam, membership can work out cheaper because the maintenance fee is built into it, but compare the numbers on the IAPP site for the current year.
On top of fees, plan for your study resources: IAPP’s textbook and practice material, a question bank, and (for most people) a structured course. A realistic total for one certification is the exam fee plus a few hundred dollars in preparation material.
For a broader look at how the IAPP family fits together, see our CIPP vs CIPM comparison and our CIPM certification cost breakdown.
Who Should Take Which: A Decision Table
| Your situation | Start with | Why |
| Privacy role at a company that processes EU or UK customer data | CIPP/E | GDPR knowledge is the daily working language |
| DPO, privacy counsel or compliance lead in an EU-based organization | CIPP/E | It maps directly to your obligations |
| Privacy role at a US company serving mostly US customers | CIPP/US | The exam matches the laws you actually deal with |
| Healthcare, financial services or education privacy in the US | CIPP/US | Sector rules such as HIPAA, GLBA and FERPA are central |
| Legal or compliance career in the US with litigation exposure | CIPP/US | Covers government access, civil litigation and breach rules |
| Global privacy role covering both | Whichever you use more | You will study the second faster after the first |
| Career changer into privacy, no location preference | CIPP/E, if you are happy with a single regulation | Check job postings in your target market first, since GDPR knowledge is asked for widely |
| Student or graduate in the US who wants a first credential | CIPP/US | It aligns to the market you are applying in |
| Security professional adding privacy | Look at the CIPM, or the technical route through ISACA’s CDPSE or the IAPP CIPT | CIPP is law-heavy, so a technical or management path may fit better |
The simplest test is to open ten job postings for the role you want and see which law they name. That tells you what your next employer will actually ask about.
How Hard Is Each One?
IAPP does not publish pass rates, so any number you see online is a guess. What we can say from the structure:
- CIPP/E is a deeper dive into one system. Candidates with legal or compliance backgrounds usually adapt quickly, while those from technical backgrounds spend the first weeks building legal vocabulary.
- CIPP/US is broader. The difficulty is volume and keeping the laws apart (what HIPAA covers versus what GLBA covers, which entity enforces which statute, which laws have a private right of action).
Neither is easy to pass on a casual read-through. Most candidates who do well treat both as legal study courses and use active recall, not just reading.
Study Plans
CIPP/E: 8 to 10 weeks at 6 to 8 hours per week
| Weeks | Focus |
| 1 to 2 | European institutions, legal framework and the history behind GDPR |
| 3 to 4 | GDPR core concepts, principles, lawful bases, data subject rights |
| 5 | International transfers and the mechanisms that allow them |
| 6 | Scope, accountability, supervision, enforcement and penalties |
| 7 | Employment, surveillance, marketing and online technology rules |
| 8 to 10 | Timed practice, error log review, weak-area reading |
CIPP/US: 8 to 10 weeks at 6 to 8 hours per week
| Weeks | Focus |
| 1 | The US legal framework, enforcement bodies and information management principles |
| 2 to 3 | FTC authority and consumer protection, plus the sector laws |
| 4 | Telecommunications, marketing and direct communication rules |
| 5 | Government and court access, then workplace privacy |
| 6 to 7 | State privacy laws and breach notification |
| 8 to 10 | Timed practice, comparison tables, error log review |
For both, build a one-page summary per law or topic and review them weekly. Our CIPP/E exam page and CIPP/E practice questions and CIPP/US practice questions, plus the CIPP/US exam page, are useful for checking how well the material sticks once you have finished a first pass.
Mistakes That Cost Candidates
- Studying the wrong jurisdiction. Buying a global privacy course and assuming it covers the exam. The exam is specific to Europe or the US.
- Reading without testing. Law is easy to recognize on the page and hard to recall under timed conditions.
- Treating the CIPP/US as “easier”. It is easier to start and harder to keep organized.
- Ignoring the exam refresh. Both exams have had recent content updates, so older notes and books may be out of date. Check the study guide version.
- Memorizing penalties and thresholds without context. Questions usually wrap them in a scenario.
- Skipping the recertification plan. You need 20 CPE hours every two years for each credential you hold, so keep a record from the beginning.
Recertification and Keeping Both
Per the IAPP handbook, each credential needs 20 CPE hours per two-year term, with a minimum number from IAPP-recognized activities, and the maintenance fee must be paid. If you hold both CIPP/E and CIPP/US, each credential has its own requirement, though IAPP’s rules on how CPE can be applied across credentials are worth checking on its site.
If you also plan to add a privacy management or technology credential later, the IAPP family is designed to stack. Our AAISM vs AIGP comparison covers the AI governance side of that path.
Is It Worth It?
For a privacy career, yes, as long as you pick the credential that matches your market. IAPP certifications are widely recognized by employers, and the CIPP/E and CIPP/US are the two most common ones. We have left salary figures out because we could not find a source that separates people who hold these credentials from the wider compliance and legal population, and a loose average would mislead more than it helps.
Which one to take first, if you are still undecided: look at where your data subjects live and which regulator would call you after a breach. That is the exam to start with. For the official body of knowledge, the exam blueprint and current fees, see the IAPP’s CIPP/E certification page.
FAQs
1. Should I take CIPP/E or CIPP/US first?
Take the one that matches the law you use at work. If you handle European personal data, start with CIPP/E. If your role is mostly US federal and state compliance, start with CIPP/US.
2. Is CIPP/E harder than CIPP/US?
IAPP does not publish pass rates. CIPP/E goes deep on one regulation, while CIPP/US covers many laws with more to organize and remember. Which one feels harder depends mostly on your background.
3. How much does each exam cost?
The IAPP store lists both at US$550 for members and non-members. A maintenance fee applies separately and is included with IAPP membership.
4. How many questions are on the exams?
Both have 90 multiple-choice questions in 2.5 hours, including a 15-minute break. IAPP’s handbook says 75 are scored and 15 are unscored.
5. What is the passing score?
The passing score on IAPP exams is 300 on a scale of 100 to 500. That is a scaled score, not a plain percentage.
6. Are there prerequisites?
No. You can sit either exam without work experience or a legal degree.
7. Can I take the exams online?
Yes. Both can be taken online with a proctor through Pearson VUE or in person at a test center. You must sit the exam within one year of purchase.
8. In which languages are the exams offered?
CIPP/E is offered in English, German and French. CIPP/US is offered in English.
9. Do I need both?
Not unless your job spans both regions. Many professionals hold one and add the second when their role expands.
10. How long should I study?
Plan on about 8 to 10 weeks at 6 to 8 hours per week for either exam if you are new to the material. Candidates with strong legal or compliance backgrounds may need less.
11. How often do I need to recertify?
Every two years, with 20 CPE hours per credential and a maintenance fee, according to IAPP’s handbook. Verify the current rules on the IAPP site.
12. Is the content changing?
Yes. The CIPP/US had additional content for exams on or after September 1, 2025, and the CIPP/E study guide is dated September 2025. Use current materials.
13. What can I take after CIPP/E or CIPP/US?
Many candidates add the CIPM for program management or the CIPT for technology. Our CIPP vs CIPM guide explains how to decide.
