CIPP/E (Certified Information Privacy Professional - Europe)

Key Topics to Master:

• Historical rationale for data protection and early human rights instruments
• OECD Guidelines, the Treaty of Lisbon, Convention 108 and Convention 108+
• How the harmonised European approach developed, and challenges such as Brexit
• Roles of the Council of Europe, the European Court of Human Rights, the European Parliament, the European Commission, the European Council and the Court of Justice of the European Union
• The 1981 Council of Europe Convention on automatic processing of personal data
• Directive 95/46/EC, the ePrivacy Directive 2002/58/EC as amended, and the Electronic Commerce Directive 2000/31/EC
• Principles and goals of GDPR (EU) 2016/679
• The NIS and NIS 2 Directives and the EU Artificial Intelligence Act

Key Topics to Master:

• Personal data, sensitive personal data and special categories of personal data
• Pseudonymous versus anonymous data and the difference between them
• Controller, processor and data subject, with EDPB guidance on the distinction
• Appropriate technical and organisational measures such as encryption and access controls
• Breach notification requirements and risk reporting, with EDPB guidance
• Vendor management and sharing personal data with third parties
• Rights of access, rectification, erasure and the right to be forgotten
• Rights of restriction, objection and data portability, plus rights around automated decision-making and profiling
• Consent and the right of withdrawal, and restrictions on data subject rights

Key Topics to Master:

• Fairness and lawfulness, purpose limitation, proportionality, accuracy, storage limitation and integrity and confidentiality
• The lawful bases: consent, contractual necessity, legal obligation, vital interests, public interest and legitimate interest
• Processing of special categories of personal data
• The transparency principle, key components of privacy notices and layered notices
• The rationale for prohibiting transfers and the concept of adequate jurisdiction
• Safe Harbor, Privacy Shield, the Schrems decisions and the EU-US Data Privacy Framework
• Standard Contractual Clauses and Binding Corporate Rules
• Codes of conduct, certifications and derogations
• Transfer impact assessments and EDPB guidance on them

Key Topics to Master:

• Establishment and non-establishment in the EU, with EDPB guidance
• Territorial and material scope of the GDPR and its exemptions
• Accountability duties of controllers, joint controllers and processors
• Data protection by design and by default
• Documentation obligations and cooperation with regulators
• Data protection impact assessments and the established criteria for conducting one
• The mandatory data protection officer requirement and the role of auditing in a privacy programme
• Roles and powers of the EDPB, the EDPS and national supervisory authorities, and the lead supervisory authority concept
• GDPR infringement procedures, fine tiers, class actions and compensation to data subjects

Key Topics to Master:

• Legal basis for processing employee data, personnel record storage and the risks in handling employee data
• Workplace monitoring, data loss prevention and bring your own device programmes
• EU works councils and whistleblowing systems
• Surveillance by public authorities and the laws on interception of communications
• CCTV, geolocation and biometrics or facial recognition, with EDPB guidance
• Marketing compliance requirements and online behavioural targeting
• Cloud computing compliance issues
• Web cookies, social media platforms and dark patterns
• Search engine marketing, and the compliance and ethical issues raised by artificial intelligence and machine learning

• 1Download the current CIPP/E Body of Knowledge and Exam Blueprint from iapp.org and check the version and effective date on the cover, since the IAPP reviews it annually and gives 90 days notice of changes
• 2Copy the five domains and their question ranges into a tracker so you know Domain II carries 18 to 28 questions and Domain I only 7 to 13
• 3Buy the exam and note the one-year deadline to schedule and sit it
• 4Read GDPR Articles 1 to 11 in the official text, not in a summary
• 5Decide now between a Pearson VUE test centre and OnVUE, because the reschedule deadlines differ sharply

• 1Learn what Convention 108 did and what Convention 108+ changed
• 2Build a one-page map distinguishing the Council of Europe, the European Council, the Council of the EU, the Commission, the Parliament, the CJEU and the ECHR, because these are the questions candidates lose to confusion rather than ignorance
• 3Read the recitals to Directive 95/46/EC and note what the GDPR carried over
• 4Skim the NIS 2 Directive and the EU AI Act for their stated purpose and scope, which is the depth Domain I asks for

• 1Work through GDPR Articles 4, 5, 32, 33 and 34 line by line
• 2Write out the difference between pseudonymous and anonymous data with a worked example, since this distinction recurs across domains
• 3Learn the 72-hour breach notification obligation, who it runs to and when data subjects must also be told
• 4Read the EDPB guidelines on controller and processor concepts and take notes on the joint controller examples

• 1Read GDPR Articles 12 to 23 and build a table with one row per right: scope, time limits, grounds for refusal and interaction with other rights
• 2Learn where restriction and objection differ, because scenario questions hinge on it
• 3Study Article 22 on automated decision-making including profiling, and the exceptions
• 4Read the EDPB guidelines on the right of access and on the right to be forgotten
• 5Self-test on 8 to 12 rights questions, matching the blueprint weighting for this competency

• 1Memorise the six lawful bases and be able to identify which applies in a scenario, plus the extra Article 9 conditions for special category data
• 2Learn the legitimate interests balancing test as a three-step structure you can apply on the spot
• 3Study Articles 13 and 14 and list what a privacy notice must contain in each case
• 4Understand why layered notices exist and what the EDPB says about transparency

• 1Trace the chain from Safe Harbor to Schrems I to Privacy Shield to Schrems II to the EU-US Data Privacy Framework, with what each decision actually held
• 2Learn the difference between an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, codes of conduct, certifications and Article 49 derogations
• 3Study what a transfer impact assessment is for and what EDPB guidance says about supplementary measures
• 4Take the IAPP practice exam for the first time and score it by domain rather than overall

• 1Work through Article 3 on territorial scope, including the targeting and monitoring limbs, and Article 2 on material scope and exemptions
• 2Learn when a DPIA is mandatory under Article 35 and what the established criteria are
• 3Learn when a DPO is mandatory under Article 37 and what independence requirements attach
• 4Study the one-stop-shop and lead supervisory authority mechanism, and how the EDPB consistency mechanism resolves disputes
• 5Memorise the two fine tiers in Article 83 and which infringements fall into each

• 1Study employment data: lawful bases in the employment context, personnel record retention, monitoring limits and BYOD
• 2Learn the role of works councils and the rules on whistleblowing systems
• 3Cover CCTV, geolocation and biometric processing, with the EDPB guidance on each
• 4Study the ePrivacy rules on cookies alongside GDPR consent, since candidates commonly answer the cookie questions using GDPR alone
• 5Read the EDPB material on dark patterns on social media platforms and the compliance issues around AI and machine learning

• 1Sit a full 90-question practice run in 2.5 hours, including a 15-minute break at the halfway mark to rehearse the real structure
• 2Practise submitting the first half without going back, because the real exam does not let you return to those questions
• 3Score by domain and rework the two weakest against the blueprint ranges
• 4Reread the GDPR articles behind every question you got wrong rather than the explanation alone

• 1Confirm the name on your MyIAPP profile exactly matches the ID you will present, and edit it in Edit My Profile if it does not
• 2For a test centre, plan to arrive 15 minutes early and confirm you have two qualifying forms of ID that meet Pearson VUE's requirements
• 3For OnVUE, use a personal computer rather than a work-issued one, turn off any VPN and run the system check on the same network you will test on
• 4Review only your rights table, lawful bases table and transfer mechanisms table
• 5After the exam, buy the certification maintenance fee or IAPP membership so the certification activates