IAPP certifications: CIPP, CIPM & CIPT hub

The IAPP CIPP U.S. Private Sector certification covers the five objectives, or domains, listed below: 

1. Introduction to the U.S. privacy environment (38%): Provides a structural overview of the U.S. legal system and the branches of government. Covers regulatory authorities and how laws are enforced at a national level. Includes a view of information management from a U.S. perspective and how privacy and security laws are enforced by the government.
2. Limits on private-sector collection and use of data (27%): Covers regulatory and enforcement policies of the FTC and limitations of collecting data from medical, financial and educational sectors. Includes ethics and laws surrounding the collection and dissemination of telecommunications and marketing data.
3. Government and Court Access to Private-sector Information (8%): Includes limitations and protections of data by law enforcement and those during civil litigation. Also includes laws and exceptions of data collection as it pertains to national security.
4. Workplace Privacy (10%): Covers tools and methods for maintaining workplace privacy, including how to maintain it before, during, and after employment. Includes all relevant workplace privacy laws and how to manage privacy before, during, and after employee terminations, as well as laws surrounding employee monitoring.
5. State Privacy Laws (17%): Covers specific privacy laws enacted by states with a focus on the collection and protection of digital data. Also defines how federal and state authorities work together to enforce privacy laws and the jurisdictions of each.

The IAPP CIPP Europe certification certification covers the three objectives, or domains, listed below: 

1. Introduction to European data protection (10%): Covers the history of European privacy law and the current legal framework for data privacy in the E.U. Includes an overview of the E.U. institutions that regulate privacy laws.

2. European data protection saw and regulation (71%): Includes an in-depth look at the concepts and principles that guide data privacy regulations in the European Union. Covers processing laws, how they're governed within the E.U. and how they're maintained internationally. Includes enforcement of these laws and consequences for their violation. 
3. Compliance with European data protection saw and regulation (19%): Covers the responsibilities of employers and organizations regarding E.U. data privacy in the workplace. Includes regulations on surveillance, direct marketing and IT.

The IAPP CIPT certification covers the seven objectives, or domains, listed below: 

1. Foundational principles (12%): Covers the basics of information privacy, including the average data life cycle, value-sensitive design models and the foundational principles of privacy by design. Includes commonly used privacy risk models and frameworks that can be applied to different organizational models.
2. Role of IT in privacy (15%): Covers the basics of information security and the role of IT in privacy design to give a better picture of where IT fits in overall privacy strategies. Includes the most common privacy responsibilities of IT professionals from the ground up.
3. Privacy threats and violations (17%): Includes common risks to privacy during data collection, usage and dissemination. Includes information on software security implementation and management. Also covers less obvious threats from intrusion, decisional interference and self-representation.
4. Technical measures and privacy-enhancing technologies (18%): Covers how to use the latest in privacy technology and strategies for technology to reduce privacy threat risk. Includes data-oriented strategies and techniques and process-oriented strategies.
5. Privacy engineering (12%): Covers the role engineers play in maintaining organization-wide privacy. Outlines common privacy objectives for engineers and privacy design patterns that can be implemented to reduce risk. Includes common privacy risks in software and how they can be mitigated.
6. Privacy by design methodology (11%): Covers the latest methodology for the Privacy by Design process and the importance of frequent monitoring of how this process is enacted in organizations.
7. Technology challenges for privacy (15%): Covers the latest technologies that pose risks to privacy, including automated decision-making, tracking and surveillance, anthropomorphism, ubiquitous computing and mobile social computing.

The IAPP CIPM certification covers the six objectives, or domains, listed below: 

1. Developing a framework (21%): Covers how to create a solid foundation for a privacy program and details who is responsible for what tasks to keep it running. Includes how to adapt a program's governance model to specific privacy strategies. Covers laws and regulations related to programs.
2. Establishing a program governance (19%): Covers how to institute privacy programs and requirements across an organization and how to establish roles and responsibilities for those involved. Includes how to define privacy metrics for oversight and how to institute information privacy training.
3. Assessing data (19%): Covers how to assess potential privacy threats to an organization's information systems and processes. Includes how to pinpoint weaknesses to secure policies and procedures across an organization and how to prepare for potential threats. 
4. Protecting personal data (15%): Covers different levels of protection of an organization's personal data. Explores security controls and technology that protect personal employee and customer data for companies of varying sizes and industries. Includes how to enact these strategies company-wide.
5. Sustaining program performance (10%): Covers how to maintain privacy strategies and policies after they're created. Includes auditing and risk assessment techniques and ways to use metrics to judge the performance of implemented privacy policies and programs. 
6. Responding to requests and incidents (16%): Covers methodology for responding to privacy requests and how to create an incident response plan if leaks or violations occur. Includes how to perform risk assessment after incidents occur, how to prevent incidents from spreading throughout data systems and how to course correct after incidents.

To begin, enroll in training courses for each IAPP exam you plan on taking. There are online classes and boot camps for IAPP CIPP/US, IAPP CIPP/E certification, IAPP CIPT certification and IAPP CIPM certification that comprehensively cover the latest bodies of knowledge for these exams. Once you've completed the relevant courses, IAPP sells some of the most popular data privacy books on data privacy from the foremost experts in the field, as well as practice tests for the four exams mentioned above. Exam blueprints and other free resources give candidates a rough idea of the topics covered and how much weight is attributed to each domain in the exam.

Grading for these exams is based on the total number of scored questions answered correctly, and candidates need a cumulative score of 300 (on a scale of 100-500) to pass and receive their certification. This is true for all exams offered by IAPP.

While there are no published data on first-time pass rates, many people who have taken the CIPP U.S. Private-sector exam report it being the toughest of the four exams covered because it has the widest-reaching BOKs of any IAPP certification. Candidates report that CIPP Europe exams are slightly easier due to fewer domains covered, but they are still quite challenging. Rigorous and comprehensive studying using training courses, paid materials and free materials is highly recommended to earn IAPP CIPP certification.

How difficult the CIPT exam will be depends on your experience, your exam preparation approach and how well you take tests. IAPP training partners like Infosec offer an Exam Pass Guarantee, which means if you don't pass your exam on the first attempt, you can get a second attempt at no cost to you.

As mentioned above, your chances of passing the CIPM exam depend on your experience and how well you prepare for the exam. IAPP training partners like Infosec offer an Exam Pass Guarantee, which means if you don't pass your exam on the first attempt, you can get a second attempt at no cost to you.

Professionals with this certification are experts on European Union privacy law and understand how it interacts with U.S. privacy law. Some of the jobs CIPP/E holders have are similar to CIPP/US holders and include:

• Data protection officer

• Compliance and regulation associate

• Privacy analyst/consultant

• Institutional privacy oversight manager

• Technical privacy investigator

IT professionals with CIPT certification understand the ins and outs of protecting privacy data on a technical level. They know the latest privacy techniques for systems and applications and are aware of weak points in information life cycles. Some of the jobs CIPT holders enjoy can include:

• Compliance manager

• Privacy program manager

• Data governance and privacy operations analyst

• Privacy engineer

• IT internal auditor

CIPM is a management-level privacy certification, so most holders have all the above knowledge and more about instituting privacy programs across an organization. They can train employees in the latest security techniques and develop policies that protect employees and customers. Some jobs held by professionals with CIPM certification include:

• Data privacy manager/advisor

• Privacy program manager

• Lead privacy analyst

• Privacy director

• Director of governance, risk and compliance

According to the IAPP salary survey, "Respondents with any one IAPP certification earned over 13% more than those with no IAPP qualifications, while those with multiple IAPP certifications earned just over 27% more than those with no IAPP qualifications."

IAPP estimates that the average base salary for internal privacy professionals is $146,200. 

As of 2019, the IAPP reported that over 25,000 certifications had been issued and, as the leading privacy certifications in the U.S., the current number is likely much higher.

CIPP U.S. Private-sector is a requested certification in data-privacy-related job listings. General job boards like Indeed, Monster, Glassdoor, LinkedIn and CareerBuilder allow you to search by keywords like “CIPP/US” or relevant job titles for open roles.

There are also cyber-specific job boards, such as ClearedJobs, infosec-jobs.com and others. Another great way to find CIPP/US job openings is by joining local and national cybersecurity groups — such as ISSA, or Women in Cybersecurity — joining local meetups or engaging in cybersecurity forums and websites.

To prepare for your job interview, download our free ebook of cybersecurity interview tips: How to stand out, get hired and advance your career.