CIPP/US Practice Test

The CIPP/US (Certified Information Privacy Professional/United States Exam) is a top certification. It shows you know a lot about US privacy laws and practices. Passing this exam means you understand how to handle privacy well. This certification is very important for those in data privacy, compliance, and security. It shows you're serious about keeping information safe.

CIPP/US Exam at a Glance

What changed for CIPP/US in 2026

• Apr 7, 2026: IAPP's Continuing Professional Education Policy, applicable to CIPP/US certification maintenance, became effective as version 3.3.1 on April 7, 2026, superseding version 3.3.0.^[6]

According to International Association of Privacy Professionals, “The CIPP/US is a 2.5 hour exam composed of 90 items.”^[1]

CIPP/US content outline and where to practise each area

The content areas below are copied from the official CIPP/US content outline published by International Association of Privacy Professionals. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through CIPP/US questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: Why is training important in privacy program management?

1. To reduce server downtime
2. To meet contractual obligations
3. To educate employees on data protection
4. To boost sales

Answer: C. To educate employees on data protection

Explanation:

The correct answer is that training exists to educate employees on data protection. People handle personal data every day, so a privacy program only works if staff understand their responsibilities, the organisation's policies and the risks involved.

Reducing server downtime is an IT availability goal, not what privacy training is for. Meeting contractual obligations can be a side benefit, because some contracts require training, but it is not the reason training matters to the program itself. Boosting sales is a commercial aim unrelated to privacy governance.

The rule to remember: policies on paper do not change behaviour. Training and awareness turn written rules into daily practice, which helps prevent incidents, supports compliance and builds a privacy-aware culture. When an exam asks why a program activity exists, choose the answer that links it to protecting personal data.

Example 2

Question: An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:

1. Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis
2. File it with the EEOC within 30 days
3. Disclose it to HR and the employee's entire team to facilitate the accommodation
4. Retain it in the general personnel file for documentation purposes

Answer: A. Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis

Explanation:

The correct answer is to keep the medical information confidential and share it only with people who have a specific need to know. The ADA treats medical information gathered during the accommodation process as confidential, so it is held separately and disclosed narrowly, for example to a supervisor who must carry out the accommodation.

Filing it with the EEOC within 30 days is wrong because there is no such duty on the employer. Disclosing it to HR and the entire team is wrong because it goes far beyond need to know. Keeping it in the general personnel file is wrong because medical records are normally stored apart from ordinary personnel records.

The rule to remember: employee medical data is confidential, stored separately, and shared only to the extent needed to act on it.

Example 3

Question: Under the HIPAA Privacy Rule, patients have the right to do all of the following EXCEPT:

1. Request access to their PHI
2. Request an amendment to their PHI
3. Receive an accounting of disclosures of their PHI
4. Prohibit all sharing of their PHI for treatment purposes

Answer: D. Prohibit all sharing of their PHI for treatment purposes

Explanation:

The correct answer is the option saying patients may prohibit all sharing of their PHI for treatment purposes, because the question asks for the right patients do not have. The HIPAA Privacy Rule lets covered entities use and disclose PHI for treatment, payment and healthcare operations without a separate authorization, so a patient cannot block treatment-related sharing outright.

The other options are real rights. Patients can request access to their PHI, can request an amendment to it, and can receive an accounting of certain disclosures.

The rule to remember: HIPAA gives patients access, amendment, accounting and similar controls, but it does not give an absolute veto over routine sharing needed for care. In EXCEPT questions, read the stem twice and look for the statement that is false.

How to use these practice tests

Start with the official outline from IAPP and list the five content areas on this page. Take one practice set for each area and treat the result as a diagnosis, not a grade. Note every question you miss and write down the rule behind the right answer in your own words.

Next, read the matching official material for your weakest areas and return to the same set a few days later. If you get a question right only by guessing, count it as a miss. Spend extra time on federal statutes, because many questions depend on knowing which law applies to which organisation and which data.

Use the workplace and state-law sets to practise comparison. Make a short table of how the rules differ rather than memorising each one separately. Then mix topics so you are not relying on knowing which area a question comes from.

Before test day, do a timed session sized to the real exam: 90 items in 2.5 hours. Check the booking, proctoring and ID rules on the IAPP site, and decide whether you will test virtually or at a center. Keep in mind that our questions are written by us and are not real exam questions.

Key Takeaways

Free CIPP/US Practice Test Online

• The CIPP/US certification validates expertise in US privacy laws and regulations.
• Earning the CIPP/US demonstrates proficiency in managing effective privacy programs.
• The certification is valued by professionals in data privacy, compliance, and information security.
• Passing the CIPP/US exam requires a thorough understanding of privacy principles and best practices.
• Obtaining the CIPP/US certification can enhance career opportunities and demonstrate a commitment to privacy.

Understanding the CIPP/US (Certified Information Privacy Professional/United States Exam) Test

The CIPP/US exam checks if you know US privacy laws well. You need to understand laws like the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act (HIPAA). Also, the Fair Credit Reporting Act and the EU's General Data Protection Regulation (GDPR) are important.

Data Privacy Laws and Regulations

This exam tests your ability to work with these laws. You must know the main points of each law. This includes how data is collected, used, and stored. You also need to know the rights of individuals and what organizations must do.

Privacy Program Management

The exam also looks at your skills in managing a privacy program. You need to know how to find and fix privacy risks. You must also set up controls and make sure everything follows the rules.

• Identifying and assessing privacy risks
• Developing and implementing privacy policies and procedures
• Implementing data protection controls and security measures
• Monitoring and maintaining compliance with data privacy laws

By showing you're good at these things, you can help companies deal with data privacy laws. You ensure they follow the rules and protect people's privacy rights.

Preparing for the CIPP/US Certification Exam

To pass the CIPP/US certification exam, you need to know a lot about privacy. This includes how personal info is collected, used, stored, and thrown away. You must also follow all data privacy laws and rules.

Privacy Operational Life Cycle

Understanding the privacy life cycle is key. It covers getting, using, storing, and getting rid of personal info. Knowing the best ways to handle each step is very important.

Privacy Risk Assessment and Mitigation

Being able to find and fix privacy risks is a big part of the exam. You should know how to spot risks, figure out their impact, and come up with good solutions. It's also important to know how to handle data breaches and work with vendors.

FAQs

What is the CIPP/US (Certified Information Privacy Professional/United States Exam) certification?

The CIPP/US certification shows you know a lot about US privacy laws. It proves you can handle privacy well. It's a big deal in the field.

What topics are covered in the CIPP/US exam?

The exam tests your knowledge of US privacy laws. This includes the Gramm-Leach-Bliley Act and HIPAA. You also need to know about privacy management and risk assessment.

How can I prepare for the CIPP/US certification exam?

Start by learning about the privacy life cycle. This includes how information is collected and stored. You also need to know how to manage risks and create privacy policies.

What are the benefits of obtaining the CIPP/US certification?

Getting certified shows you're an expert in US privacy laws. It's a big plus for your career. It can lead to better jobs and higher pay.

What are the compliance requirements and regulations covered in the CIPP/US exam?

The exam covers many US privacy laws. This includes the Gramm-Leach-Bliley Act and HIPAA. You need to know how these laws affect privacy management.

What is the importance of privacy risk assessment and mitigation in the CIPP/US certification?

Risk assessment and mitigation are key parts of the exam. You need to show you can find and fix privacy risks. This keeps information safe and follows the law.

How does the CIPP/US certification differ from other privacy and cybersecurity certifications?

The CIPP/US focuses on US privacy laws. It's different from other certifications that cover more areas. It shows you really know US privacy rules.

Sources & last verified

1. International Association of Privacy Professionals — number of questions (official source). “The CIPP/US is a 2.5 hour exam composed of 90 items.” Verified Oct 15, 2026.
2. International Association of Privacy Professionals — exam fee, delivery (official source). “Member Price: 550.00 USD Non-member Price: 550.00 USD” Verified Oct 17, 2026 · source checked Oct 17, 2026.
3. International Association of Privacy Professionals — passing score, registration opens, testing window (official source). “The passing score for all IAPP exams is 300 (which does not represent 60%).” Verified Oct 16, 2026 · source checked Oct 16, 2026.
4. assets.contentstack.io — retake policy, score release (official source). “sooner than seven days after their prior attempt.” Verified Oct 16, 2026 · source checked Oct 16, 2026.
5. International Association of Privacy Professionals — validity, registration deadline (official source). “per two-year certification term” Verified Oct 19, 2026 · source checked Oct 19, 2026.
6. assets.contentstack.io — other (official source). “Effective date: 07 April 2026 Version: 3.3.1 Supersedes: 3.3.0” Verified Oct 16, 2026 · source checked Oct 16, 2026.
7. assets.contentstack.io — other (official source). “domain i - the u.s. privacy environment” Verified Nov 1, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.