Failed CIPP/US (Certified Information Privacy Professional/United States)? Here's Your Recovery Plan

Pro tip: A missed appointment is recorded as a no-show, consumes the purchased attempt and cannot be rescheduled, so a new exam must be bought. IAPP will consider reopening a no-showed exam only for unavoidable circumstances such as a medical emergency, handled case by case through Pearson VUE. An exam ended by a proctor for a rules violation is permanently closed and all fees are forfeited, though Pearson VUE will review a dismissal the candidate believes was made in error and will reopen the exam if no rule was broken.

• Treating the five domains as equally sized because there are five of them.
  The blueprint gives Domain I 27 to 33 questions and Domain V 17 to 21, while Domain III gets 3 to 5 and Domain IV gets 4 to 6. Domains I and V can supply up to 54 of the 90 questions between them.
• Studying an older edition of the body of knowledge.
  IAPP reviews the body of knowledge annually and changes roughly 10 to 15 percent of exam content each update, announced at least 90 days ahead. Check the effective date printed on your copy before you start.
• Guessing part of a multi-select answer and expecting partial credit.
  IAPP awards no partial credit. A multi-select item names the exact number of responses to pick, and you get the item right only by selecting exactly that number correctly.
• Planning to revisit early questions at the end of the exam.
  The 15-minute break splits the paper in half, and the first 45 questions must be submitted before the break with no return afterwards. Finish every flagged item in the first half before you accept the break.
• Reading 300 out of 500 as 60 percent and studying to that target.
  IAPP states directly that 300 does not represent 60 percent. The cut score is set by an exam development board through psychometric analysis and then mapped to 300, so no percentage target can be derived from the scale.
• Learning federal statutes and treating state law as background reading.
  Domain V carries 17 to 21 questions and covers CCPA as amended by CPRA, the Delete Act, Washington My Health My Data, Nevada SB 370, the Illinois GIPA class actions, biometric restrictions and AI bias rules. It is nearly as large as the whole federal domain.
• Confusing the HIPAA privacy rule with the HIPAA security rule.
  The privacy rule governs use and disclosure of protected health information. The security rule governs administrative, physical and technical safeguards for electronic PHI. Questions frequently name one and test the other.
• Passing the exam and assuming the certification is active.
  IAPP requires either a 250 USD certification maintenance fee for the term or IAPP membership at 295 USD annually before the certification counts as valid. Until one is paid, no certificate is issued and the credential does not appear.
• Booking the exam and then trying to reschedule inside two days.
  Pearson VUE requires at least 48 hours notice to cancel or reschedule an in-person appointment. Remote appointments can be rescheduled up to 15 minutes after the scheduled start. Missing an appointment consumes the attempt and cannot be rescheduled.
• Averaging the domain percentages on a failed score report to work out how close you were.
  IAPP warns against this explicitly. Blueprint domains hold different question counts, so their percentages cannot be averaged into an overall score. Use the breakdown only to rank domains for restudy.

• 90 questions in 2.5 hours, with a break at the halfway point
• Scored on a 100 to 500 scale with a pass at 300, which IAPP states does not represent 60 percent
• Domain I supplies 27 to 33 questions and Domain V supplies 17 to 21, so those two carry the exam
• Multi-select questions award no partial credit, you must pick the exact number requested
• State law is now a third of the paper: CCPA and CPRA, My Health My Data, GIPA, biometric and AI bias laws
• The exam is closed to review once you submit the first half, so pace 45 questions in 75 minutes